What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Infected Worm.palevo.gen

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I would like to request assistance from patndoris about the problems i'm having with my computer. I have been recieving an instant message from people on my list that i know wouldn't send me, It is : Fotooo.. haha URL removed from post. I tried to close it and wound up clicking on the link and downloading something. Now every once and awhile my yahoo messenger freezes up my computer for a couple seconds, and goes right back to the way it was, but it does it alot of times. Has anyone heard of this before and if so can they tell me how to fix the problem, I tried deleting my yahoo messenger and installed a new one and it still doing it, any advice would be helpful. I tried using many programs including, superanti spyware, avira,malware. and they said that i had a trojan called TR/inject.TM.15 after deleting what i could and restarting my computer it still is doing the same thing so i was told to download Anti-Worm.Palevo.Gen-EN, and it detected that i had a palevo worm and when it tried to disinfect it that it failed so i tried it again and now its saying that my system is clean. I don't know what to do because its still doing the same thing with my messenger, i've changed my password for my yahoo. I'm kinda stumped on this one so any help would be good.
Post #2
Hello aj0212 and Posted Image

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:
  • Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
  • Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
  • Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!
Please be advised I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay in response time, but I will do my best to keep it as short as possible.

Download and Run OTL
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in:

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    mv61xx.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\system32\drivers\*.sys /90
    %systemroot%\System32\config\*.sav

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

If you have CDEmulation drivers installed (such as Daemon Tools, Alcohol120) please follow the instructions below to run DeFogger prior to and after running GMER. If you do not have any CDEmulation drivers installed, you do not need to run DeFogger and you can go right to the instructions to run GMER.

Download DeFogger

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Download and Run GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
OTX.Txt

OTL logfile created on: 5/12/2010 3:35:14 PM - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = G:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,007.00 Mb Total Physical Memory | 396.00 Mb Available Physical Memory | 39.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 48.30 Gb Free Space | 64.81% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 232.88 Gb Total Space | 69.00 Gb Free Space | 29.63% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: AJ-A3328F86CAD6
Current User Name: Andrew Lawrence
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/05/12 15:34:18 | 000,570,880 | —- | M] (OldTimer Tools) – G:\OTL.exe
PRC - [2010/05/01 19:23:59 | 002,020,592 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2010/04/12 18:46:36 | 001,135,912 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/04/01 10:49:09 | 000,908,248 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/02/25 11:02:02 | 000,716,616 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2010/02/25 10:59:54 | 001,047,880 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2009/08/05 21:00:55 | 000,185,089 | —- | M] (Avira GmbH) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2009/06/09 19:51:28 | 000,108,289 | —- | M] (Avira GmbH) – C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2009/03/02 12:08:47 | 000,209,153 | —- | M] (Avira GmbH) – C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/08/21 20:41:32 | 000,981,904 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008/04/13 20:12:35 | 000,073,796 | —- | M] (Smart Link) – C:\WINDOWS\system32\slserv.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/12/31 18:51:33 | 000,185,632 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2007/10/22 03:45:26 | 000,094,208 | —- | M] () – C:\Program Files\Smart PDF Converter\sspdfagentd.exe
PRC - [2007/08/06 20:05:46 | 000,200,704 | —- | M] (PowerISO Computing, Inc.) – C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2005/07/19 17:32:18 | 000,221,184 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\LVCOMSX.EXE
PRC - [2005/06/08 15:14:44 | 000,217,088 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\Video\LogiTray.exe
PRC - [2005/06/08 14:44:56 | 000,192,512 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\Video\FxSvr2.exe
PRC - [2004/09/29 12:14:36 | 000,069,632 | —- | M] (HP) – C:\WINDOWS\system32\HPZipm12.exe


