Spyware / Malware / Virus Removal

Need Help Please

23 min read

Looking for the outcome? Ask AI

NicoleB Topic Starter

Post #1January 31, 2010, 6:51 PM UTC

Hi. A friend referred me to this site. Would you please check my registry for any malware. I am recovering from a virus and have done quite a few scans. Each one keeps finding more scum. I was told this is the best place to get all of the junk off of my computer and get it clean again. Also, I have gone down the list of scans and things to do before posting and have gotten stuck on GMER Rootkit Scanner. Every time I run this scanner my computer crashes. What to do next?? Thanks so much for your time and help!

emeraldnzl

Post #2February 2, 2010, 10:13 PM UTC

Hello NicoleB

Welcome to WTT.

Please download OTL to your Desktop
Double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and paste them into your reply.

Note: Unless otherwise instructed always post the logs in the forum. If reports don't fit on one post. It might be necessary to break the logs up to get them on the forum. Just use as many posts as you need, that's fine.

NicoleB

Post #3February 3, 2010, 4:19 AM UTC

Thanks so much for your help! Here is what you asked for, I think: Thanks again.

OTL logfile created on: 2/2/2010 10:46:12 PM - Run 1
OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 77.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 152.66 Gb Total Space | 138.43 Gb Free Space | 90.68% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GARAGE
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/02 22:45:18 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\Downloads\OTL.exe
PRC - [2010/01/15 22:09:37 | 000,910,296 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/12/05 07:53:40 | 003,042,504 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oahlp.exe
PRC - [2009/12/05 07:53:38 | 006,622,920 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oaui.exe
PRC - [2009/12/05 07:53:38 | 003,291,336 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe
PRC - [2009/12/05 07:53:38 | 001,282,248 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oacat.exe
PRC - [2009/10/10 16:07:08 | 000,320,832 | —- | M] (BillP Studios) – C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2009/10/01 16:03:14 | 001,858,144 | —- | M] (Emsi Software GmbH) – C:\Program Files\a-squared Free\a2service.exe
PRC - [2009/09/13 18:52:50 | 001,048,392 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2009/07/02 17:36:52 | 000,017,904 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009/03/30 16:28:36 | 001,533,808 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
PRC - [2009/03/30 16:28:36 | 000,183,152 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
PRC - [2008/09/26 10:02:04 | 002,356,088 | R— | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/08/03 22:02:58 | 000,380,928 | —- | M] (ATI Technologies Inc.) – C:\WINDOWS\system32\ati2evxx.exe
PRC - [2004/10/14 13:42:54 | 001,404,928 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\Core\smax4pnp.exe

========== Modules (SafeList) ==========

MOD - [2010/02/02 22:45:18 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\Downloads\OTL.exe
MOD - [2009/12/05 07:53:38 | 000,941,256 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oawatch.dll
MOD - [2008/04/13 19:12:10 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wsock32.dll
MOD - [2008/04/13 19:12:10 | 000,018,432 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wtsapi32.dll
MOD - [2008/04/13 19:12:09 | 000,053,760 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\winsta.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/02/01 22:48:49 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) [Disabled | Stopped] – C:\Program Files\Java\jre6\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2009/12/05 07:53:38 | 003,291,336 | —- | M] (Tall Emu) [Auto | Running] – C:\Program Files\Tall Emu\Online Armor\oasrv.exe – (SvcOnlineArmor)
SRV - [2009/12/05 07:53:38 | 001,282,248 | —- | M] (Tall Emu) [Auto | Running] – C:\Program Files\Tall Emu\Online Armor\OAcat.exe – (OAcat)
SRV - [2009/10/01 16:03:14 | 001,858,144 | —- | M] (Emsi Software GmbH) [Auto | Running] – C:\Program Files\a-squared Free\a2service.exe – (a2free)
SRV - [2009/07/02 17:36:52 | 000,017,904 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe – (MsMpSvc)
SRV - [2009/03/30 16:28:36 | 001,533,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE – (wlidsvc)
SRV - [2008/11/04 00:06:28 | 000,441,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE – (odserv)
SRV - [2006/10/26 13:03:08 | 000,145,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose)
SRV - [2006/10/18 19:05:24 | 000,913,408 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Windows Media Player\WMPNetwk.exe – (WMPNetworkSvc)
SRV - [2005/08/05 20:05:00 | 000,516,096 | —- | M] () [Auto | Stopped] – C:\WINDOWS\system32\ati2sgag.exe – (ATI Smart)
SRV - [2005/08/03 22:02:58 | 000,380,928 | —- | M] (ATI Technologies Inc.) [Auto | Running] – C:\WINDOWS\system32\ati2evxx.exe – (Ati HotKey Poller)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://rr.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "http://www.crawler.com/?tbid=66028"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
FF - prefs.js..extensions.enabledItems: [removed]:1.01
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=66028&qkw="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/30 19:15:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/01 22:49:08 | 000,000,000 | —D | M]

