Spyware / Malware / Virus Removal

[Closed] Your system is infected wallpaper

13 min read

Looking for the outcome? Ask AI

yaaaabuddy03 Topic Starter

Post #1January 25, 2010, 1:24 AM UTC

forums.whatthetech.com/your_system_infected_wallpaper_t108633.html I'm pretty sure I need what this guy got. I can't seem to get rid of this carp**, I've done all kinds of system restores, and it still comes back. Somebody help me, please! Paul

SweetTech

Post #2January 25, 2010, 1:42 AM UTC

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:

Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within five days. I will post a reminder should you seem to fail to do this, however, if you fail to reply within three days then,
unless I have been notified of your absence in advance, the topic shall be closed!
Please do not PM me directly for help. If you have any questions, post them in this topic.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your log, I will post back shortly with instructions.

yaaaabuddy03

Post #3January 25, 2010, 2:35 AM UTC

Sweet, I'm ready when you are. Paul

SweetTech

Post #4January 25, 2010, 2:55 AM UTC

While I am waiting for my post to you to be approved by one of my teachers, I'd like to known which computer I am working with. Is it your Laptop which is running Windows XP Pro or is it your Desktop that is running Windows 7?

yaaaabuddy03

Post #5January 25, 2010, 2:56 AM UTC

It is for my Laptop that is running XP Pro Paul

SweetTech

Post #6January 25, 2010, 9:19 PM UTC

Hello yaaaabuddy03,

Sorry for the delay in getting back to you.

Run exeHelper
Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Next:

OTL Custom Scan

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

Next:

Scanning with GMER

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Next:

Please make sure you include the following items in your next post:

1. The log that was produced after running exeHelper.
2. The logs that were produced after running OTL.
3. The log that was produced after running GMER.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

yaaaabuddy03

Post #7January 26, 2010, 12:51 AM UTC

exeHelper by Raktor Build 20091220 Run at 18:46:50 on 01/25/10 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished–

yaaaabuddy03

Post #8January 26, 2010, 1:00 AM UTC

When I click on the "OTL" link in your above post, it doesn't let me download anything. I tried to right click and save as (thinking that was the way to save it), but my computer wouldn't let me save it. Something with the virus wouldn't let me. Paul

SweetTech

Post #9January 26, 2010, 7:50 PM UTC

Try to use this link here instead. You can find instructions in my previous post to you that contains the directions for how to run OTL.

yaaaabuddy03

Post #10January 27, 2010, 9:45 AM UTC

OTL.Txt

OTL logfile created on: 1/27/2010 3:28:20 AM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Paul Lowery\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 35.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.66 Gb Total Space | 1.84 Gb Free Space | 6.20% Space Free | Partition Type: NTFS
Drive D: | 7.58 Gb Total Space | 0.85 Gb Free Space | 11.25% Space Free | Partition Type: FAT32
Drive E: | 5.54 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOWERYLAPTOP
Current User Name: Paul Lowery
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Paul Lowery\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\av.exe ()
PRC - C:\Documents and Settings\Paul Lowery\Local Settings\Temp\extrac64_cab.exe (Microsoft Corporation)
PRC - C:\Program Files\InternetSecurity2010\IS2010.exe (Internet Security)
PRC - C:\WINDOWS\system32\smss32.exe (IpVOPqgs)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe (Hewlett-Packard )
PRC - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
PRC - C:\Program Files\HPQ\Shared\HpqToaster.exe ()
PRC - C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\MSI\Star Key Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\MSI\Star Key Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Paul Lowery\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Computer, Inc.)
SRV - (hpqwmiex) – C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (btwdins) – C:\Program Files\MSI\Star Key Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (Ati HotKey Poller) – C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (hpqwmi) – C:\Program Files\HPQ\Shared\hpqwmi.exe (Hewlett-Packard Development Company, L.P.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (BTSERIAL) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTSLBCSP) – C:\WINDOWS\system32\drivers\btslbcsp.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (mdmxsdk) – C:\WINDOWS\system32\drivers\mdmxsdk.sys (Conexant)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…o&pf;=laptop
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: [removed]:1.2.1
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: {b6b69e50-3747-11dd-ae16-0800200c9a66}:1.2.1

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/22 02:43:12 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/23 18:51:49 | 00,000,000 | —D | M]