========== Modules (SafeList) ==========

MOD - [2010/05/12 15:34:18 | 000,570,880 | —- | M] (OldTimer Tools) – G:\OTL.exe
MOD - [2008/04/13 20:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – – (ACDaemon)
SRV - [2010/03/22 22:33:42 | 000,435,016 | —- | M] (TuneUp Software) [On_Demand | Stopped] – C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe – (TuneUp.Defrag)
SRV - [2010/02/25 10:59:54 | 001,047,880 | —- | M] (TuneUp Software) [Auto | Running] – C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe – (TuneUp.UtilitiesSvc)
SRV - [2010/02/25 10:56:02 | 000,030,024 | —- | M] (TuneUp Software) [Auto | Running] – C:\WINDOWS\system32\uxtuneup.dll – (UxTuneUp)
SRV - [2009/08/05 21:00:55 | 000,185,089 | —- | M] (Avira GmbH) [Auto | Running] – C:\Program Files\Avira\AntiVir Desktop\avguard.exe – (AntiVirService)
SRV - [2009/06/09 19:51:28 | 000,108,289 | —- | M] (Avira GmbH) [Auto | Running] – C:\Program Files\Avira\AntiVir Desktop\sched.exe – (AntiVirSchedulerService)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/08/21 20:41:32 | 002,405,776 | —- | M] (Check Point Software Technologies LTD) [Auto | Stopped] – C:\WINDOWS\System32\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2008/04/13 20:12:35 | 000,073,796 | —- | M] (Smart Link) [Auto | Running] – C:\WINDOWS\System32\slserv.exe – (SLService)
SRV - [2008/02/01 21:18:05 | 000,654,848 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2004/09/29 12:14:36 | 000,069,632 | —- | M] (HP) [Auto | Running] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - [2010/05/01 19:23:58 | 000,061,440 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/03/23 21:37:22 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2010/03/23 21:37:22 | 000,012,872 | —- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS – (SASENUM)
DRV - [2010/03/17 16:53:38 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2010/03/17 16:53:22 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2010/02/25 10:18:08 | 000,010,064 | —- | M] (TuneUp Software) [Kernel | On_Demand | Running] – C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys – (TuneUpUtilitiesDrv)
DRV - [2009/12/07 18:48:14 | 000,056,816 | —- | M] (Avira GmbH) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\avgntflt.sys – (avgntflt)
DRV - [2009/06/09 19:51:28 | 000,028,520 | —- | M] (Avira GmbH) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\ssmdrv.sys – (ssmdrv)
DRV - [2009/04/27 19:47:29 | 000,096,104 | —- | M] (Avira GmbH) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avipbb.sys – (avipbb)
DRV - [2009/02/13 11:35:05 | 000,011,608 | —- | M] (Avira GmbH) [Kernel | System | Running] – C:\Program Files\Avira\AntiVir Desktop\avgio.sys – (avgio)
DRV - [2008/04/21 07:19:58 | 000,051,648 | —- | M] (Check Point Software Technologies LTD) [Kernel | Boot | Running] – C:\WINDOWS\system32\ZoneLabs\srescan.sys – (srescan)
DRV - [2008/04/13 14:45:12 | 000,060,032 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2007/08/06 20:15:07 | 000,033,052 | —- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\scdemu.sys – (SCDEmu)
DRV - [2007/04/10 12:36:36 | 000,062,794 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\jl2005c.sys – (JL2005C)
DRV - [2007/02/05 12:15:26 | 000,018,432 | —- | M] (NewSoft Technology Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\Achernar.sys – (Achernar)
DRV - [2005/08/15 12:08:26 | 000,127,488 | —- | M] (Ahead Software AG) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\imagesrv.sys – (imagesrv)
DRV - [2005/08/15 12:08:26 | 000,005,888 | —- | M] (Ahead Software AG) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\imagedrv.sys – (imagedrv)
DRV - [2005/05/27 09:32:52 | 001,317,152 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvcm.sys – (QCMerced)
DRV - [2005/05/27 09:31:28 | 000,022,016 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2005/02/23 15:58:56 | 000,011,776 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\afc.sys – (Afc)
DRV - [2004/10/15 13:50:20 | 000,015,295 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BrScnUsb.sys – (BrScnUsb)
DRV - [2004/08/03 18:41:46 | 000,095,424 | —- | M] (Smart Link) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\slnthal.sys – (SlNtHal)
DRV - [2004/08/03 18:41:46 | 000,013,240 | —- | M] (Smart Link) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\slwdmsup.sys – (SlWdmSup)
DRV - [2004/08/03 18:41:44 | 000,404,990 | —- | M] (Smart Link) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\slntamr.sys – (Slntamr)
DRV - [2004/08/03 18:41:40 | 000,180,360 | —- | M] (Smart Link) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ntmtlfax.sys – (NtMtlFax)
DRV - [2004/08/03 18:41:40 | 000,126,686 | —- | M] (Smart Link) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mtlmnt5.sys – (Mtlmnt5)
DRV - [2004/08/03 18:41:40 | 000,013,776 | —- | M] (Smart Link) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\RecAgent.sys – (RecAgent)
DRV - [2004/08/03 18:41:38 | 001,309,184 | —- | M] (Smart Link) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mtlstrm.sys – (Mtlstrm)
DRV - [2004/08/03 18:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2003/11/13 13:01:52 | 000,145,488 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\EMUPIA2K.SYS – (emupia)
DRV - [2003/11/13 13:01:38 | 000,130,288 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\CTSFM2K.SYS – (ctsfm2k)
DRV - [2003/11/13 13:01:10 | 000,006,096 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\CTPRXY2K.SYS – (ctprxy2k)
DRV - [2003/11/13 12:59:18 | 000,645,360 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\CTAC32K.SYS – (ctac32k)
DRV - [2003/11/13 12:58:10 | 000,148,432 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HAP16V2K.SYS – (hap16v2k)
DRV - [2003/11/13 12:57:40 | 000,904,496 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HA10KX2K.SYS – (ha10kx2k)
DRV - [2003/11/12 15:11:54 | 000,333,600 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\CTDVDA2K.SYS – (ctdvda2k)
DRV - [2001/08/17 13:20:16 | 000,297,728 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ac97sis.sys – (SiS7018) Service for AC'97 Sample Driver (WDM)
DRV - [2001/08/17 13:19:20 | 000,096,256 | —- | M] (Copyright © Creative Technology Ltd. 1994-2001) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctlsb16.sys – (ctlsb16) Creative SB16/AWE32/AWE64 Driver (WDM)
DRV - [2001/08/17 09:57:38 | 000,016,128 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\MODEMCSA.sys – (MODEMCSA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 200.171.104.234:8080->Brazil(high-anonymous)