[2009/07/30 10:10:30 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/02/01 23:14:07 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions
[2010/01/30 17:30:31 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/01/24 22:49:48 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/01/30 22:35:09 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/01/30 20:25:13 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\[removed]
[2009/07/30 12:26:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\[removed]

O1 HOSTS File: ([2004/08/12 08:57:47 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1248966160031 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/30 09:43:50 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/07/30 05:02:58 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (15203041766539264)

========== Files/Folders - Created Within 14 Days ==========

[2010/02/01 22:49:36 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2010/02/01 22:49:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/01 22:49:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/02/01 22:48:42 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/02/01 22:47:37 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Sun
[2010/01/31 20:31:10 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/31 12:41:26 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/01/31 10:43:16 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2010/01/30 22:35:17 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\QuickScan
[2010/01/30 22:26:27 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Auslogics
[2010/01/30 22:26:17 | 000,000,000 | —D | C] – C:\Program Files\Auslogics
[2010/01/30 21:58:01 | 000,028,552 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\pavboot.sys
[2010/01/30 21:56:52 | 000,000,000 | —D | C] – C:\Program Files\Panda Security
[2010/01/30 20:31:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/01/30 20:13:18 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/01/30 20:07:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/01/30 20:07:06 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/30 20:07:01 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/01/30 20:06:49 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/30 20:06:38 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/01/30 20:03:36 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Windows Desktop Search
[2010/01/30 19:05:20 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\VS Revo Group
[2010/01/30 19:04:59 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2010/01/30 19:03:46 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/01/30 17:14:38 | 000,000,000 | —D | C] – C:\Program Files\SIW
[2010/01/30 17:10:57 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\WinPatrol
[2010/01/30 17:10:50 | 000,000,000 | —D | C] – C:\Program Files\BillP Studios
[2010/01/30 17:07:11 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/01/30 16:24:46 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\OnlineArmor
[2010/01/30 16:24:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2010/01/30 16:24:03 | 000,029,776 | —- | C] (Tall Emu Pty Ltd) – C:\WINDOWS\System32\drivers\OAnet.sys
[2010/01/30 16:24:03 | 000,024,656 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OAmon.sys
[2010/01/30 16:24:02 | 000,223,312 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OADriver.sys
[2010/01/30 16:23:45 | 000,000,000 | —D | C] – C:\Program Files\Tall Emu
[2010/01/30 16:15:40 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Essentials
[2010/01/30 15:13:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/01/30 15:12:49 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
[2010/01/30 15:12:49 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/01/30 15:12:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/01/30 15:10:30 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/01/30 15:10:25 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/30 15:10:23 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/30 15:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/30 15:10:22 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/30 15:07:32 | 000,000,000 | —D | C] – C:\Program Files\a-squared Free
[2010/01/30 15:07:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\a-squared Free
[2010/01/29 20:10:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Tific
[2010/01/29 20:09:19 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Tific
[2010/01/25 08:37:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2010/01/25 08:36:08 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2010/01/25 08:36:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2010/01/25 08:35:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/07/30 09:43:47 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/02/02 02:15:30 | 002,097,152 | -H– | M] () – C:\Documents and Settings\User\NTUSER.DAT
[2010/02/02 01:34:50 | 000,000,408 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/02/02 01:34:01 | 000,546,316 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/02 01:34:01 | 000,458,786 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/02/02 01:34:01 | 000,076,726 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/02/02 01:29:41 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/02/02 01:29:26 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/02/01 23:18:56 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\User\ntuser.ini
[2010/02/01 22:07:40 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/31 14:10:07 | 000,000,153 | —- | M] () – C:\Documents and Settings\User\Desktop\Yahoo.url
[2010/01/30 16:24:54 | 000,000,044 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.idx
[2010/01/30 15:14:58 | 005,881,858 | -H– | M] () – C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db
[2010/01/25 07:50:30 | 000,046,488 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/01/24 21:52:24 | 000,000,001 | —- | M] () – C:\s
[2010/01/20 07:51:24 | 000,193,776 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/31 14:09:44 | 000,000,153 | —- | C] () – C:\Documents and Settings\User\Desktop\Yahoo.url
[2010/01/30 16:21:05 | 000,000,408 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2009/07/30 09:56:33 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini

========== LOP Check ==========

[2010/01/30 20:31:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/01/30 16:54:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2010/01/30 22:26:27 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Auslogics
[2010/01/30 16:25:02 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\OnlineArmor
[2010/01/30 22:36:05 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\QuickScan
[2010/01/29 20:09:19 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Tific
[2010/01/30 20:03:36 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Windows Desktop Search
[2010/01/30 17:10:57 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\WinPatrol
[2010/02/02 01:34:50 | 000,000,408 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/12 09:06:15 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/12 09:06:15 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/12 08:55:51 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/12 08:57:17 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2004/08/12 09:11:50 | 000,467,200 | —- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 – C:\WINDOWS\dell\iastor\iastor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/12 09:02:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/12 09:04:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
< End of report >

emeraldnzl

Post #4February 3, 2010, 5:29 AM UTC

Hello NicoleB,

Please run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..keyword.URL: "http://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=66028&qkw="

:Files
 C:\WINDOWS\system32\drivers\atapi.sys|C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys /replace

:Commands
[emptytemp]
[resethosts]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.

Next

Run OTL again.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
It will produce a log for you. Post the log here.

So when you return please post
OTL fix log
OTL scan log - OTL.txt

NicoleB

Post #5February 3, 2010, 4:07 PM UTC

hi:) here is the first part of what you asked for, i will get to the rest now. thanks!! : All processes killed ========== OTL ========== Prefs.js: "Crawler Search" removed from browser.search.defaultenginename Prefs.js: "Crawler Search" removed from browser.search.order.1 Prefs.js: "http://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=66028&qkw=" removed from keyword.URL ========== FILES ========== File C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->FireFox cache emptied: 13273670 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 8984 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: User ->Temp folder emptied: 6419238 bytes ->Temporary Internet Files folder emptied: 23478465 bytes ->Java cache emptied: 248757 bytes ->FireFox cache emptied: 88514928 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 4304997 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1016016 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 10449758 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 9817 bytes Total Files Cleaned = 141.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.1.27.1 log created on 02032010_105626 Files\Folders moved on Reboot… File\Folder C:\WINDOWS\temp\TMP00000002FE1E6B53770A5006 not found! Registry entries deleted on Reboot…