[2008/12/07 19:26:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Extensions
[2010/01/25 18:54:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions
[2009/11/02 18:47:21 | 00,000,000 | —D | M] (Toolbar Buttons) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/22 02:44:38 | 00,000,000 | —D | M] (No name found) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2010/01/22 02:44:38 | 00,000,000 | —D | M] (FoxyTunes) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}(2)
[2009/09/18 17:14:14 | 00,000,000 | —D | M] (Proto) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{b6b69e50-3747-11dd-ae16-0800200c9a66}
[2010/01/22 02:44:12 | 00,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2)
[2010/01/22 02:45:46 | 00,000,000 | —D | M] (No name found) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/01/22 02:44:53 | 00,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2010/01/22 02:44:54 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\newtaburl@sogame(2).cat
[2010/01/22 02:44:54 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\[removed]
[2010/01/22 02:44:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\personas@christopher(2).beard
[2010/01/22 02:45:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\[removed]
[2009/02/24 18:41:15 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\extensions\[removed]
[2010/01/21 13:08:36 | 00,001,720 | —- | M] () – C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Profiles\8xg9kged.default\searchplugins\youtube-video-search.xml
[2010/01/24 16:15:43 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2004/11/12 21:36:20 | 00,005,120 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Mozilla Firefox\plugins\NPAdbESD.dll
[2006/09/15 18:56:26 | 00,024,576 | —- | M] (StreamCast Networks, Inc.) – C:\Program Files\Mozilla Firefox\plugins\NPMorpBr.dll
[2007/04/16 11:07:12 | 00,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2004/08/04 02:00:00 | 00,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (ShoppingReport) - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (MorpheusToolbar BHO) - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (Morpheus)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Viewpoint Toolbar BHO) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.9.0\ViewBarBHO.dll (Viewpoint Corporation)
O3 - HKLM\..\Toolbar: (Morpheus Toolbar) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (Morpheus)
O3 - HKLM\..\Toolbar: (Viewpoint Toolbar) - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll (Viewpoint Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Morpheus Toolbar) - {3F3714A9-89A4-46BE-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (Morpheus)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [QPService] C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe (IpVOPqgs)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [extrac64_cab.exe] C:\Documents and Settings\Paul Lowery\Local Settings\Temp\extrac64_cab.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe (Internet Security)
O4 - HKCU..\Run: [Malware Defense] C:\Program Files\Malware Defense\mdefense.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\MSI\Star Key Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Send To &Bluetooth; - C:\Program Files\MSI\Star Key Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\Star Key Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\Star Key Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\helper32.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\helper32.dll ()
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\winlogon32.exe) - C:\WINDOWS\system32\winlogon32.exe (IpVOPqgs)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Paul Lowery\Application Data\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 22:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 14:01:14 | 00,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2009/04/29 20:57:16 | 00,054,544 | R— | M] (Electronic Arts) - E:\Autorun.exe – [ UDF ]
O32 - AutoRun File - [2008/10/21 16:22:16 | 00,000,045 | R— | M] () - E:\Autorun.inf – [ UDF ]
O33 - MountPoints2\{36990250-73be-11dc-97db-0014a5b9b55c}\Shell - "" = AutoRun
O33 - MountPoints2\{36990250-73be-11dc-97db-0014a5b9b55c}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{36990250-73be-11dc-97db-0014a5b9b55c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2006/04/19 21:52:14 | 00,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - C:\WINDOWS\system32\irmon.dll (Microsoft Corporation)
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error starting restore point: 31
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2010/01/27 03:24:32 | 00,548,864 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Paul Lowery\Desktop\OTL.exe
[2010/01/24 18:54:55 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/01/24 17:03:41 | 00,000,000 | —D | C] – C:\Program Files\Malware Defense
[2010/01/24 16:29:15 | 00,064,288 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/01/24 16:29:15 | 00,000,000 | —D | C] – C:\WINDOWS\System32\DRVSTORE
[2010/01/24 16:27:59 | 00,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/01/24 16:27:24 | 00,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/01/24 16:27:24 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/01/24 16:05:24 | 00,000,000 | —D | C] – C:\spoolerlogs
[2010/01/23 19:02:53 | 00,000,000 | —D | C] – C:\Program Files\InternetSecurity2010
[2010/01/23 19:02:27 | 00,020,480 | —- | C] (IpVOPqgs) – C:\WINDOWS\System32\winlogon32.exe
[2010/01/23 19:02:27 | 00,020,480 | —- | C] (IpVOPqgs) – C:\WINDOWS\System32\smss32.exe
[2010/01/22 22:56:39 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9 Installer
[2010/01/22 22:54:57 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2010/01/22 02:45:34 | 00,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/01/22 02:45:19 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2010/01/22 02:45:19 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2010/01/22 00:28:59 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR(2)
[2010/01/21 22:52:15 | 00,000,000 | —D | C] – C:\Documents and Settings\Paul Lowery\My Documents\Stuff to keep
[2010/01/17 21:56:40 | 00,000,000 | —D | C] – C:\Program Files\WindSolutions