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "www.yahoo.com"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {3DD07E5D-2ADF-42ea-972E-2998FA5CE45A}:[removed]
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p;="


FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2010/03/24 20:53:00 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/16 10:01:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/01 10:49:13 | 000,000,000 | —D | M]

[2009/03/22 21:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Extensions
[2010/05/11 16:07:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\extensions
[2009/03/01 00:36:19 | 000,000,000 | —D | M] (Verizon Broadband Toolbar) – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\extensions\{3DD07E5D-2ADF-42ea-972E-2998FA5CE45A}
[2010/05/11 16:06:32 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/24 12:57:57 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/12/28 01:51:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\extensions\[removed]
[2008/12/12 14:23:54 | 000,002,158 | —- | M] () – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\searchplugins\MySpace.xml
[2008/03/02 01:27:40 | 000,000,276 | —- | M] () – C:\Documents and Settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\searchplugins\search.xml
[2010/05/11 16:07:16 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/11/19 01:36:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2007/07/26 12:05:16 | 000,001,329 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml

Hosts file not found
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (PopupBlockerBHO.CPopupBlockerBHO) - {0D929918-C804-4756-B0AC-640EF3F061E9} - C:\Program Files\SmartPopupBlocker\PopupBlockerBHO.dll (aa)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O4 - HKLM..\Run: [AsioReg] C:\WINDOWS\System32\CTASIO.DLL (Creative Technology Ltd)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [DevconDefaultDB] C:\WINDOWS\READREG.exe (Creative Technology Limited)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [SmartSoft PDF Printer (demo) Agent] C:\Program Files\Smart PDF Converter\sspdfagentd.exe ()
O4 - HKLM..\Run: [SmartSoft PDF Printer (demo) virtual printer agent] C:\Program Files\Smart PDF Converter\sspdfagentd.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe (Logitech Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe (Broderbund Properties LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemydsl.verizon.net/sdcCommon…20Installer.cab (Support.com Configuration Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Andrew Lawrence\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Andrew Lawrence\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/12/05 01:00:54 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/12/05 01:00:23 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 30 Days ==========

[2010/05/12 15:37:07 | 000,570,880 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Andrew Lawrence\Desktop\OTL.exe
[2010/05/12 14:39:16 | 000,205,312 | —- | C] (SC BitDefender , Romania) – C:\Documents and Settings\Andrew Lawrence\Desktop\Anti-Worm.Palevo.Gen-EN.exe
[2010/05/11 23:41:02 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/05/11 16:07:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Andrew Lawrence\Local Settings\Application Data\Yahoo
[2010/05/11 16:06:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Andrew Lawrence\Local Settings\Application Data\Yahoo!
[2010/05/11 16:06:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2010/05/11 16:06:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Andrew Lawrence\Application Data\Yahoo!
[2010/04/28 16:10:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Andrew Lawrence\My Documents\Atari
[2010/04/28 16:06:17 | 000,000,000 | —D | C] – C:\Program Files\Atari
[2010/04/21 17:18:26 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2010/04/21 17:14:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\DivX
[2010/04/19 15:32:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Andrew Lawrence\My Documents\attachments_2010_04_19
[2009/04/10 22:42:07 | 000,018,944 | —- | C] ( ) – C:\WINDOWS\System32\Implode.dll