NicoleB

Post #6February 3, 2010, 4:23 PM UTC

OTL logfile created on: 2/3/2010 11:11:29 AM - Run 2
OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 82.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 152.66 Gb Total Space | 138.52 Gb Free Space | 90.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GARAGE
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/02 22:45:18 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\Downloads\OTL.exe
PRC - [2009/12/05 07:53:40 | 003,042,504 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oahlp.exe
PRC - [2009/12/05 07:53:38 | 006,622,920 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oaui.exe
PRC - [2009/12/05 07:53:38 | 003,291,336 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe
PRC - [2009/12/05 07:53:38 | 001,282,248 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oacat.exe
PRC - [2009/10/10 16:07:08 | 000,320,832 | —- | M] (BillP Studios) – C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2009/10/01 16:03:14 | 001,858,144 | —- | M] (Emsi Software GmbH) – C:\Program Files\a-squared Free\a2service.exe
PRC - [2009/09/13 18:52:50 | 001,048,392 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2009/07/02 17:36:52 | 000,017,904 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009/03/30 16:28:36 | 001,533,808 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
PRC - [2009/03/30 16:28:36 | 000,183,152 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/08/03 22:02:58 | 000,380,928 | —- | M] (ATI Technologies Inc.) – C:\WINDOWS\system32\ati2evxx.exe
PRC - [2004/10/14 13:42:54 | 001,404,928 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\Core\smax4pnp.exe

========== Modules (SafeList) ==========

MOD - [2010/02/02 22:45:18 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\Downloads\OTL.exe
MOD - [2009/12/05 07:53:38 | 000,941,256 | —- | M] (Tall Emu) – C:\Program Files\Tall Emu\Online Armor\oawatch.dll
MOD - [2008/04/13 19:12:10 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wsock32.dll
MOD - [2008/04/13 19:12:10 | 000,018,432 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wtsapi32.dll
MOD - [2008/04/13 19:12:09 | 000,053,760 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\winsta.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/02/01 22:48:49 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) [Disabled | Stopped] – C:\Program Files\Java\jre6\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2009/12/05 07:53:38 | 003,291,336 | —- | M] (Tall Emu) [Auto | Running] – C:\Program Files\Tall Emu\Online Armor\oasrv.exe – (SvcOnlineArmor)
SRV - [2009/12/05 07:53:38 | 001,282,248 | —- | M] (Tall Emu) [Auto | Running] – C:\Program Files\Tall Emu\Online Armor\OAcat.exe – (OAcat)
SRV - [2009/10/01 16:03:14 | 001,858,144 | —- | M] (Emsi Software GmbH) [Auto | Running] – C:\Program Files\a-squared Free\a2service.exe – (a2free)
SRV - [2009/07/02 17:36:52 | 000,017,904 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe – (MsMpSvc)
SRV - [2009/03/30 16:28:36 | 001,533,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE – (wlidsvc)
SRV - [2008/11/04 00:06:28 | 000,441,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE – (odserv)
SRV - [2006/10/26 13:03:08 | 000,145,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose)
SRV - [2006/10/18 19:05:24 | 000,913,408 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Windows Media Player\WMPNetwk.exe – (WMPNetworkSvc)
SRV - [2005/08/05 20:05:00 | 000,516,096 | —- | M] () [Auto | Stopped] – C:\WINDOWS\system32\ati2sgag.exe – (ATI Smart)
SRV - [2005/08/03 22:02:58 | 000,380,928 | —- | M] (ATI Technologies Inc.) [Auto | Running] – C:\WINDOWS\system32\ati2evxx.exe – (Ati HotKey Poller)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://rr.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "http://www.crawler.com/?tbid=66028"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
FF - prefs.js..extensions.enabledItems: [removed]:1.01
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/30 19:15:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/01 22:49:08 | 000,000,000 | —D | M]

[2009/07/30 10:10:30 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/02/02 22:52:56 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions
[2010/01/30 17:30:31 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/01/24 22:49:48 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/01/30 22:35:09 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/01/30 20:25:13 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\[removed]
[2009/07/30 12:26:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\[removed]
[2010/02/02 22:52:56 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/02/03 10:58:11 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1248966160031 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/30 09:43:50 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/07/30 05:02:58 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (15203041766539264)

========== Files/Folders - Created Within 14 Days ==========

[2010/02/03 10:56:26 | 000,000,000 | —D | C] – C:\_OTL
[2010/02/01 22:49:36 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2010/02/01 22:49:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/01 22:49:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/02/01 22:48:42 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/02/01 22:47:37 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Sun
[2010/01/31 20:31:10 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/31 12:41:26 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/01/31 10:43:16 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2010/01/30 22:35:17 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\QuickScan
[2010/01/30 22:26:27 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Auslogics
[2010/01/30 22:26:17 | 000,000,000 | —D | C] – C:\Program Files\Auslogics
[2010/01/30 21:58:01 | 000,028,552 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\pavboot.sys
[2010/01/30 21:56:52 | 000,000,000 | —D | C] – C:\Program Files\Panda Security
[2010/01/30 20:31:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/01/30 20:13:18 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/01/30 20:07:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/01/30 20:07:06 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/30 20:07:01 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/01/30 20:06:49 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/30 20:06:38 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/01/30 20:03:36 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Windows Desktop Search
[2010/01/30 19:05:20 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\VS Revo Group
[2010/01/30 19:04:59 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2010/01/30 19:03:46 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/01/30 17:14:38 | 000,000,000 | —D | C] – C:\Program Files\SIW
[2010/01/30 17:10:57 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\WinPatrol
[2010/01/30 17:10:50 | 000,000,000 | —D | C] – C:\Program Files\BillP Studios
[2010/01/30 17:07:11 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/01/30 16:24:46 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\OnlineArmor
[2010/01/30 16:24:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2010/01/30 16:24:03 | 000,029,776 | —- | C] (Tall Emu Pty Ltd) – C:\WINDOWS\System32\drivers\OAnet.sys
[2010/01/30 16:24:03 | 000,024,656 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OAmon.sys
[2010/01/30 16:24:02 | 000,223,312 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OADriver.sys
[2010/01/30 16:23:45 | 000,000,000 | —D | C] – C:\Program Files\Tall Emu
[2010/01/30 16:15:40 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Essentials
[2010/01/30 15:13:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/01/30 15:12:49 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
[2010/01/30 15:12:49 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/01/30 15:12:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/01/30 15:10:30 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/01/30 15:10:25 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/30 15:10:23 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/30 15:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/30 15:10:22 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/30 15:07:32 | 000,000,000 | —D | C] – C:\Program Files\a-squared Free
[2010/01/30 15:07:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\a-squared Free
[2010/01/29 20:10:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Tific
[2010/01/29 20:09:19 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Tific
[2010/01/25 08:37:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2010/01/25 08:36:08 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2010/01/25 08:36:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2010/01/25 08:35:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/07/30 09:43:47 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/02/03 11:06:15 | 000,000,408 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/02/03 11:05:20 | 000,546,316 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/03 11:05:20 | 000,458,786 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/02/03 11:05:20 | 000,076,726 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/02/03 11:01:06 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/02/03 11:00:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/02/03 10:59:53 | 002,359,296 | -H– | M] () – C:\Documents and Settings\User\NTUSER.DAT
[2010/02/03 10:59:53 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\User\ntuser.ini
[2010/02/03 10:58:11 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2010/02/01 22:07:40 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/31 14:10:07 | 000,000,153 | —- | M] () – C:\Documents and Settings\User\Desktop\Yahoo.url
[2010/01/30 16:24:54 | 000,000,044 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.idx
[2010/01/30 15:14:58 | 005,881,858 | -H– | M] () – C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db
[2010/01/25 07:50:30 | 000,046,488 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/01/24 21:52:24 | 000,000,001 | —- | M] () – C:\s

========== Files Created - No Company Name ==========

[2010/01/31 14:09:44 | 000,000,153 | —- | C] () – C:\Documents and Settings\User\Desktop\Yahoo.url
[2010/01/30 16:21:05 | 000,000,408 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/01/24 21:52:24 | 000,000,001 | —- | C] () – C:\s
[2009/07/30 09:56:33 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini

========== LOP Check ==========

[2010/01/30 20:31:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/01/30 16:54:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2010/01/30 22:26:27 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Auslogics
[2010/01/30 16:25:02 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\OnlineArmor
[2010/01/30 22:36:05 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\QuickScan
[2010/01/29 20:09:19 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Tific
[2010/01/30 20:03:36 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Windows Desktop Search
[2010/01/30 17:10:57 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\WinPatrol
[2010/02/03 11:06:15 | 000,000,408 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/12 09:06:15 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/12 09:06:15 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/07/30 10:18:44 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/12 08:55:51 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/12 08:57:17 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2004/08/12 09:11:50 | 000,467,200 | —- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 – C:\WINDOWS\dell\iastor\iastor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/12 09:02:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/12 09:04:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 19:11:54 | 000,344,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\hnetcfg.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/07/30 05:07:37 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/07/30 05:07:37 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/07/30 05:07:37 | 000,888,832 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >

emeraldnzl

Post #7February 3, 2010, 7:14 PM UTC

Hello NicoleB,

Please download ComboFix from one of these locations:

NOTE: If you are guest watching this topic. ComboFix is a very powerful tool. The disclaimer clearly states that you should not use it without supervision. There is good reason for this as ComboFix can, and sometimes does, run into conflict on a computer and render it unusable.

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

NicoleB

Post #8February 4, 2010, 4:33 AM UTC

hi. i did what you said and then ran combofix. it popped up with a window telling me it could not open a file. i had trouble proceeding from there so i xed the box and re ran combo fix. now it has popped up a warning that norton antivirus is active, even though i didn't think i have norton anymore and can't find it anywhere to get rid of it or disable it.. hopefully everything will be okay if i just leave everything alone until i hear from you+

emeraldnzl

Post #9February 4, 2010, 5:29 AM UTC

Hi NicoleB,

Probably some left overs from Norton there. Very common, people uninstall Norton Symantec but it leaves behind stuff, not your fault.

Let's do this:

You have had Norton Symantec Antivirus on your computer at some stage. It has not been properly removed.

Firstly please go to Start > Control Panel > Add or remove Programs (Programs in Vista) and remove all items with Symantec or Norton in the name if any are there.

Then

Go here Norton Removal Tool to remove left over bits of the Norton AntiVirus Program. Choose the link for the version you had and then download and run the removal progam. If you don't know the version just proceed, it should still work.

After that

Right click on Start > Explore and navigate to:

C:\QooBox\LastRun\ <–Data from failed CF runs are stored here.

You should be able to find the data for the failed run there.

Copy and paste back here.

Finally

Run ComboFix again (this time if it complains about Norton just proceed) and paste that report back too.

So when you return, all going well, please post

ComboFix failed run txt.
ComboFix last run txt.

NicoleB

Post #10February 4, 2010, 12:06 PM UTC

QooBox only has a folder called Quarantine. Nothing that says Last Run.

emeraldnzl

Post #11February 4, 2010, 6:19 PM UTC

Well let's see if you can run ComboFix again.

NicoleB

Post #12February 5, 2010, 6:15 AM UTC

QooBox only has these folders now: BackEric LastRun Quarantine Test TestC All are blank inside except Quarantine, which has an empty folder called Registry_backups and a document called catch me that says this inside": ——– 2010-02-05 - 00:59:31 ————- ????

emeraldnzl

Post #13February 5, 2010, 6:28 AM UTC

Okay somethings blocking it I think.

Let's do this.

Please delete your version of ComboFix, including the folders C:\Qoobox and C:\Combofix, and download a new version of Combofix.

Download Combofix from either of the links below & save it to your desktop.. You must rename it .

Link 1
Link 2

[external image: Posted Image]

Once you have downloaded it, right click and rename it to Confuse.exe.

——————————————————————–

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for review.

NicoleB

Post #14February 5, 2010, 7:03 AM UTC

I have not been able to find ComboFix anywhere to delete it. (Also, I disabled the anti virus and anti spyware, but i have other various security programs:, such as: e squared WinPatrol Online Armor My firewall is still on. Could these be a problem? I think those are the only security programs. Think the rest that I have are scanners. Let me know if you want the names of those.) So should I just attempt downloading ComboFix again? Ah! Thanks for your time and help!

emeraldnzl

Post #15February 5, 2010, 7:12 AM UTC

I have not been able to find ComboFix anywhere to delete it.

That's OK just go ahead and download the new version.

So should I just attempt downloading ComboFix again?

Yep

Also if it asks you about your anti-malware programs, just proceed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Need Help Please

✨ Ask AI

Ask AI