[2010/01/17 21:53:10 | 00,000,000 | —D | C] – C:\Documents and Settings\Paul Lowery\Application Data\WindSolutions
[2010/01/17 21:53:01 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WindSolutions
[2010/01/05 22:30:01 | 00,000,000 | —D | C] – C:\Program Files\DivX
[2009/12/31 01:48:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Paul Lowery\My Documents\Electronic Arts
[2009/12/30 17:25:57 | 00,000,000 | —D | C] – C:\Program Files\Microsoft WSE
[2009/12/30 17:25:32 | 00,000,000 | —D | C] – C:\WINDOWS\Logs
[2009/12/30 17:04:18 | 00,000,000 | —D | C] – C:\Program Files\Electronic Arts
[2009/12/30 11:42:29 | 00,000,000 | —D | C] – C:\Program Files\Jetcast(2)
[2009/12/29 23:16:16 | 00,000,000 | —D | C] – C:\Documents and Settings\Paul Lowery\My Documents\Azureus Downloads
[2009/12/29 23:03:48 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Azureus
[2009/12/29 23:03:42 | 00,000,000 | —D | C] – C:\Documents and Settings\Paul Lowery\Application Data\Azureus
[2009/12/29 23:03:06 | 00,000,000 | —D | C] – C:\Program Files\Vuze(2)
[2009/07/22 01:28:03 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2007/04/07 23:55:03 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Viewpoint
[2006/04/19 22:58:33 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/04/19 22:58:33 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/04/19 22:58:30 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/27 03:24:37 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/27 03:24:33 | 00,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Paul Lowery\Desktop\OTL.exe
[2010/01/27 03:24:28 | 00,521,766 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/01/27 03:24:28 | 00,441,692 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/27 03:24:28 | 00,071,462 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/27 03:20:50 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/27 03:20:47 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\41.exe
[2010/01/27 03:20:10 | 00,002,931 | —- | M] () – C:\WINDOWS\System32\warning.html
[2010/01/27 03:20:03 | 00,000,273 | —- | M] () – C:\hpqp.ini
[2010/01/27 03:20:03 | 00,000,039 | —- | M] () – C:\XP_TV.ini
[2010/01/27 03:20:00 | 00,014,020 | -HS- | M] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\5sWWs1S67JJev
[2010/01/27 03:19:20 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/27 03:19:14 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/27 03:19:10 | 12,064,39936 | -HS- | M] () – C:\hiberfil.sys
[2010/01/25 21:52:46 | 03,932,160 | —- | M] () – C:\Documents and Settings\Paul Lowery\ntuser.dat
[2010/01/25 21:52:46 | 00,000,178 | -HS- | M] () – C:\Documents and Settings\Paul Lowery\ntuser.ini
[2010/01/25 21:37:18 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\28145.exe
[2010/01/25 21:29:27 | 00,180,736 | -HS- | M] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\av.exe
[2010/01/25 21:17:18 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\5705.exe
[2010/01/25 20:57:18 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\24464.exe
[2010/01/25 19:50:12 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\26962.exe
[2010/01/25 19:30:12 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\29358.exe
[2010/01/25 19:10:12 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\11478.exe
[2010/01/25 18:46:03 | 00,290,816 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\exeHelper.com
[2010/01/24 22:31:40 | 00,012,800 | —- | M] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/24 16:27:58 | 00,000,867 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/01/23 22:12:19 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/23 20:22:42 | 00,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/23 19:02:36 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 19:02:36 | 00,000,552 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/23 19:02:32 | 00,018,432 | —- | M] () – C:\WINDOWS\System32\helper32.dll
[2010/01/23 19:02:20 | 00,020,480 | —- | M] (IpVOPqgs) – C:\WINDOWS\System32\winlogon32.exe
[2010/01/23 19:02:20 | 00,020,480 | —- | M] (IpVOPqgs) – C:\WINDOWS\System32\smss32.exe
[2010/01/22 22:58:29 | 00,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/01/22 21:44:28 | 00,002,341 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/01/22 02:55:41 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/22 00:01:24 | 00,028,890 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\bookmarks-2010-01-22.json
[2010/01/20 18:44:02 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/19 23:29:35 | 00,007,477 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\Paul Lowery.jpg
[2010/01/18 19:34:57 | 00,100,069 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\tcp group.jpg
[2010/01/18 18:52:57 | 00,069,405 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\flag_bg.jpg
[2010/01/10 19:22:55 | 47,014,631 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\1043_898919.wmv
[2010/01/08 02:37:38 | 00,056,240 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\16837_625261149825_34415006_36555284_2143819_n.jpg
[2010/01/03 02:07:50 | 06,098,888 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\895572.WMA
[2010/01/03 02:07:22 | 05,277,216 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\895568.WMA
[2010/01/01 19:56:12 | 11,853,9219 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\894836.wmv
[2009/12/30 20:19:19 | 04,094,739 | —- | M] () – C:\Documents and Settings\Paul Lowery\Desktop\1231leach.pdf
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/25 21:45:40 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\41.exe
[2010/01/25 21:37:18 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\28145.exe
[2010/01/25 21:29:28 | 00,014,020 | -HS- | C] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\5sWWs1S67JJev
[2010/01/25 21:29:27 | 00,180,736 | -HS- | C] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\av.exe
[2010/01/25 21:17:18 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\5705.exe
[2010/01/25 20:57:18 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\24464.exe
[2010/01/25 19:50:12 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\26962.exe
[2010/01/25 19:30:12 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\29358.exe
[2010/01/25 19:10:12 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\11478.exe
[2010/01/25 18:46:02 | 00,290,816 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\exeHelper.com
[2010/01/24 18:55:19 | 00,015,880 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2010/01/24 16:35:11 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/24 16:27:58 | 00,000,867 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/01/23 22:12:19 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/23 19:02:36 | 00,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/23 19:02:32 | 00,018,432 | —- | C] () – C:\WINDOWS\System32\helper32.dll
[2010/01/23 19:02:29 | 00,002,931 | —- | C] () – C:\WINDOWS\System32\warning.html
[2010/01/22 22:58:28 | 00,001,729 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/01/22 00:01:24 | 00,028,890 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\bookmarks-2010-01-22.json
[2010/01/19 23:29:33 | 00,007,477 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\Paul Lowery.jpg
[2010/01/18 19:34:56 | 00,100,069 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\tcp group.jpg
[2010/01/18 18:52:56 | 00,069,405 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\flag_bg.jpg
[2010/01/10 19:21:44 | 47,014,631 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\1043_898919.wmv
[2010/01/08 02:37:38 | 00,056,240 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\16837_625261149825_34415006_36555284_2143819_n.jpg
[2010/01/03 02:07:42 | 06,098,888 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\895572.WMA
[2010/01/03 02:07:13 | 05,277,216 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\895568.WMA
[2010/01/01 19:53:11 | 11,853,9219 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\894836.wmv
[2009/12/30 20:19:11 | 04,094,739 | —- | C] () – C:\Documents and Settings\Paul Lowery\Desktop\1231leach.pdf
[2007/12/19 14:24:12 | 00,002,162 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/09/24 18:12:29 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/09/16 07:23:46 | 00,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2006/09/16 04:45:07 | 00,000,134 | —- | C] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\fusioncache.dat
[2006/09/15 22:41:25 | 00,012,800 | —- | C] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/19 23:53:25 | 00,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/04/19 23:40:16 | 00,002,499 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/04/19 23:31:35 | 00,000,056 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/04/19 23:27:59 | 00,000,166 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/04/19 23:22:23 | 00,028,836 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/12/02 04:09:10 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/09/19 14:50:42 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2004/08/07 07:16:44 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/07 07:10:08 | 00,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/01/07 14:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/05/15 22:29:04 | 00,000,607 | —- | C] () – C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2001/11/23 17:18:00 | 00,000,597 | —- | C] () – C:\WINDOWS\System32\btcss.dll.manifest
[2001/11/14 12:56:00 | 01,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2008/12/15 17:44:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/12/29 23:03:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2006/04/19 23:56:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2009/07/18 17:17:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/01/17 21:56:34 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WindSolutions
[2009/12/24 18:15:34 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/01/24 16:28:01 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2006/09/16 07:33:39 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\acccore
[2010/01/22 02:40:49 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Azureus
[2006/09/15 17:27:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Leadertech
[2006/09/15 19:17:56 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Morpheus
[2010/01/23 22:42:33 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\ShoppingReport
[2007/04/01 20:09:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\Viewpoint
[2010/01/22 02:44:45 | 00,000,000 | —D | M] – C:\Documents and Settings\Paul Lowery\Application Data\WindSolutions
[2010/01/27 03:24:37 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/04 07:00:00 | 18,738,937 | —- | M] () .cab file – C:\I386\sp2.cab:AGP440.sys
[2004/08/04 02:00:00 | 18,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 05:51:44 | 20,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 05:51:44 | 20,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/14 00:06:40 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\agp440.sys
[2008/04/14 00:06:40 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 07:00:00 | 18,738,937 | —- | M] () .cab file – C:\I386\sp2.cab:atapi.sys
[2004/08/04 02:00:00 | 18,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 05:51:44 | 20,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:51:44 | 20,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/14 00:10:32 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\atapi.sys
[2010/01/23 20:22:42 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys
[2010/01/23 20:22:42 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 18:59:44 | 00,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:41:54 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\eventlog.dll
[2008/04/14 05:41:54 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 02:00:00 | 00,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:42:02 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\netlogon.dll
[2008/04/14 05:42:02 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004/08/04 02:00:00 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtUninstallKB968389_0$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 02:00:00 | 00,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 05:42:06 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\scecli.dll
[2008/04/14 05:42:06 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
< End of report >

yaaaabuddy03

Post #11January 27, 2010, 9:46 AM UTC

Extras.Txt

OTL Extras logfile created on: 1/27/2010 3:28:20 AM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Paul Lowery\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 35.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.66 Gb Total Space | 1.84 Gb Free Space | 6.20% Space Free | Partition Type: NTFS
Drive D: | 7.58 Gb Total Space | 0.85 Gb Free Space | 11.25% Space Free | Partition Type: FAT32
Drive E: | 5.54 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOWERYLAPTOP
Current User Name: Paul Lowery
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = secfile] – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\av.exe ()
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – File not found
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\Common Files\AOL\1158413527\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1158413527\ee\aolsoftware.exe:*:Enabled:AOL Services – File not found
"C:\Program Files\Common Files\AOL\1158413527\ee\aim6.exe" = C:\Program Files\Common Files\AOL\1158413527\ee\aim6.exe:*:Enabled:AIM – File not found
"C:\Program Files\Morpheus\Morpheus.exe" = C:\Program Files\Morpheus\Morpheus.exe:*:Enabled:M5Shell – (Streamcast Networks, Inc)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer – (RealNetworks, Inc.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – (AOL LLC)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Computer, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{09D8492A-C8E2-421E-927D-46800FB327A3}" = Wireless Home Network Setup
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
"{286F29AF-0BE2-4D5F-AB17-B7631A810553}" = muvee autoProducer 4.5
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 B3
"{446DBFFA-4088-48E3-8932-74316BA4CAE4}" = iTunes
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 2.0
"{47D2103B-FD51-4017-9C20-DD408B17D726}" = Office 2003 Trial Assistant
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{798E409B-F5CA-449E-9BE6-E18199E007C6}" = HP User Guides 0024
"{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}" = TIPCI
"{7F2F3F8B-2D57-48A3-99D0-1AC23D594C89}" = LightScribe 1.4.56.1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{A01FC76F-CC09-4658-9E37-5C2F635EE708}" = TourSetup
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{BC96BBA7-C634-460E-AD18-A0A994213F80}" = HP User Guides–System Recovery
"{BD3B98C2-CB80-4AFF-A53E-53C92B270DAF}" = Paint.NET v2.72
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 5.20 G1
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"074EEF5F-3BE8-4112-B253-C5D6CDE2924C" = Zuma Deluxe from Hewlett-Packard Laptops (remove only)
"0E5266B4-9069-401A-93AE-5FF9F1712016" = Insaniquarium Deluxe from Hewlett-Packard Laptops (remove only)
"103EFD47-9F2C-4490-95DD-AE6C442AFB92" = SCRABBLE from Hewlett-Packard Laptops (remove only)
"1C3FDBBA-EBF7-4CDB-AD8A-A1125734AF86" = Tradewinds from Hewlett-Packard Laptops (remove only)
"320F055A-570F-4335-B026-16A836DB9549" = Final Drive Nitro from Hewlett-Packard Laptops (remove only)
"382C11F0-1A18-4F76-B8E0-15CA7F209C22" = Chuzzle Deluxe from Hewlett-Packard Laptops (remove only)
"384E0BF4-1E1F-45A6-B60E-42144A3F15CD" = Blackhawk Striker 2 from Hewlett-Packard Laptops (remove only)
"4C061F83-EE92-445A-A03F-184B0BD59242" = Jewel Quest from Hewlett-Packard Laptops (remove only)
"5658FB14-16A4-4DAE-946B-1457BE31572E" = Boggle Supreme from Hewlett-Packard Laptops (remove only)
"5758A0E8-A112-4A1D-82EC-EC72F7F16B88" = Lexibox Deluxe from Hewlett-Packard Laptops (remove only)
"5DE4D54F-AA79-43A4-9C8A-C173E7E2B025" = 5 Card Slingo from Hewlett-Packard Laptops (remove only)
"6E377D95-DF37-4E67-B64B-68C314600BCB" = Bejeweled 2 Deluxe from Hewlett-Packard Laptops (remove only)
"6ECB6EE6-92E1-4525-AF3B-3CE51A7C5F89" = FATE from Hewlett-Packard Laptops (remove only)
"7948472C-423F-4134-B68F-48D660A05D71" = Big Kahuna Reef from Hewlett-Packard Laptops (remove only)
"7A940E33-6993-404B-ABA6-ED62E8FBE615" = Bounce Symphony from Hewlett-Packard Laptops (remove only)
"7ED8A70C-9597-40BE-AEA0-0573182F1F51" = Super Granny from Hewlett-Packard Laptops (remove only)
"7F8C5718-1BA9-4AAE-96D2-2B04D05F2D54" = Polar Bowler from Hewlett-Packard Laptops (remove only)
"9F3399B2-9ED6-4339-84A2-686432638B86" = Blasterball 2 from Hewlett-Packard Laptops (remove only)
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM_6" = AIM 6
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"B0202B33-E73D-4FCD-AC88-0B2971AFC116" = Slyder from Hewlett-Packard Laptops (remove only)
"B0769D17-E72A-4E87-A83F-1F7A3F080008" = Bookworm Deluxe from Hewlett-Packard Laptops (remove only)
"C264D692-8E15-4141-96A2-5621332E5DD0" = Slingo Deluxe from Hewlett-Packard Laptops (remove only)
"CNXT_AUDIO" = Conexant AC-Link Audio
"CNXT_MODEM_PCI_VEN_1002&DEV_4378&SUBSYS_3091103C" = Data Fax SoftModem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"D2E44AA4-8665-4490-A6C9-2D0744B47B27" = Polar Golfer from Hewlett-Packard Laptops (remove only)
"DED8E2B5-BA9F-448F-84E8-0AEF79876F95" = Snowboard SuperJam
"E332F38A-75F6-4EF2-88CC-246E8A1CB5D7" = Oasis from Hewlett-Packard Laptops (remove only)
"E76A7EFF-7758-49EE-B3FA-9699830A2D6B" = Mah Jong Quest from Hewlett-Packard Laptops (remove only)
"E90E3AE9-73E4-4E5C-BB0F-673989A808D0" = Lemonade Tycoon 2 from Hewlett-Packard Laptops (remove only)
"E94C7046-2F7D-4D4D-B76F-C412DCCEAAC2" = Crystal Maze from Hewlett-Packard Laptops (remove only)
"EF860173-4FB7-4DE1-8BE8-5400F05A0DC5" = Puzzle Express from Hewlett-Packard Laptops (remove only)
"F2566CC2-D4C4-44ED-A838-3F8288D8D3FE" = Flip Words from Hewlett-Packard Laptops (remove only)
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"HP Game Console" = HP Game Console and games
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2006b" = Microsoft Money 2006
"Morpheus" = Morpheus 5.2 (remove only)
"MorpheusToolbar Uninstall" = Morpheus Toolbar
"Mozilla Firefox (3.5.1)" = Mozilla Firefox (3.5.1)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Netscape Browser" = Netscape Browser (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"RealPlayer 12.0" = RealPlayer
"ShoppingReport" = ShopperReports
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Viewpoint Manager" = Viewpoint Manager (Remove Only)
"Viewpoint Toolbar" = Viewpoint Toolbar
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"WildTangent CDA" = WildTangent Web Driver
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/24/2010 8:47:01 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application ViewpointService.exe, version 2.0.0.62, faulting
module ViewpointService.exe, version 2.0.0.62, fault address 0x00002250.

Error - 1/24/2010 8:48:00 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x01181171.

Error - 1/25/2010 7:09:23 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application ViewpointService.exe, version 2.0.0.62, faulting
module ViewpointService.exe, version 2.0.0.62, fault address 0x00002250.

Error - 1/25/2010 7:10:00 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x01181171.

Error - 1/25/2010 7:10:23 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x01231171.

Error - 1/25/2010 11:44:45 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application ViewpointService.exe, version 2.0.0.62, faulting
module ViewpointService.exe, version 2.0.0.62, fault address 0x00002250.

Error - 1/25/2010 11:45:38 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1004
Description = Faulting application spoolsv.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x01231171.

Error - 1/25/2010 11:47:53 PM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application av.exe, version 0.0.0.0, faulting module av.exe,
version 0.0.0.0, fault address 0x00115059.

Error - 1/27/2010 5:19:24 AM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application ViewpointService.exe, version 2.0.0.62, faulting
module ViewpointService.exe, version 2.0.0.62, fault address 0x00002250.

Error - 1/27/2010 5:22:00 AM | Computer Name = LOWERYLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application av.exe, version 0.0.0.0, faulting module av.exe,
version 0.0.0.0, fault address 0x00115059.

[ System Events ]
Error - 1/25/2010 11:45:15 PM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Viewpoint Manager Service
service to connect.

Error - 1/25/2010 11:45:15 PM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7000
Description = The Viewpoint Manager Service service failed to start due to the following
error: %%1053

Error - 1/25/2010 11:45:50 PM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 1/25/2010 11:45:50 PM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 1/27/2010 5:19:31 AM | Computer Name = LOWERYLAPTOP | Source = Ftdisk | ID = 262189
Description = The system could not sucessfully load the crash dump driver.

Error - 1/27/2010 5:19:31 AM | Computer Name = LOWERYLAPTOP | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 1/27/2010 5:20:06 AM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Viewpoint Manager Service
service to connect.

Error - 1/27/2010 5:20:06 AM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7000
Description = The Viewpoint Manager Service service failed to start due to the following
error: %%1053

Error - 1/27/2010 5:20:38 AM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 1/27/2010 5:20:38 AM | Computer Name = LOWERYLAPTOP | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

< End of report >

yaaaabuddy03

Post #12January 27, 2010, 9:59 AM UTC last edited January 27, 2010, 9:59 AM UTC

Ok, when I try and extract the "gmer" file a warning pops up that says "Application cannot be executed. The file is infected. Please activate your antivirus software." The box only has an "ok" button and a red close button in the top right. Paul

SweetTech

Post #13January 28, 2010, 9:27 PM UTC

Do you recognize these names for the following .wmv and .wma (media files)?

Note:

They should be located on your desktop somewhere.

C:\Documents and Settings\Paul Lowery\Desktop\1043_898919.wmv
C:\Documents and Settings\Paul Lowery\Desktop\895572.WMA
C:\Documents and Settings\Paul Lowery\Desktop\895568.WMA
C:\Documents and Settings\Paul Lowery\Desktop\894836.wmv

Next:

VirusTotal File Scan
Please go to: VirusTotal

[external image: Posted Image]
Click the Browse button and search for the following file: C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\5sWWs1S67JJev
Click Open
Then click Send File
Please be patient while the file is scanned.
Once the scan results appear, please provide them in your next reply.

If it says already scanned – click "reanalyze now"

Please post the results in your next reply.

Next:

OTL Fix
Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
""=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\windows\\system32\\userinit.exe,"
[-HKEY_CURRENT_USER\SOFTWARE\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
:OTL
PRC - C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\av.exe ()
PRC - C:\Documents and Settings\Paul Lowery\Local Settings\Temp\extrac64_cab.exe (Microsoft Corporation)
PRC - C:\Program Files\InternetSecurity2010\IS2010.exe (Internet Security)
PRC - C:\WINDOWS\system32\smss32.exe (IpVOPqgs)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe (IpVOPqgs)
O4 - HKCU..\Run: [extrac64_cab.exe] C:\Documents and Settings\Paul Lowery\Local Settings\Temp\extrac64_cab.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe (Internet Security)
O4 - HKCU..\Run: [Malware Defense] C:\Program Files\Malware Defense\mdefense.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\helper32.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\helper32.dll ()
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\winlogon32.exe) - C:\WINDOWS\system32\winlogon32.exe (IpVOPqgs)
O32 - AutoRun File - [2004/04/30 14:01:14 | 00,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2008/10/21 16:22:16 | 00,000,045 | R— | M] () - E:\Autorun.inf – [ UDF ]
[2010/01/24 17:03:41 | 00,000,000 | —D | C] – C:\Program Files\Malware Defense
[2010/01/23 19:02:53 | 00,000,000 | —D | C] – C:\Program Files\InternetSecurity2010
[2010/01/23 19:02:27 | 00,020,480 | —- | C] (IpVOPqgs) – C:\WINDOWS\System32\winlogon32.exe
[2010/01/23 19:02:27 | 00,020,480 | —- | C] (IpVOPqgs) – C:\WINDOWS\System32\smss32.exe
[2010/01/27 03:20:47 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\41.exe
[2010/01/27 03:20:10 | 00,002,931 | —- | M] () – C:\WINDOWS\System32\warning.html
[2010/01/25 21:37:18 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\28145.exe
[2010/01/25 21:29:27 | 00,180,736 | -HS- | M] () – C:\Documents and Settings\Paul Lowery\Local Settings\Application Data\av.exe
[2010/01/25 21:17:18 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\5705.exe
[2010/01/25 20:57:18 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\24464.exe
[2010/01/25 19:50:12 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\26962.exe
[2010/01/25 19:30:12 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\29358.exe
[2010/01/25 19:10:12 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\11478.exe
[2010/01/23 19:02:32 | 00,018,432 | —- | M] () – C:\WINDOWS\System32\helper32.dll
[2010/01/23 19:02:20 | 00,020,480 | —- | M] (IpVOPqgs) – C:\WINDOWS\System32\winlogon32.exe
[2010/01/23 19:02:20 | 00,020,480 | —- | M] (IpVOPqgs) – C:\WINDOWS\System32\smss32.exe
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Next:

Lets see if we can get GMER to run now. Go ahead and delete the copy of GMER that you have on your computer. I'd like you to download a fresh copy.

Scanning with GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Next:

Please make sure you include the following items in your next post:

1. An answer to my question regarding those media files.
2. The results from the VirusTotal scan.
3. The log that was produced after running OTL.
4. The log that was produced after running the GMER scan.
5. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

yaaaabuddy03

Post #14January 29, 2010, 4:37 PM UTC

Do you recognize these names for the following .wmv and .wma (media files)?

Note:

They should be located on your desktop somewhere.
C:\Documents and Settings\Paul Lowery\Desktop\1043_898919.wmv
C:\Documents and Settings\Paul Lowery\Desktop\895572.WMA
C:\Documents and Settings\Paul Lowery\Desktop\895568.WMA
C:\Documents and Settings\Paul Lowery\Desktop\894836.wmv

Yes, I recognize those files. They are similar to a video blog from a sports news forum website, they shouldn't have any viral attributes to them at all.

Paul

yaaaabuddy03

Post #15January 29, 2010, 5:00 PM UTC last edited January 29, 2010, 5:04 PM UTC

At first it wouldn't show me the local settings file, but I typed everything into the browse file location and it found it, now I'm waiting. Paul

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Your system is infected wallpaper

✨ Ask AI

Ask AI