========== Files - Modified Within 30 Days ==========

[2010/05/12 15:37:14 | 000,000,229 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/05/12 15:34:18 | 000,570,880 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Andrew Lawrence\Desktop\OTL.exe
[2010/05/12 14:40:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/12 14:21:10 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/05/11 23:37:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/11 23:36:45 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/05/11 23:36:44 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/05/11 23:36:41 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/05/11 23:33:42 | 007,340,032 | —- | M] () – C:\Documents and Settings\Andrew Lawrence\ntuser.dat
[2010/05/11 23:33:42 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Andrew Lawrence\ntuser.ini
[2010/05/11 16:05:54 | 000,000,802 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/05/10 16:01:53 | 000,003,871 | RHS- | M] () – C:\WINDOWS\wintybrd.jpg
[2010/05/07 17:17:05 | 000,000,410 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2010/05/07 09:16:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/04 19:25:52 | 000,000,592 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/05/04 12:05:00 | 000,205,312 | —- | M] (SC BitDefender , Romania) – C:\Documents and Settings\Andrew Lawrence\Desktop\Anti-Worm.Palevo.Gen-EN.exe
[2010/05/03 23:07:12 | 000,172,032 | —- | M] () – C:\Documents and Settings\Andrew Lawrence\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/02 03:15:41 | 000,505,234 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/05/02 03:15:41 | 000,444,028 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/05/02 03:15:41 | 000,071,904 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/05/02 03:13:11 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/04/28 16:08:25 | 000,001,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tycoon City - New York.lnk
[2010/04/21 17:19:51 | 000,001,499 | —- | M] () – C:\Documents and Settings\Andrew Lawrence\Desktop\DivX Movies.lnk
[2010/04/21 17:19:14 | 000,000,777 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2010/04/21 17:18:57 | 000,000,817 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 000,011,168 | -H– | C] () – C:\WINDOWS\System32\zonajagi
[2010/05/11 16:05:54 | 000,000,802 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/05/10 16:01:53 | 000,003,871 | RHS- | C] () – C:\WINDOWS\wintybrd.jpg
[2010/04/28 19:29:42 | 000,000,592 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/04/28 16:08:25 | 000,001,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tycoon City - New York.lnk
[2010/04/21 17:19:51 | 000,001,499 | —- | C] () – C:\Documents and Settings\Andrew Lawrence\Desktop\DivX Movies.lnk
[2010/04/21 17:19:14 | 000,000,777 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2010/04/21 17:18:57 | 000,000,817 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2009/11/18 01:05:48 | 000,000,036 | —- | C] () – C:\WINDOWS\mafosav.INI
[2009/06/17 14:17:54 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/06/17 14:17:53 | 008,676,883 | —- | C] () – C:\WINDOWS\System32\NCMedia2.dll
[2009/06/17 14:17:53 | 000,758,018 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/06/16 18:56:32 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/06/16 18:56:32 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/04/10 22:42:09 | 000,054,272 | —- | C] () – C:\WINDOWS\System32\P2irdao.dll
[2009/04/10 22:42:09 | 000,050,176 | —- | C] () – C:\WINDOWS\System32\P2ctdao.dll
[2009/04/10 22:42:07 | 000,748,160 | —- | C] () – C:\WINDOWS\System32\Co2c40en.dll
[2009/04/10 19:06:57 | 000,028,160 | —- | C] () – C:\WINDOWS\System32\sspdfpmd.dll
[2009/04/02 14:43:55 | 000,077,312 | —- | C] () – C:\WINDOWS\System32\ztvunace26.dll
[2009/04/02 14:43:54 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\ztvunrar36.dll
[2009/04/02 14:43:53 | 000,075,264 | —- | C] () – C:\WINDOWS\System32\unacev2.dll
[2009/04/02 14:43:52 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\unrar3.dll
[2009/03/22 18:41:25 | 000,009,255 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2009/03/22 18:41:23 | 001,317,152 | —- | C] () – C:\WINDOWS\System32\drivers\lvcm.sys
[2008/11/28 16:53:05 | 000,000,031 | —- | C] () – C:\WINDOWS\tdlp32.ini
[2008/11/19 01:36:24 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\securenet.dll
[2008/11/06 23:31:10 | 000,012,288 | R— | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2008/04/17 20:31:19 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2008/02/19 01:21:24 | 000,000,000 | —- | C] () – C:\WINDOWS\Irremote.ini
[2008/02/01 21:16:15 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2008/01/03 17:42:08 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\FoxImager.dll
[2007/12/31 20:17:43 | 000,395,776 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2007/12/31 20:17:43 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2007/12/31 20:17:43 | 000,112,640 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2007/12/28 23:50:19 | 000,000,049 | —- | C] () – C:\WINDOWS\iltwain.ini
[2007/12/28 23:41:22 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2007/12/28 23:41:22 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/12/07 16:15:37 | 000,000,229 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/12/05 04:06:05 | 000,015,866 | —- | C] () – C:\WINDOWS\System32\Aud2_Gw.ini
[2007/12/05 04:06:05 | 000,000,029 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2007/12/05 02:47:41 | 000,000,025 | —- | C] () – C:\WINDOWS\mixerdef.ini
[2007/12/05 02:45:01 | 000,020,333 | —- | C] () – C:\WINDOWS\cmaudio.ini
[2007/03/30 13:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2005/06/01 23:01:02 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2004/08/04 08:00:00 | 000,008,261 | —- | C] () – C:\WINDOWS\System32\toolhelp.dll
[2003/03/21 12:56:12 | 000,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2000/01/07 23:34:10 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\pagesync.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/04 08:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/08/22 19:57:51 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/08/22 19:57:51 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 08:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/08/22 19:57:51 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/08/22 19:57:51 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 08:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 08:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 08:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 08:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\drivers\*.sys /90 >
[2010/03/30 21:58:04 | 000,009,072 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\cdr4_xp.sys
[2010/03/30 21:58:04 | 000,009,200 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\cdralw2k.sys
[2010/03/30 00:45:52 | 000,020,824 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/03/30 00:46:30 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2010/02/24 09:11:07 | 000,455,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mrxsmb.sys
[2010/03/30 21:58:04 | 000,044,944 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\PxHelp20.sys

< %systemroot%\System32\config\*.sav >
[2007/12/04 19:47:10 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2007/12/04 19:47:10 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2007/12/04 19:47:10 | 000,884,736 | —- | M] () – C:\WINDOWS\system32\config\system.sav

========== Alternate Data Streams ==========

@Alternate Data Stream - 94 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A1D3FEF0
@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A8E2C33
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92412C7B
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D8824D0B
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A11F741D
< End of report >
Post #4
Extras.Txt

OTL Extras logfile created on: 5/12/2010 3:35:15 PM - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = G:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,007.00 Mb Total Physical Memory | 396.00 Mb Available Physical Memory | 39.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 48.30 Gb Free Space | 64.81% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 232.88 Gb Total Space | 69.00 Gb Free Space | 29.63% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: AJ-A3328F86CAD6
Current User Name: Andrew Lawrence
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
https [open] – "C:\Program Files\Opera\Opera.exe" (Opera Software)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost – File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 – File not found
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server – File not found
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – (AOL LLC)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Opera\Opera.exe" = C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – ()
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe" = C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup – (Nero AG)
"C:\Program Files\IP Hider\IP Hider.exe" = C:\Program Files\IP Hider\IP Hider.exe:*:Enabled:IP Hider – (AllAnonymity)
"C:\WINDOWS\system32\LVCOMSX.EXE" = C:\WINDOWS\system32\LVCOMSX.EXE:*:Enabled:LVCOMSX – (Logitech Inc.)
"C:\Program Files\SmartFTP Client\SmartFTP.exe" = C:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0 – (SmartSoft Ltd.)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\MySpace\IM\MySpaceIM.exe" = C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM – ()
"G:\IM55172.JPG-www.myspace.com.exe" = C:\WINDOWS\infocard.exe:*:Enabled:Firewall Administrating – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08C0729E-3E50-11DF-9D81-005056806466}" = Google Earth
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1A0D2EFC-C4FC-446A-8BC3-57A54CE5EADD}" = Opera 10.53
"{2266312B-3502-41EE-82CD-8DC62276D87B}" = Vz In Home Agent
"{25B4B52B-3998-4a62-AD83-E990B1338F79}" = PS8000
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{33D6CC28-9F75-4d1b-A11D-98895B3A3729}" = HP Photosmart 330,380,420,470,7800,8000,8200 Series
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{49FC50FC-F965-40D9-89B4-CBFF80941033}" = Windows Movie Maker 2.0
"{4F5CE18C-D97D-48FF-A510-A0D90C918294}" = iTunes
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5B622B7A-60FB-4630-B11D-F121D20BCCD6}" = MarketResearch
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6801832E-8F63-45B3-9A5B-BDE050763062}" = Symbols for FloorPlan v7
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6F23C1A3-9F62-470C-BD12-B83F04E67865}" = SmartFTP Client
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{755EC5E3-FD51-46bd-A57F-7A2D56FBF061}" = PSTAPlugin
"{769A295C-DCF4-41d6-AFBA-7D9394B23AFE}" = PSPrinters08
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A974B6-F864-41AE-9F5A-0AAF7D40E884}" = PrintMaster 16
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{856C155E-4A74-4041-B026-04F96FFD1BCD}" = ZIP Reader 8.00.0018
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9763E36A-08E9-4228-BBCE-12989A4EB1A8}" = QuickTime
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3455242-DAE0-4523-8242-FD82706ABF4B}" = CameraDrivers
"{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}" = Tycoon City - New York
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B5C209B1-8DDB-4642-A573-375B951514CB}" = Apple Mobile Device Support
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BFB8C7BE-3BFA-446C-9F3E-3AFBA5BC1033}" = Nero 7 Ultra Edition
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C40AD26C-855D-45DF-BB8F-B339707E7ABC}" = Rock Tour
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D42AF88F-7669-48DF-8CFF-887EB9D250EF}" = FloorPlan 3D v10
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{E6445FCC-EAF6-4E35-9E72-6EF105A4C177}" = HDView for Firefox
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{FE3997D3-6B56-4AC4-A99C-9DDFC45359BF}" = TuneUp Utilities Language Pack (en-US)
"AC3Filter" = AC3Filter (remove only)
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"AIM_6" = AIM 6
"Any Video Converter_is1" = Any Video Converter 2.7.5
"Auto FTP Manager 4.0_is1" = Auto FTP Manager 4.3
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"BFGC" = Big Fish Games Client
"BFG-Zuma Deluxe" = Zuma Deluxe
"DivX Setup.divx.com" = DivX Setup
"Dual Mode Camera_is1" = Uninstall Dual Mode Camera
"Edraw Office Viewer Component_is1" = Edraw Office Viewer Component v5.6
"FileZilla Client" = FileZilla Client [removed]
"Freez FLV to AVI/MPEG/WMV Converter v1.6_is1" = Freez FLV to AVI/MPEG/WMV Converter
"Gateway Drivers and Applications Recovery" = Gateway Drivers and Applications Recovery
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 5.3
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3
"HPExtendedCapabilities" = HP Extended Capabilities 5.3
"IP Hider 3.7_is1" = IP Hider 3.7
"Keychain Collector" = Keychain Collector
"LimeWire" = LimeWire 4.12.3
"Magic ISO Maker v5.5 (build 0265)" = Magic ISO Maker v5.5 (build 0265)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mihov Image Resizer" = Mihov Image Resizer 1.1 (remove only)
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MySpaceIM" = MySpaceIM
"PartyPoker" = PartyPoker
"Photo Viewer" = Photo Viewer 2.3
"PowerISO" = PowerISO
"PROR" = Microsoft Office Professional 2007
"PROSet" = Intel® PRO Network Adapters and Drivers
"QcDrv" = Logitech® Camera Driver
"QuickWordtoPDF" = QuickWordtoPDF
"RealPlayer 6.0" = RealPlayer
"Ricochet Infinity_is1" = Ricochet Infinity
"Ricochet Lost Worlds Recharged_is1" = Ricochet Lost Worlds Recharged
"Ricochet Xtreme Retail_is1" = Ricochet Xtreme
"Shockwave" = Shockwave
"Smart PDF Converter_is1" = Smart PDF Converter [removed]
"Smart Popup Blocker_is1" = Smart Popup Blocker version 1.20
"SmartFTP Client 3.0 Setup Files" = SmartFTP Client 3.0 Setup Files (remove only)
"Super Mario 3 : Mario Forever" = Super Mario 3 : Mario Forever
"Temptu Tattoo Studio" = Temptu Tattoo Studio
"TuneUp Utilities" = TuneUp Utilities
"Verizon Broadband Toolbar Firefox only" = Verizon Broadband Toolbar Firefox only
"Verizon Help and Support" = Verizon Help and Support Tool
"Verizon High Speed Internet_is1" = Verizon High Speed Internet
"verizon_broad" = Verizon Broadband Toolbar (IE only)
"VLC media player" = VideoLAN VLC media player 0.8.6c
"WebPost" = Microsoft Web Publishing Wizard 1.52
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"ZoneAlarm Security Suite" = ZoneAlarm Security Suite
"Zuma Deluxe RA" = Zuma Deluxe RA

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.7.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/29/2010 12:34:20 AM | Computer Name = AJ-A3328F86CAD6 | Source = Application Error | ID = 1000
Description = Faulting application tycooncity.exe, version 0.0.0.0, faulting module
tycooncity.exe, version 0.0.0.0, fault address 0x000702aa.

Error - 4/29/2010 11:45:28 PM | Computer Name = AJ-A3328F86CAD6 | Source = Application Error | ID = 1000
Description = Faulting application tycooncity.exe, version 0.0.0.0, faulting module
tycooncity.exe, version 0.0.0.0, fault address 0x000702aa.

Error - 5/3/2010 11:10:20 PM | Computer Name = AJ-A3328F86CAD6 | Source = Application Hang | ID = 1002
Description = Hanging application moviemk.exe, version 2.1.4027.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/3/2010 11:12:16 PM | Computer Name = AJ-A3328F86CAD6 | Source = Application Hang | ID = 1002
Description = Hanging application moviemk.exe, version 2.1.4027.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/8/2010 12:17:29 AM | Computer Name = AJ-A3328F86CAD6 | Source = Application Error | ID = 1000
Description = Faulting application tycooncity.exe, version 0.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x0acd01d2.

Error - 1/1/2002 3:31:13 AM | Computer Name = AJ-A3328F86CAD6 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/1/2002 3:31:13 AM | Computer Name = AJ-A3328F86CAD6 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/1/2002 3:31:14 AM | Computer Name = AJ-A3328F86CAD6 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 5/9/2010 11:36:22 PM | Computer Name = AJ-A3328F86CAD6 | Source = Application Error | ID = 1000
Description = Faulting application tycooncity.exe, version 0.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x0acd0230.

Error - 5/10/2010 6:25:23 PM | Computer Name = AJ-A3328F86CAD6 | Source = Application Error | ID = 1000
Description = Faulting application tycooncity.exe, version 0.0.0.0, faulting module
tycooncity.exe, version 0.0.0.0, fault address 0x000702aa.

[ OSession Events ]
Error - 11/19/2008 4:23:57 PM | Computer Name = AJ-A3328F86CAD6 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 74
seconds with 0 seconds of active time. This session ended with a crash.

Error - 5/1/2009 5:52:43 PM | Computer Name = AJ-A3328F86CAD6 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 41
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 5/12/2010 3:42:50 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7000
Description = The vsdatant service failed to start due to the following error: %%2

Error - 5/12/2010 3:42:50 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7001
Description = The TrueVector Internet Monitor service depends on the vsdatant service
which failed to start because of the following error: %%2

Error - 5/12/2010 3:42:51 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7000
Description = The vsdatant service failed to start due to the following error: %%2

Error - 5/12/2010 3:42:51 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7001
Description = The TrueVector Internet Monitor service depends on the vsdatant service
which failed to start because of the following error: %%2

Error - 5/12/2010 3:42:52 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7000
Description = The vsdatant service failed to start due to the following error: %%2

Error - 5/12/2010 3:42:52 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7001
Description = The TrueVector Internet Monitor service depends on the vsdatant service
which failed to start because of the following error: %%2

Error - 5/12/2010 3:42:53 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7000
Description = The vsdatant service failed to start due to the following error: %%2

Error - 5/12/2010 3:42:53 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7001
Description = The TrueVector Internet Monitor service depends on the vsdatant service
which failed to start because of the following error: %%2

Error - 5/12/2010 3:42:55 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7000
Description = The vsdatant service failed to start due to the following error: %%2

Error - 5/12/2010 3:42:55 PM | Computer Name = AJ-A3328F86CAD6 | Source = Service Control Manager | ID = 7001
Description = The TrueVector Internet Monitor service depends on the vsdatant service
which failed to start because of the following error: %%2

[ TuneUp Events ]
Error - 3/5/2009 4:10:42 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/6/2009 2:20:59 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/6/2009 2:21:19 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/6/2009 2:32:36 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/6/2009 2:32:41 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/13/2009 1:37:31 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/13/2009 1:38:06 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/22/2009 7:07:18 PM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 5/8/2010 2:34:16 AM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 5/8/2010 5:00:30 PM | Computer Name = AJ-A3328F86CAD6 | Source = TuneUp.UtilitiesSvc | ID = 300
Description =


< End of report >
Post #6
The system box should be checked by default. The only boxes you need to change are the ones I listed in the instructions above.
Post #9
Please give me a bit to look at the logs you have already posted, and to get further instructions for GMER for you. I will post back shortly.
Post #11
We will deal with GMER in a moment. There are a few things that need to be taken care of before we can do anything. Please understand that the fixes for the infection on your machine are going to take several steps.

I can see the System Restore feature is turned off on your computer. You may have done this intentionally, or it may have been caused by malware - whichever the case, it is critical that we turn it back on. If System Restore is off, and something goes terribly wrong, you will be unable to boot your computer (and would likely lose all your data). It is very important to create a restore point.

Turn ON System Restore.
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • UN-Check *Turn off System Restore*.
  • Click Apply, and then click OK.

Create a new Restore Point
  • Click Start > All Programs > Accessories > System Tools > System Restore
  • On the Welcome page, click Create a restore point.
  • On the Create a Restore Point page, enter a descriptive name for your restore point
  • Click Create
  • The Restore Point Created page confirms that the new restore point has been created.

I can also see that you have 2 anti-virus programs on your machine (Avira and ZoneAlarm). Having good anti-virus running at all times is very important but having more than one anti-virus program on your machine at a time will cause conflicts. Even if one of them is not running it can still cause performance issues. It does not matter which one you remove but you should remove one or the other of them.

Now to address GMER:
When you run GMER again, please be sure you have your anti-virus disabled during the scan.

Ideally, we'd like to run GMER in normal mode, but if it still won't run in normal mode please do the following:

Boot your computer in Safe Mode
  • Turn the computer on or Restart the computer
  • As soon as BIOS is loaded, start tapping the F8 key.
  • The Windows Advanced Options Menu appears.
    If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Use the arrow keys to select the Safe Mode menu option.
  • Press Enter.
  • The computer then begins to start in Safe mode.
  • Log into your usual account

Then try running GMER with just "sections" and the "c:\" drive checked, leave everything else blank. After running it, reboot into normal mode.

If you still can't get it to run, please let me know.

P2P - I see you have P2P software ( uTorrent and LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

Please include the following in your next post:
  • Confirm System Restore is turned on and a new restore point has been created.
  • Let me know which Anti-virus program you uninstalled
  • Include the GMER log
Post #12
i just tried to do the scan, i went through the whole scan and when i went to save it, it froze up my whole computer to the point where i had to restart my computer. I can't start my computer in safe mode i have had this problem for over 2 years and a tech tried to help me with it last time and couldn't figure it out. the antivirus i chose was avira and deleted the other antivirus
Post #13 last edited
If you encounter any problems or are unclear on how to perform any steps, please stop and let me know.
You may want to print out these instructions so you have them handy as you follow the steps.

Download mbr.exe and save it to your desktop

Go to start > run type the following into the open run box

"%userprofile%\desktop\mbr.exe" -t

A log will be created on your desktop, please post the contents of the log in your next reply.



Please download this file, and save it to your Desktop. Once you have downloaded it, save and close all other programs and run it by double-clicking on the file named "RootRepeal.exe".

Once the main window shows up, please click on the "Report" button on the bottom of the window. Next, please click the "Scan" button.

Another window will pop up asking you to select what to include in the scan. Please uncheck everything except for the "Stealth Code" checkbox, and then click OK.

Once the program has finished scanning, the results will appear. Click on the "Save Report" button, and save the report to your desktop.

Finally, please open this report with Notepad, and post it here.
Post #14
MBR Log :

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: TUKERNEL.EXE CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys
kernel: MBR read successfully
user & kernel MBR OK
Post #15
ROOTREPEAL © AD, 2007-2010 ================================================== Report Save Time: 2010/05/13 22:25 Program Version: Version 2.0.0.0 Windows Version: Windows XP SP3 ================================================== STEALTH CODE ——————-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI