Spyware / Malware / Virus Removal

Microsoft did not Fix

40 min read

Looking for the outcome? Ask AI

gbsk

Post #16June 4, 2010, 9:21 PM UTC

Satchfan,

Mysteriously, the computer worked much better yesterday. I don't know why. I noticed i also downKaspersky was still on the computer and deleted it. I also uninstalled 2 java updates and then downloaded java to the desktop. I do not remember downloading Google Earth and asked my wife about it. She said she did not download it. I understand and will not download anything until we get this fixed. Here is the ComboFix log.

ComboFix 10-05-28.02 - Owner 06/03/2010 16:35:58.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.1082 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100603-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-05-04 to 2010-06-04 )))))))))))))))))))))))))))))))
.

2010-06-03 06:34 . 2009-11-24 22:48 23120 —-a-w- c:\wixp\system32\drivers\aswRdr.sys
2010-06-03 06:34 . 2009-11-24 22:49 48560 —-a-w- c:\wixp\system32\drivers\aswTdi.sys
2010-06-03 06:34 . 2009-11-24 22:47 27408 —-a-w- c:\wixp\system32\drivers\aavmker4.sys
2010-06-03 06:34 . 2009-11-24 22:47 97480 —-a-w- c:\wixp\system32\AvastSS.scr
2010-06-03 06:34 . 2009-11-24 22:51 93424 —-a-w- c:\wixp\system32\drivers\aswmon.sys
2010-06-03 06:34 . 2009-11-24 22:50 94160 —-a-w- c:\wixp\system32\drivers\aswmon2.sys
2010-06-03 06:34 . 2009-11-24 22:50 114768 —-a-w- c:\wixp\system32\drivers\aswSP.sys
2010-06-03 06:34 . 2009-11-24 22:50 20560 —-a-w- c:\wixp\system32\drivers\aswFsBlk.sys
2010-06-03 06:33 . 2009-11-24 22:54 1280480 —-a-w- c:\wixp\system32\aswBoot.exe
2010-06-03 06:33 . 2003-03-18 19:20 1060864 —-a-w- c:\wixp\system32\MFC71.dll
2010-06-03 04:36 . 2010-06-03 04:36 52224 —-a-w- c:\documents and settings\Administrator.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-06-03 04:36 . 2010-06-03 04:36 117760 —-a-w- c:\documents and settings\Administrator.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-06-03 04:35 . 2010-06-03 04:35 ——– d—–w- c:\documents and settings\Administrator.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com
2010-06-03 04:32 . 2010-06-03 04:32 ——– d—–w- c:\documents and settings\Administrator.KHALSA-FAMILY\Application Data\Malwarebytes
2010-05-24 07:01 . 2010-05-24 07:01 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcp71.dll
2010-05-24 07:01 . 2010-05-24 07:01 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\jmc.dll
2010-05-24 07:01 . 2010-05-24 07:01 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-sse.dll
2010-05-24 07:01 . 2010-05-24 07:01 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcr71.dll
2010-05-24 07:01 . 2010-05-24 07:01 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-d3d.dll
2010-05-21 13:16 . 2010-05-21 13:16 ——– d—–w- c:\program files\ESET
2010-05-21 07:12 . 2010-05-21 07:12 56 —ha-w- c:\wixp\system32\ezsidmv.dat
2010-05-18 04:58 . 2010-05-30 21:50 1 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 04:58 . 2010-05-18 04:58 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\JRE
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\OpenOffice.org 3
2010-05-08 21:36 . 2004-08-04 07:07 59264 -c–a-w- c:\wixp\system32\dllcache\usbaudio.sys
2010-05-08 21:36 . 2004-08-04 07:07 59264 —-a-w- c:\wixp\system32\drivers\USBAUDIO.sys
2010-05-08 21:36 . 2004-08-04 07:08 31616 -c–a-w- c:\wixp\system32\dllcache\usbccgp.sys
2010-05-08 21:36 . 2004-08-04 07:08 31616 —-a-w- c:\wixp\system32\drivers\usbccgp.sys
2010-05-07 08:56 . 2004-05-04 20:53 1645320 —-a-w- c:\wixp\system32\gdiplus.dll
2010-05-07 08:56 . 2010-05-07 08:56 ——– d—–w- c:\program files\BurnAware Free
2010-05-07 05:05 . 2010-06-03 08:42 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\skypePM
2010-05-07 04:17 . 2010-06-03 08:43 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Skype
2010-05-07 00:39 . 2010-05-07 00:39 ——– d—–w- C:\finalburner
2010-05-07 00:31 . 2010-05-07 00:32 ——– d—–w- c:\program files\FinalBurner
2010-05-06 21:55 . 2010-05-06 21:55 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-03 22:39 . 2009-08-04 18:12 ——– d—–w- c:\program files\Java
2010-06-03 06:33 . 2010-01-23 23:16 ——– d—–w- c:\program files\Alwil Software
2010-06-03 04:31 . 2010-01-23 23:16 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Alwil Software
2010-05-23 21:41 . 2009-12-22 12:33 18008 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-21 17:21 . 2010-03-20 23:33 ——– d—–w- c:\program files\xplorer2
2010-05-14 14:49 . 2009-12-24 04:05 ——– d—–w- c:\program files\Google
2010-05-12 21:43 . 2009-12-23 06:33 117760 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-08 03:26 . 2010-01-24 08:41 ——– d—–w- c:\program files\McAfee
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–r- c:\program files\Skype
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–w- c:\program files\Common Files\Skype
2010-04-26 05:43 . 2010-04-26 05:43 ——– d—–w- c:\program files\Common Files\Java
2010-04-26 04:48 . 2010-04-26 04:48 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcp71.dll
2010-04-26 04:48 . 2010-04-26 04:48 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\jmc.dll
2010-04-26 04:48 . 2010-04-26 04:48 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcr71.dll
2010-04-26 04:48 . 2010-04-26 04:48 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-sse.dll
2010-04-26 04:48 . 2010-04-26 04:48 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-d3d.dll
2010-04-26 04:47 . 2010-04-26 04:47 411368 —-a-w- c:\wixp\system32\deployJava1.dll
2010-04-23 12:41 . 2010-04-23 12:41 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Kaspersky Lab Setup Files
2010-04-20 21:56 . 2010-04-20 21:56 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Foxit Software
2010-04-07 20:49 . 2010-04-07 20:49 ——– d—–w- c:\program files\Trend Micro
2010-04-06 05:11 . 2009-06-15 21:26 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-06 05:06 . 2010-04-06 05:06 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\IObit
.

((((((((((((((((((((((((((((( SnapShot@2010-05-13_00.41.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-03 08:31 . 2010-06-03 08:31 16384 c:\wixp\Temp\Perflib_Perfdata_494.dat
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ARPPRODUCTICON.exe
+ 2010-02-02 08:22 . 2010-02-02 08:22 655872 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 568832 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 224768 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2009-12-21 15:13 . 2010-05-21 06:00 115768 c:\wixp\system32\FNTCACHE.DAT
+ 2010-06-03 04:31 . 2010-06-03 04:31 262144 c:\wixp\system32\config\systemprofile\NtUser.dat
+ 2010-05-14 14:51 . 2010-05-14 14:51 1235968 c:\wixp\Installer\1692ac23.msi
+ 2010-05-18 04:39 . 2010-05-18 04:39 7424000 c:\wixp\Installer\{6ADD0603-16EF-400D-9F9E-486432835002}\soffice.exe
+ 2010-05-18 04:39 . 2010-05-18 04:39 10174464 c:\wixp\Installer\1057e2f1.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db35fda8-77e3-4784-92c2-ee7345e91af4}]
2010-05-21 17:21 2515552 —-a-w- c:\program files\xplorer2\tbxpl0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DB35FDA8-77E3-4784-92C2-EE7345E91AF4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [2010-04-06 2010864]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-20 26192680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\wixp\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\wixp\system32\hkcmd.exe" [2004-02-10 118784]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jaureg.exe" [2010-02-18 237800]

c:\documents and settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-01-26 02:20 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIXP^Start Menu^Programs^Startup^BounceBack Launcher.lnk]
backup=c:\wixp\pss\BounceBack Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner.KHALSA-FAMILY^Start Menu^Programs^Startup^TimeLeft.lnk]
backup=c:\wixp\pss\TimeLeft.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-24 04:05 135664 —-atw- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-09 00:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Giganology\\Gigaget\\Gigaget.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\wixp\system32\drivers\aswSP.sys [6/2/2010 10:34 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [5/26/2009 10:05 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 66632]
R2 aswFsBlk;aswFsBlk;c:\wixp\system32\drivers\aswFsBlk.sys [6/2/2010 10:34 PM 20560]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [1/24/2010 12:42 AM 93320]
R2 portD;CMS PortIO Service;c:\wixp\system32\drivers\portd2k.sys [1/13/2010 2:43 PM 7424]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 12872]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/23/2009 8:05 PM 135664]
S3 BIOSCHK;BIOSCHK;\??\c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS –> c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - APPMGMT
*NewlyCreated* - ASWUPDSV
*NewlyCreated* - AVAST!_ANTIVIRUS
*NewlyCreated* - AVAST!_MAIL_SCANNER
*NewlyCreated* - AVAST!_WEB_SCANNER
.
Contents of the 'Scheduled Tasks' folder

2010-06-03 c:\wixp\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-06-04 c:\wixp\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-06-03 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-06-04 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: {{21196042-830F-419f-A594-F9D456A6C29A} - {21196042-830F-419f-A594-F9D456A6C29A} c:\program files\TimeLeft3\TLIntergIE.html - c:\program files\timeleft3\tlintergie.html\inprocserver32 does not exist!
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: DirectAnimation Java Classes - file://c:\wixp\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\wixp\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-03 16:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(508)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(2424)
c:\wixp\system32\browselc.dll
c:\wixp\system32\WPDShServiceObj.dll
c:\wixp\system32\PortableDeviceTypes.dll
c:\wixp\system32\PortableDeviceApi.dll
.
Completion time: 2010-06-03 16:47:55
ComboFix-quarantined-files.txt 2010-06-04 00:47
ComboFix2.txt 2010-06-03 02:25
ComboFix3.txt 2010-05-28 23:31
ComboFix4.txt 2010-05-28 22:09
ComboFix5.txt 2010-06-04 00:34

Pre-Run: 20,412,293,120 bytes free
Post-Run: 20,394,221,568 bytes free

- - End Of File - - 6E358740001726BEC7ECA48AF08CE24A

Satchfan

Post #17June 5, 2010, 7:42 AM UTC

Hi gbsk

Glad to hear that your computer is running better.

To give me an idea of the current state of affairs, can you do the following:

Please make an uninstall list* Start HijackThis
* Click the Config button
* Click the Misc Tools button
* Click the Open Uninstall Manager button.
* Click the Save list button and save it to your desktop.
When you press "Save", a notepad will open with the contents. Copy/paste the contents of the notepad file in your next reply.

Thanks

Satchfan

gbsk

Post #18June 6, 2010, 6:18 AM UTC

Satchfan Here is the list. Thanks GB Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Shockwave Player 11.5 Audacity 1.2.6 avast! Antivirus Belarc Advisor 8.1 BounceBack Express BurnAware Free 2.4.6 Dell ResourceCD ESET Online Scanner v3 Eusing Free Registry Cleaner FinalBurner Free v2.20.0.187 Foxit Reader Gigaget Google Earth Google Toolbar for Internet Explorer Google Toolbar for Internet Explorer Google Update Helper GoToAssist 8.0.0.514 HijackThis 2.0.2 Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB952287) HP Update Intel® Extreme Graphics Driver Karen's Countdown Timer II Malwarebytes' Anti-Malware McAfee SiteAdvisor Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Easy Assist v2 Microsoft Office Live Meeting 2007 Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 OpenOffice.org 3.2 Opera 10.10 Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978706) Skype Toolbars Skype™ 4.2 SoundMAX TimeLeft Uniblue SpeedUpMyPC Update for Windows XP (KB898461) Update for Windows XP (KB914882) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB978207) Windows Driver Package - Microsoft Corporation (usbvideo) Image (05/25/2007 1.0.3656.0) Windows Installer 3.1 (KB893803) Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Service Pack 2 xplorer² lite xplorer2 Toolbar

Satchfan

Post #19June 6, 2010, 6:21 PM UTC

Hi gbsk. Thanks for the list. Everything there looks fine.

Please install Java using the shortcut on your desktop.

Clear all your temporary files

Download ATF Cleaner

To use ATF Cleaner:

Double-click ATF-Cleaner.exe (on your desktop) to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu

Run OTL

Under Extra Registry put a check in Use SafeList:

🖼Click to load external image (Posted Image)

Click Run Scan

Please post back with the 2 logfiles:

OTL.txt
Extras.txt

Thanks

Satchfan

gbsk

Post #20June 8, 2010, 1:14 AM UTC

Satchfan

I did not have ATF or OTL so I had to download them. My computer still will not openup many links when I click on them. Many times I have to right click a link and then click open on the menu. This has been going on for months. I thought it might be Java but I just reinstalled Java. here are the logs..

OTL logfile created on: 6/7/2010 4:53:27 PM - Run 2
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 8.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 36.00% Paging

OTL Extras logfile created on: 6/7/2010 4:53:27 PM - Run 2
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 8.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 36.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WIXP | %ProgramFiles% = C:\Program Files
Drive C: | 38.25 Gb Total Space | 18.41 Gb Free Space | 48.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KHALSA-FAMILY
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
https [open] – "C:\Program Files\Opera\Opera.exe" (Opera Software)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Live Meeting 8\Console\PWConsole.exe" = C:\Program Files\Microsoft Office\Live Meeting 8\Console\PWConsole.exe:*:Enabled:Microsoft Office Live Meeting 2007 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Live Meeting 8\Console\PWConsole.exe" = C:\Program Files\Microsoft Office\Live Meeting 8\Console\PWConsole.exe:*:Enabled:Microsoft Office Live Meeting 2007 – (Microsoft Corporation)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Giganology\Gigaget\Gigaget.exe" = C:\Program Files\Giganology\Gigaget\Gigaget.exe:*:Enabled:Gigaget – (Giganology Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A3E23D7-7A1E-43EC-B35D-EB8A31BED943}" = FinalBurner Free v2.20.0.187
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21199F32-B676-4FE2-A443-EF7DB6B8FD4F}" = Opera 10.10
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{326957C7-83FD-4550-A59A-849B7B4297DE}" = Microsoft Easy Assist v2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{95632566-071E-4A02-92C1-4BD907065736}" = BounceBack Express
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{BE66348A-E83F-4982-941F-DFF2F742B851}" = Microsoft Office Live Meeting 2007
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Audacity_is1" = Audacity 1.2.6
"avast!" = avast! Antivirus
"Belarc Advisor" = Belarc Advisor 8.1
"BurnAware Free_is1" = BurnAware Free 2.4.6
"EB88B6218325D2AB47CFFBF7170236B60A6198FF" = Windows Driver Package - Microsoft Corporation (usbvideo) Image (05/25/2007 1.0.3656.0)
"ESET Online Scanner" = ESET Online Scanner v3
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"Foxit Reader" = Foxit Reader
"gigaget_is1" = Gigaget
"GoToAssist" = GoToAssist 8.0.0.514
"HijackThis" = HijackThis 2.0.2
"Karen's Countdown Timer II" = Karen's Countdown Timer II
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"TIMELEFT3_is1" = TimeLeft
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 2
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xplorer2 Toolbar" = xplorer2 Toolbar
"xplorer2l" = xplorer² lite

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/7/2010 3:39:43 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:43 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3921C115C15D0ECA5CCB5BC4F07D21D8050B566A.crt>
with error: This network connection does not exist.

Error - 6/7/2010 3:39:44 PM | Computer Name = KHALSA-FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

[ System Events ]
Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\OLYMPUS\OLYMPUS
Master 2\Plugins\MDP_JPEG.omdp. Reference error message: The operation completed
successfully. .

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.CRT could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error
message: The referenced assembly is not installed on your system. .

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\OLYMPUS\OLYMPUS
Master 2\Plugins\MDP_QT.omdp. Reference error message: The operation completed successfully.
.

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.CRT could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error
message: The referenced assembly is not installed on your system. .

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\OLYMPUS\OLYMPUS
Master 2\Plugins\MDP_Raw.omdp. Reference error message: The operation completed
successfully. .

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.CRT could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error
message: The referenced assembly is not installed on your system. .

Error - 6/4/2010 7:57:22 PM | Computer Name = KHALSA-FAMILY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\OLYMPUS\OLYMPUS
Master 2\Plugins\MDP_Tiff.omdp. Reference error message: The operation completed
successfully. .

< End of report >

Satchfan

Post #21June 8, 2010, 7:29 AM UTC

gbsk

Can you please send OTL.txt as I only have the header from that log. If you can't find it, run it again.

Thanks

Satchfan

gbsk

Post #22June 9, 2010, 5:16 PM UTC

Satchfan

I thought I had the whole file. Here it is again. The computer acted up again today. My wife could not access anything in the browser and it was slow and nonfunctioning. We had to restart the computer and it took about 20 minutes to boot up completely. Before we shut it down, I looked on Task Manager. Just doing mental calculations, it looked like the computer was using no more than 1 GB of memory and we have 1.5GB available. I just presume that some other program is using the rest. Here is the file.

OTL logfile created on: 6/7/2010 4:53:27 PM - Run 2
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 8.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 36.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WIXP | %ProgramFiles% = C:\Program Files
Drive C: | 38.25 Gb Total Space | 18.41 Gb Free Space | 48.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KHALSA-FAMILY
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe ()
PRC - C:\WIXP\Qtabua.exe ()
PRC - C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
PRC - C:\Program Files\Outlook Express\msimn.exe (Microsoft Corporation)
PRC - C:\WIXP\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WIXP\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WIXP\system32\iphlpapi.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (wuauserv) – C:\WINDOWS\system32\wuauserv.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (aswMon2) – C:\WIXP\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WIXP\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WIXP\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WIXP\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WIXP\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WIXP\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (BANTExt) – C:\WIXP\System32\Drivers\BANTExt.sys ()
DRV - (portD) – C:\WIXP\system32\drivers\portd2k.sys (CMS Peripherals, Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WIXP\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (AN983) – C:\WIXP\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (OMCI) – C:\WIXP\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/06/02 21:21:08 | 000,000,000 | —D | M]

[2009/12/21 14:30:16 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2002/09/03 08:34:19 | 000,000,734 | —- | M]) - C:\WIXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (GigagetIEHelper Class) - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WIXP\system32\gigagetbho_v10.dll (Giganology Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (xplorer2 Toolbar) - {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (xplorer2 Toolbar) - {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (xplorer2 Toolbar) - {DB35FDA8-77E3-4784-92C2-EE7345E91AF4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKCU..\Run: [M5T8QL3YW3] C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; All by Gigaget - C:\Program Files\Giganology\Gigaget\getAllurl.htm ()
O8 - Extra context menu item: &Download; by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm ()
O9 - Extra Button: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - Reg Error: Key error. File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WIXP\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WIXP\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed],[removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.57,93.188.161.187
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WIXP\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WIXP\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WIXP\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WIXP\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 18:29:56 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/07 16:29:44 | 000,000,000 | —D | C] – C:\WIXP\Sun
[2010/06/07 16:09:32 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ATF-Cleaner.exe
[2010/06/07 15:17:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/06/07 15:16:20 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javacpl.cpl
[2010/06/07 15:16:19 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaws.exe
[2010/06/07 15:16:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaw.exe
[2010/06/07 15:16:18 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\java.exe
[2010/06/04 15:27:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\OLYMPUS
[2010/06/04 15:14:05 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/06/03 15:55:10 | 016,295,712 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 22:34:15 | 000,023,120 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswRdr.sys
[2010/06/02 22:34:13 | 000,048,560 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswTdi.sys
[2010/06/02 22:34:12 | 000,027,408 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aavmker4.sys
[2010/06/02 22:34:09 | 000,097,480 | —- | C] (ALWIL Software) – C:\WIXP\System32\AvastSS.scr
[2010/06/02 22:34:08 | 000,114,768 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswSP.sys
[2010/06/02 22:34:08 | 000,094,160 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswmon2.sys
[2010/06/02 22:34:08 | 000,093,424 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswmon.sys
[2010/06/02 22:34:08 | 000,020,560 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswFsBlk.sys
[2010/06/02 22:33:39 | 001,280,480 | —- | C] (ALWIL Software) – C:\WIXP\System32\aswBoot.exe
[2010/06/02 22:33:39 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\WIXP\System32\MFC71.dll
[2010/05/28 15:21:07 | 000,031,232 | —- | C] (NirSoft) – C:\WIXP\NIRCMD.exe
[2010/05/21 05:16:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/05/17 20:58:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
[2010/05/17 20:36:53 | 000,000,000 | —D | C] – C:\Program Files\JRE
[2010/05/17 20:36:43 | 000,000,000 | —D | C] – C:\Program Files\OpenOffice.org 3
[2010/05/12 16:12:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/05/12 15:53:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WIXP\SWXCACLS.exe
[2010/05/12 15:53:02 | 000,161,792 | —- | C] (SteelWerX) – C:\WIXP\SWREG.exe
[2010/05/12 15:53:02 | 000,136,704 | —- | C] (SteelWerX) – C:\WIXP\SWSC.exe
[2010/05/12 15:50:32 | 000,000,000 | —D | C] – C:\WIXP\ERDNT
[2010/05/12 15:45:18 | 000,000,000 | —D | C] – C:\Qoobox
[2009/09/20 14:20:41 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2009/06/10 22:37:38 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/06/10 18:33:18 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/06/10 18:29:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/06/10 18:29:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[4 C:\WIXP\*.tmp files -> C:\WIXP\*.tmp -> ]
[1 C:\WIXP\System32\*.tmp files -> C:\WIXP\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/07 17:02:00 | 000,001,006 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
[2010/06/07 16:54:26 | 000,000,240 | -H– | M] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/06/07 16:42:38 | 000,000,294 | -H– | M] () – C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/06/07 16:23:16 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ATF-Cleaner.exe
[2010/06/07 16:11:00 | 000,000,884 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/07 15:15:32 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaws.exe
[2010/06/07 15:15:32 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaw.exe
[2010/06/07 15:15:32 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javacpl.cpl
[2010/06/07 15:15:31 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\java.exe
[2010/06/07 15:15:30 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\deployJava1.dll
[2010/06/07 15:11:00 | 000,000,880 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/07 13:36:46 | 000,000,892 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\PRESS RELEASE.rtf
[2010/06/07 12:02:00 | 000,000,954 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
[2010/06/07 09:26:53 | 000,176,128 | —- | M] () – C:\WIXP\Qtabua.exe
[2010/06/07 09:26:52 | 000,000,306 | -H– | M] () – C:\WIXP\tasks\MSWD-0c81ca32.job
[2010/06/07 09:26:49 | 000,070,656 | —- | M] () – C:\WIXP\System32\ernel32.dll
[2010/06/07 09:26:49 | 000,070,656 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe
[2010/06/07 04:20:35 | 000,003,096 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits - 6-6-10.rtf
[2010/06/07 03:38:18 | 000,000,188 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits.rtf
[2010/06/05 17:22:09 | 000,007,782 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.pdf
[2010/06/05 14:58:56 | 000,058,542 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\mo 036.JPG
[2010/06/05 14:49:32 | 000,032,308 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Mo's SD 2009 344.JPG
[2010/06/04 17:23:54 | 000,009,340 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.odt
[2010/06/04 17:22:35 | 000,012,669 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom from Tony.odt
[2010/06/04 17:20:47 | 000,015,489 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Wisdom from Mo.odt
[2010/06/04 15:05:47 | 000,000,006 | -H– | M] () – C:\WIXP\tasks\SA.DAT
[2010/06/04 15:05:27 | 000,002,048 | –S- | M] () – C:\WIXP\bootstat.dat
[2010/06/03 16:45:12 | 000,000,227 | —- | M] () – C:\WIXP\system.ini
[2010/06/03 15:55:11 | 016,295,712 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\jre-6u20-windows-i586.exe
[2010/06/03 10:57:31 | 000,092,533 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Health Risks.PDF
[2010/06/02 23:19:01 | 002,883,584 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\NTUSER.DAT
[2010/06/02 23:18:51 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.ini
[2010/06/02 22:34:08 | 000,002,626 | —- | M] () – C:\WIXP\System32\CONFIG.NT
[2010/06/02 19:02:26 | 005,890,370 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\IconCache.db
[2010/06/02 19:01:11 | 000,249,139 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Graduation-Invitation.jpg
[2010/06/02 18:49:31 | 000,000,430 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental2.rtf
[2010/06/02 18:48:23 | 000,005,794 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental.rtf
[2010/05/31 22:05:49 | 000,030,771 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Policies and Produres (1).pdf
[2010/05/31 16:58:35 | 000,237,314 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Intermediate.pdf
[2010/05/28 22:29:22 | 000,229,727 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Graduation-Invitation.jpg
[2010/05/28 22:17:37 | 000,025,563 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\class_of_2010-21926.jpg
[2010/05/28 13:51:07 | 003,700,495 | R— | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ComboFix.exe
[2010/05/23 14:29:07 | 002,150,480 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\untitled_0.odt
[2010/05/23 13:41:09 | 000,018,008 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/05/20 23:12:27 | 000,000,056 | -H– | M] () – C:\WIXP\System32\ezsidmv.dat
[2010/05/20 22:00:06 | 000,115,768 | —- | M] () – C:\WIXP\System32\FNTCACHE.DAT
[2010/05/20 21:54:50 | 000,006,604 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\2010 May letter to MSBSD.rtf
[2010/05/20 21:53:14 | 000,000,687 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\latest herbs for us 2010.rtf
[2010/05/20 21:45:48 | 000,000,016 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb.lck
[2010/05/19 18:34:19 | 000,026,112 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Budget-YACT PR Committee-May 7.xls
[2010/05/17 21:04:41 | 000,001,689 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb
[2010/05/17 21:01:07 | 000,000,864 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/05/17 20:39:06 | 000,000,905 | —- | M] () – C:\Documents and Settings\All Users.WIXP\Desktop\OpenOffice.org 3.2.lnk
[2010/05/17 19:54:09 | 000,000,754 | —- | M] () – C:\WIXP\WORDPAD.INI
[2010/05/16 16:43:20 | 000,062,976 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\7Habits+class01.ppt
[2010/05/15 01:28:52 | 000,100,908 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\SystemLook.exe
[2010/05/12 16:12:46 | 000,000,386 | RHS- | M] () – C:\boot.ini
[2010/05/09 20:22:53 | 000,002,259 | —- | M] () – C:\Documents and Settings\All Users.WIXP\Desktop\Skype.lnk
[4 C:\WIXP\*.tmp files -> C:\WIXP\*.tmp -> ]
[1 C:\WIXP\System32\*.tmp files -> C:\WIXP\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/07 13:35:03 | 000,000,892 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\PRESS RELEASE.rtf
[2010/06/07 09:27:24 | 000,176,128 | —- | C] () – C:\WIXP\Qtabua.exe
[2010/06/07 09:27:06 | 000,000,294 | -H– | C] () – C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/06/07 09:27:00 | 000,070,656 | —- | C] () – C:\WIXP\System32\ernel32.dll
[2010/06/07 09:26:59 | 000,000,240 | -H– | C] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/06/07 09:26:51 | 000,070,656 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe
[2010/06/07 09:26:51 | 000,000,306 | -H– | C] () – C:\WIXP\tasks\MSWD-0c81ca32.job
[2010/06/07 03:39:27 | 000,003,096 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits - 6-6-10.rtf
[2010/06/07 03:38:18 | 000,000,188 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits.rtf
[2010/06/05 17:22:07 | 000,007,782 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.pdf
[2010/06/05 15:27:25 | 000,058,542 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\mo 036.JPG
[2010/06/05 14:49:32 | 000,032,308 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Mo's SD 2009 344.JPG
[2010/06/04 17:23:53 | 000,009,340 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.odt
[2010/06/04 17:22:35 | 000,012,669 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom from Tony.odt
[2010/06/04 17:20:45 | 000,015,489 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Wisdom from Mo.odt
[2010/06/03 14:56:08 | 000,092,533 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Health Risks.PDF
[2010/06/02 22:33:39 | 000,380,928 | —- | C] () – C:\WIXP\System32\actskin4.ocx
[2010/06/02 18:49:31 | 000,000,430 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental2.rtf
[2010/06/02 18:48:23 | 000,005,794 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental.rtf
[2010/06/02 12:52:07 | 000,000,436 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics
[2010/06/01 12:43:37 | 000,030,771 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Policies and Produres (1).pdf
[2010/05/31 16:58:35 | 000,237,314 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Intermediate.pdf
[2010/05/30 13:50:13 | 002,150,480 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\untitled_0.odt
[2010/05/28 22:46:10 | 000,229,727 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Graduation-Invitation.jpg
[2010/05/28 22:29:22 | 000,249,139 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Graduation-Invitation.jpg
[2010/05/28 22:17:37 | 000,025,563 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\class_of_2010-21926.jpg
[2010/05/20 23:12:27 | 000,000,056 | -H– | C] () – C:\WIXP\System32\ezsidmv.dat
[2010/05/20 21:54:50 | 000,006,604 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\2010 May letter to MSBSD.rtf
[2010/05/20 21:53:13 | 000,000,687 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\latest herbs for us 2010.rtf
[2010/05/19 18:34:18 | 000,026,112 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Budget-YACT PR Committee-May 7.xls
[2010/05/17 21:04:44 | 000,000,016 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb.lck
[2010/05/17 21:04:40 | 000,001,689 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb
[2010/05/17 21:01:07 | 000,000,864 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/05/17 20:39:06 | 000,000,905 | —- | C] () – C:\Documents and Settings\All Users.WIXP\Desktop\OpenOffice.org 3.2.lnk
[2010/05/17 19:54:09 | 000,000,754 | —- | C] () – C:\WIXP\WORDPAD.INI
[2010/05/16 16:43:20 | 000,062,976 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\7Habits+class01.ppt
[2010/05/15 01:28:52 | 000,100,908 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\SystemLook.exe
[2010/05/12 16:12:46 | 000,000,316 | —- | C] () – C:\Boot.bak
[2010/05/12 16:12:39 | 000,260,272 | —- | C] () – C:\cmldr
[2010/05/12 15:53:02 | 000,256,512 | —- | C] () – C:\WIXP\PEV.exe
[2010/05/12 15:53:02 | 000,098,816 | —- | C] () – C:\WIXP\sed.exe
[2010/05/12 15:53:02 | 000,080,412 | —- | C] () – C:\WIXP\grep.exe
[2010/05/12 15:53:02 | 000,077,312 | —- | C] () – C:\WIXP\MBR.exe
[2010/05/12 15:53:02 | 000,068,096 | —- | C] () – C:\WIXP\zip.exe
[2010/05/09 11:33:09 | 003,700,495 | R— | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ComboFix.exe
[2010/05/07 01:03:11 | 000,000,237 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\burnaware.ini
[2010/04/07 05:46:10 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\housecall.guid.cache
[2010/03/08 13:21:09 | 000,004,608 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/03 06:41:44 | 000,003,840 | —- | C] () – C:\WIXP\System32\drivers\BANTExt.sys
[2010/01/22 13:22:54 | 000,767,952 | —- | C] () – C:\WIXP\BDTSupport.dll.old
[2009/12/21 17:57:56 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.ini
[2009/12/21 17:57:54 | 000,016,384 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.dat.LOG
[2009/12/21 17:57:52 | 002,883,584 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\NTUSER.DAT
[2002/09/03 08:58:49 | 000,027,440 | —- | C] () – C:\WIXP\System32\drivers\secdrv.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:5C321E34
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:DFC5A2B2
< End of report >

gbsk

Post #23June 9, 2010, 5:33 PM UTC

Satchfan When running Task Manager, I notice a few programs running that I do not recognize like AshWebSv.exe, AshMaiSv.exe, ashServ.exe. I don't know if this will help or not. Thanks GB

Satchfan

Post #24June 9, 2010, 9:44 PM UTC

gbsk

Thanks for the additional information but don;t worry, AshWebSv.exe, AshMaiSv.exe and ashServ.exe all belong to Avast.

Satchfan

Satchfan

Post #25June 10, 2010, 1:24 PM UTC

Gbsk

You have some pretty nasty infections showing up in the latest log. If possible, it would be best not to use the Internet unless necessary until we have cleared this up. Do use it to see if there is any improvement after you have completed these steps.

There is one entry that is a bit confusing:

C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics

Have you tried to configure a home network using Internet Connection Sharing (ICS) and did you move that file to its present position?

OK let’s get rid of this bad stuff. Please let me know if you are unsure of anything in these instructions.

Download/run Rkill:

Please download Rkill from one of the following links and save to your Desktop:

Link One
Link Two
Link Three
Link Four

Double click on Rkill.
A command window will open then disappear upon completion, this is normal.
Please leave Rkill on the Desktop until otherwise advised.

Note: If your security software warns about Rkill, please ignore and allow the download to continue.

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) O4 - HKCU..\Run: [M5T8QL3YW3] C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe () [2010/06/07 16:54:26 | 000,000,240 | -H– | M] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010/06/07 16:42:38 | 000,000,294 | -H– | M] () – C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:5C321E34 @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:A8ADE5D8 @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:DFC5A2B2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed],[removed] O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.57,93.188.161.187 [2010/06/07 09:26:52 | 000,000,306 | -H– | M] () – C:\WIXP\tasks\MSWD-0c81ca32.job [2010/06/07 09:26:49 | 000,070,656 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe [2010/06/07 09:26:49 | 000,070,656 | —- | M] () – C:\WIXP\System32\ernel32.dll - :Commands [resethosts] [emptytemp] [start explorer] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Download the GMER Rootkit Scanner

I realise that I have asked you to run this before, but there are new infections and I’d like another look.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- All drives/partitions except C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Submit a file to VirusTotal

Go to VirusTotal and submit this file for analysis:

C:\WIXP\Qtabua.exe
• Click on Browse
• Click on the arrow and choose Local Disc (C:)
🖼Click to load external image (Posted Image)
• Below, double-click on Windows
• Double-click on the System32folder and then the Drivers folder
• Locate the file Qtabua.exe click on it and then on Open
• Click on Send File.
You will get a report back, post the report into this thread for me to see.

Logs to include with next post:

OTL.txt
Gmer.txt
VirusTotal result

Please remember to let me know about the hosts.ics file. Also, let me know how your Internet connection and links are behaving.

Satchfan

gbsk

Post #26June 12, 2010, 10:39 AM UTC

Satchfan

Below are all the files. AS you probably know, the computer is not working well. we will try not to use the computer too much. We are taking a class so we need it sometimes. I sure do not remember downloading the ips file about networking. Maybe that is the reason I cannot log in as an owner when I go to Safe Mode. I can only log in as an administrator. Not all the files are ther as an administrator. Also, when going to Virus Total to analyze the file, I could onhly go to drivers but the Qtabua.exe was not in between the letters p and r as q should be. I ran the file for drivers since that was as far as I could go. Just to let you know, we will not be here from June 16 to June 26. Hopefully, this will be fixed by theen though. I will work on this when I get your response.

Thansk
GB

OTL logfile created on: 6/7/2010 4:53:27 PM - Run 2
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 8.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 36.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WIXP | %ProgramFiles% = C:\Program Files
Drive C: | 38.25 Gb Total Space | 18.41 Gb Free Space | 48.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KHALSA-FAMILY
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe ()
PRC - C:\WIXP\Qtabua.exe ()
PRC - C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
PRC - C:\Program Files\Outlook Express\msimn.exe (Microsoft Corporation)
PRC - C:\WIXP\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WIXP\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WIXP\system32\iphlpapi.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (wuauserv) – C:\WINDOWS\system32\wuauserv.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (aswMon2) – C:\WIXP\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WIXP\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WIXP\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WIXP\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WIXP\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WIXP\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (BANTExt) – C:\WIXP\System32\Drivers\BANTExt.sys ()
DRV - (portD) – C:\WIXP\system32\drivers\portd2k.sys (CMS Peripherals, Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WIXP\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (AN983) – C:\WIXP\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (OMCI) – C:\WIXP\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/06/02 21:21:08 | 000,000,000 | —D | M]

[2009/12/21 14:30:16 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2002/09/03 08:34:19 | 000,000,734 | —- | M]) - C:\WIXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (GigagetIEHelper Class) - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WIXP\system32\gigagetbho_v10.dll (Giganology Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (xplorer2 Toolbar) - {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (xplorer2 Toolbar) - {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (xplorer2 Toolbar) - {DB35FDA8-77E3-4784-92C2-EE7345E91AF4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKCU..\Run: [M5T8QL3YW3] C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; All by Gigaget - C:\Program Files\Giganology\Gigaget\getAllurl.htm ()
O8 - Extra context menu item: &Download; by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm ()
O9 - Extra Button: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - Reg Error: Key error. File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WIXP\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WIXP\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed],[removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.57,93.188.161.187
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WIXP\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WIXP\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WIXP\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WIXP\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 18:29:56 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/07 16:29:44 | 000,000,000 | —D | C] – C:\WIXP\Sun
[2010/06/07 16:09:32 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ATF-Cleaner.exe
[2010/06/07 15:17:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/06/07 15:16:20 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javacpl.cpl
[2010/06/07 15:16:19 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaws.exe
[2010/06/07 15:16:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaw.exe
[2010/06/07 15:16:18 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\java.exe
[2010/06/04 15:27:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\OLYMPUS
[2010/06/04 15:14:05 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/06/03 15:55:10 | 016,295,712 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 22:34:15 | 000,023,120 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswRdr.sys
[2010/06/02 22:34:13 | 000,048,560 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswTdi.sys
[2010/06/02 22:34:12 | 000,027,408 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aavmker4.sys
[2010/06/02 22:34:09 | 000,097,480 | —- | C] (ALWIL Software) – C:\WIXP\System32\AvastSS.scr
[2010/06/02 22:34:08 | 000,114,768 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswSP.sys
[2010/06/02 22:34:08 | 000,094,160 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswmon2.sys
[2010/06/02 22:34:08 | 000,093,424 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswmon.sys
[2010/06/02 22:34:08 | 000,020,560 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswFsBlk.sys
[2010/06/02 22:33:39 | 001,280,480 | —- | C] (ALWIL Software) – C:\WIXP\System32\aswBoot.exe
[2010/06/02 22:33:39 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\WIXP\System32\MFC71.dll
[2010/05/28 15:21:07 | 000,031,232 | —- | C] (NirSoft) – C:\WIXP\NIRCMD.exe
[2010/05/21 05:16:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/05/17 20:58:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
[2010/05/17 20:36:53 | 000,000,000 | —D | C] – C:\Program Files\JRE
[2010/05/17 20:36:43 | 000,000,000 | —D | C] – C:\Program Files\OpenOffice.org 3
[2010/05/12 16:12:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/05/12 15:53:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WIXP\SWXCACLS.exe
[2010/05/12 15:53:02 | 000,161,792 | —- | C] (SteelWerX) – C:\WIXP\SWREG.exe
[2010/05/12 15:53:02 | 000,136,704 | —- | C] (SteelWerX) – C:\WIXP\SWSC.exe
[2010/05/12 15:50:32 | 000,000,000 | —D | C] – C:\WIXP\ERDNT
[2010/05/12 15:45:18 | 000,000,000 | —D | C] – C:\Qoobox
[2009/09/20 14:20:41 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2009/06/10 22:37:38 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/06/10 18:33:18 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/06/10 18:29:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/06/10 18:29:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[4 C:\WIXP\*.tmp files -> C:\WIXP\*.tmp -> ]
[1 C:\WIXP\System32\*.tmp files -> C:\WIXP\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/07 17:02:00 | 000,001,006 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
[2010/06/07 16:54:26 | 000,000,240 | -H– | M] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/06/07 16:42:38 | 000,000,294 | -H– | M] () – C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/06/07 16:23:16 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ATF-Cleaner.exe
[2010/06/07 16:11:00 | 000,000,884 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/07 15:15:32 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaws.exe
[2010/06/07 15:15:32 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaw.exe
[2010/06/07 15:15:32 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javacpl.cpl
[2010/06/07 15:15:31 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\java.exe
[2010/06/07 15:15:30 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\deployJava1.dll
[2010/06/07 15:11:00 | 000,000,880 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/07 13:36:46 | 000,000,892 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\PRESS RELEASE.rtf
[2010/06/07 12:02:00 | 000,000,954 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
[2010/06/07 09:26:53 | 000,176,128 | —- | M] () – C:\WIXP\Qtabua.exe
[2010/06/07 09:26:52 | 000,000,306 | -H– | M] () – C:\WIXP\tasks\MSWD-0c81ca32.job
[2010/06/07 09:26:49 | 000,070,656 | —- | M] () – C:\WIXP\System32\ernel32.dll
[2010/06/07 09:26:49 | 000,070,656 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe
[2010/06/07 04:20:35 | 000,003,096 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits - 6-6-10.rtf
[2010/06/07 03:38:18 | 000,000,188 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits.rtf
[2010/06/05 17:22:09 | 000,007,782 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.pdf
[2010/06/05 14:58:56 | 000,058,542 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\mo 036.JPG
[2010/06/05 14:49:32 | 000,032,308 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Mo's SD 2009 344.JPG
[2010/06/04 17:23:54 | 000,009,340 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.odt
[2010/06/04 17:22:35 | 000,012,669 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom from Tony.odt
[2010/06/04 17:20:47 | 000,015,489 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Wisdom from Mo.odt
[2010/06/04 15:05:47 | 000,000,006 | -H– | M] () – C:\WIXP\tasks\SA.DAT
[2010/06/04 15:05:27 | 000,002,048 | –S- | M] () – C:\WIXP\bootstat.dat
[2010/06/03 16:45:12 | 000,000,227 | —- | M] () – C:\WIXP\system.ini
[2010/06/03 15:55:11 | 016,295,712 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\jre-6u20-windows-i586.exe
[2010/06/03 10:57:31 | 000,092,533 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Health Risks.PDF
[2010/06/02 23:19:01 | 002,883,584 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\NTUSER.DAT
[2010/06/02 23:18:51 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.ini
[2010/06/02 22:34:08 | 000,002,626 | —- | M] () – C:\WIXP\System32\CONFIG.NT
[2010/06/02 19:02:26 | 005,890,370 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\IconCache.db
[2010/06/02 19:01:11 | 000,249,139 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Graduation-Invitation.jpg
[2010/06/02 18:49:31 | 000,000,430 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental2.rtf
[2010/06/02 18:48:23 | 000,005,794 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental.rtf
[2010/05/31 22:05:49 | 000,030,771 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Policies and Produres (1).pdf
[2010/05/31 16:58:35 | 000,237,314 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Intermediate.pdf
[2010/05/28 22:29:22 | 000,229,727 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Graduation-Invitation.jpg
[2010/05/28 22:17:37 | 000,025,563 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\class_of_2010-21926.jpg
[2010/05/28 13:51:07 | 003,700,495 | R— | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ComboFix.exe
[2010/05/23 14:29:07 | 002,150,480 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\untitled_0.odt
[2010/05/23 13:41:09 | 000,018,008 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/05/20 23:12:27 | 000,000,056 | -H– | M] () – C:\WIXP\System32\ezsidmv.dat
[2010/05/20 22:00:06 | 000,115,768 | —- | M] () – C:\WIXP\System32\FNTCACHE.DAT
[2010/05/20 21:54:50 | 000,006,604 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\2010 May letter to MSBSD.rtf
[2010/05/20 21:53:14 | 000,000,687 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\latest herbs for us 2010.rtf
[2010/05/20 21:45:48 | 000,000,016 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb.lck
[2010/05/19 18:34:19 | 000,026,112 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Budget-YACT PR Committee-May 7.xls
[2010/05/17 21:04:41 | 000,001,689 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb
[2010/05/17 21:01:07 | 000,000,864 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/05/17 20:39:06 | 000,000,905 | —- | M] () – C:\Documents and Settings\All Users.WIXP\Desktop\OpenOffice.org 3.2.lnk
[2010/05/17 19:54:09 | 000,000,754 | —- | M] () – C:\WIXP\WORDPAD.INI
[2010/05/16 16:43:20 | 000,062,976 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\7Habits+class01.ppt
[2010/05/15 01:28:52 | 000,100,908 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\SystemLook.exe
[2010/05/12 16:12:46 | 000,000,386 | RHS- | M] () – C:\boot.ini
[2010/05/09 20:22:53 | 000,002,259 | —- | M] () – C:\Documents and Settings\All Users.WIXP\Desktop\Skype.lnk
[4 C:\WIXP\*.tmp files -> C:\WIXP\*.tmp -> ]
[1 C:\WIXP\System32\*.tmp files -> C:\WIXP\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/07 13:35:03 | 000,000,892 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\PRESS RELEASE.rtf
[2010/06/07 09:27:24 | 000,176,128 | —- | C] () – C:\WIXP\Qtabua.exe
[2010/06/07 09:27:06 | 000,000,294 | -H– | C] () – C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/06/07 09:27:00 | 000,070,656 | —- | C] () – C:\WIXP\System32\ernel32.dll
[2010/06/07 09:26:59 | 000,000,240 | -H– | C] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/06/07 09:26:51 | 000,070,656 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe
[2010/06/07 09:26:51 | 000,000,306 | -H– | C] () – C:\WIXP\tasks\MSWD-0c81ca32.job
[2010/06/07 03:39:27 | 000,003,096 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits - 6-6-10.rtf
[2010/06/07 03:38:18 | 000,000,188 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmaster Tidbits.rtf
[2010/06/05 17:22:07 | 000,007,782 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.pdf
[2010/06/05 15:27:25 | 000,058,542 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\mo 036.JPG
[2010/06/05 14:49:32 | 000,032,308 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Mo's SD 2009 344.JPG
[2010/06/04 17:23:53 | 000,009,340 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.odt
[2010/06/04 17:22:35 | 000,012,669 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom from Tony.odt
[2010/06/04 17:20:45 | 000,015,489 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Wisdom from Mo.odt
[2010/06/03 14:56:08 | 000,092,533 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Health Risks.PDF
[2010/06/02 22:33:39 | 000,380,928 | —- | C] () – C:\WIXP\System32\actskin4.ocx
[2010/06/02 18:49:31 | 000,000,430 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental2.rtf
[2010/06/02 18:48:23 | 000,005,794 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental.rtf
[2010/06/02 12:52:07 | 000,000,436 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics
[2010/06/01 12:43:37 | 000,030,771 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Policies and Produres (1).pdf
[2010/05/31 16:58:35 | 000,237,314 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Intermediate.pdf
[2010/05/30 13:50:13 | 002,150,480 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\untitled_0.odt
[2010/05/28 22:46:10 | 000,229,727 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Graduation-Invitation.jpg
[2010/05/28 22:29:22 | 000,249,139 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Graduation-Invitation.jpg
[2010/05/28 22:17:37 | 000,025,563 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\class_of_2010-21926.jpg
[2010/05/20 23:12:27 | 000,000,056 | -H– | C] () – C:\WIXP\System32\ezsidmv.dat
[2010/05/20 21:54:50 | 000,006,604 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\2010 May letter to MSBSD.rtf
[2010/05/20 21:53:13 | 000,000,687 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\latest herbs for us 2010.rtf
[2010/05/19 18:34:18 | 000,026,112 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Budget-YACT PR Committee-May 7.xls
[2010/05/17 21:04:44 | 000,000,016 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb.lck
[2010/05/17 21:04:40 | 000,001,689 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb
[2010/05/17 21:01:07 | 000,000,864 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/05/17 20:39:06 | 000,000,905 | —- | C] () – C:\Documents and Settings\All Users.WIXP\Desktop\OpenOffice.org 3.2.lnk
[2010/05/17 19:54:09 | 000,000,754 | —- | C] () – C:\WIXP\WORDPAD.INI
[2010/05/16 16:43:20 | 000,062,976 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\7Habits+class01.ppt
[2010/05/15 01:28:52 | 000,100,908 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\SystemLook.exe
[2010/05/12 16:12:46 | 000,000,316 | —- | C] () – C:\Boot.bak
[2010/05/12 16:12:39 | 000,260,272 | —- | C] () – C:\cmldr
[2010/05/12 15:53:02 | 000,256,512 | —- | C] () – C:\WIXP\PEV.exe
[2010/05/12 15:53:02 | 000,098,816 | —- | C] () – C:\WIXP\sed.exe
[2010/05/12 15:53:02 | 000,080,412 | —- | C] () – C:\WIXP\grep.exe
[2010/05/12 15:53:02 | 000,077,312 | —- | C] () – C:\WIXP\MBR.exe
[2010/05/12 15:53:02 | 000,068,096 | —- | C] () – C:\WIXP\zip.exe
[2010/05/09 11:33:09 | 003,700,495 | R— | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ComboFix.exe
[2010/05/07 01:03:11 | 000,000,237 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\burnaware.ini
[2010/04/07 05:46:10 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\housecall.guid.cache
[2010/03/08 13:21:09 | 000,004,608 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/03 06:41:44 | 000,003,840 | —- | C] () – C:\WIXP\System32\drivers\BANTExt.sys
[2010/01/22 13:22:54 | 000,767,952 | —- | C] () – C:\WIXP\BDTSupport.dll.old
[2009/12/21 17:57:56 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.ini
[2009/12/21 17:57:54 | 000,016,384 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.dat.LOG
[2009/12/21 17:57:52 | 002,883,584 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\NTUSER.DAT
[2002/09/03 08:58:49 | 000,027,440 | —- | C] () – C:\WIXP\System32\drivers\secdrv.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:5C321E34
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:DFC5A2B2
< End of report >

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\M5T8QL3YW3 deleted successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe moved successfully.
C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully.
C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job moved successfully.
ADS C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:5C321E34 deleted successfully.
ADS C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:A8ADE5D8 deleted successfully.
ADS C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:DFC5A2B2 deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer| /E : value set successfully!
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\NameServer| /E : value set successfully!
C:\WIXP\tasks\MSWD-0c81ca32.job moved successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe moved successfully.
C:\WIXP\System32\ernel32.dll moved successfully.
========== COMMANDS ==========
C:\WIXP\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 3351883 bytes

User: Administrator.KHALSA-FAMILY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 593 bytes

User: All Users

User: All Users.WIXP

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User.WIXP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: GB
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 4468870 bytes
->Flash cache emptied: 405 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: HAKK
->Temp folder emptied: 5534718 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 14506 bytes
->FireFox cache emptied: 52186921 bytes
->Flash cache emptied: 40870 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 78579819 bytes
->Flash cache emptied: 675 bytes

User: Owner.KHALSA-FAMILY
->Temp folder emptied: 283675646 bytes
->Temporary Internet Files folder emptied: 721014230 bytes
->Java cache emptied: 2972 bytes
->Google Chrome cache emptied: 182868310 bytes
->Flash cache emptied: 2127659 bytes

User: OWNER~1~KHA

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1126364 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 625147 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 2454259 bytes
RecycleBin emptied: 787 bytes

Total Files Cleaned = 1,276.00 mb

OTL by OldTimer - Version 3.2.1.1 log created on 06122010_010314

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\FQSWZG2T\%253Futm_source%253Dabc%2526utm_medium%253Dcpc%2526utm_campaign%253Dabc117143%253Faffiliate%253Dmu1-939287day%252520Weather%252520Of%252520Lexington%252520Kentucky[1] not found!
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\FQSWZG2T\_hid=999305559&ga;_fc=0&u;_tz=-480&u;_his=3&u;_java=1&u;_h=768&u;_w=1024&u;_ah=738&u;_aw=1024&u;_cd=32&u;_nplug=0&u;_nmime=0&biw;=-12245933&bih;=-12245933&ifk;=2908320451&fu;=0&ifi;=1&dtd;=62 not found!
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\DH9QFIQ2\%253Futm_source%253Dabc%2526utm_medium%253Dcpc%2526utm_campaign%253Dabc117144%253Faffiliate%253Dmx3-33070Move%252520Modules%252520On%252520Myspace[1] not found!
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\DH9QFIQ2\;net=btg;u=,btg-8316551_1275956764,11938b4ee60aa7d,entertainment,;;loc=af;dcopt=ist;lan=es;tile=
1;ord1=918390;sz=728x90;if=0;contx=entertainment;btg=;ord=4048358600[2] not found!
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\DH9QFIQ2\id=1913729464&ga;_fc=0&u;_tz=-480&u;_his=2&u;_java=1&u;_h=768&u;_w=1024&u;_ah=738&u;_aw=1024&u;_cd=32&u;_nplug=0&u;_nmime=0&biw;=-12245933&bih;=-12245933&ifk;=2908320451&fu;=0&ifi;=1&dtd;=156 not found!
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\CINOPOWA\;net=btg;u=,btg-1095871_1275956844,11938b4ee60aa7d,entertainment,;;loc=bf;dcopt=ist;lan=es;tile=
1;ord1=615413;sz=300x250;if=1;contx=entertainment;btg=;ord=2970587774[2] not found!
File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\CINOPOWA\;net=btg;u=,btg-41516977_1275959931,11938b4ee60aa7d,entertainment,;;loc=af;dcopt=ist;lan=es;tile
=1;ord1=846853;sz=728x90;if=0;contx=entertainment;btg=;ord=6453813649[2] not found!
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\~DF6BE.tmp moved successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\~DF7739.tmp moved successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\~DFFBED.tmp moved successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temporary Internet Files\Content.IE5\CRM3ASO2\iframe[1].htm moved successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temporary Internet Files\Content.IE5\CRM3ASO2\pixel[1].gif moved successfully.
C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temporary Internet Files\Content.IE5\CRM3ASO2\pixel[2].gif moved successfully.
File move failed. C:\WIXP\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File\Folder C:\WIXP\temp\Perflib_Perfdata_450.dat not found!

Registry entries deleted on Reboot…

File Qtabua.exe received on 2010.06.12 10:18:23 (UTC)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED

Result: 25/41 (60.98%)
Loading server information…
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 5.0.0.26 2010.06.12 -
AhnLab-V3 2010.06.12.00 2010.06.12 Win-Trojan/Agent.176128.IO
AntiVir 8.2.2.6 2010.06.11 TR/Dldr.Renos.LX.11
Antiy-AVL 2.0.3.7 2010.06.11 -
Authentium 5.2.0.5 2010.06.12 W32/FakeAlert.GZ.gen!Eldorado
Avast 4.8.1351.0 2010.06.12 -
Avast5 5.0.332.0 2010.06.12 Win32:SuspBehav-C
AVG 9.0.0.787 2010.06.11 Downloader.Generic9.CBGS
BitDefender 7.2 2010.06.12 -
CAT-QuickHeal 10.00 2010.06.12 -
ClamAV 0.96.0.3-git 2010.06.12 -
Comodo 5069 2010.06.12 -
DrWeb 5.0.2.03300 2010.06.12 Trojan.Siggen1.40126
eSafe 7.0.17.0 2010.06.10 -
eTrust-Vet 36.1.7629 2010.06.11 Win32/FakeCodec.C!generic
F-Prot 4.6.0.103 2010.06.12 W32/FakeAlert.GZ.gen!Eldorado
F-Secure 9.0.15370.0 2010.06.11 Suspicious:W32/Malware!Gemini
Fortinet 4.1.133.0 2010.06.11 -
GData 21 2010.06.12 -
Ikarus T3.1.1.84.0 2010.06.12 -
Jiangmin 13.0.900 2010.06.12 -
Kaspersky 7.0.0.125 2010.06.12 Packed.Win32.Katusha.n
McAfee 5.400.0.1158 2010.06.12 Downloader-CEW.b
McAfee-GW-Edition 2010.1 2010.06.11 -
Microsoft 1.5802 2010.06.12 TrojanDownloader:Win32/Renos.LX
NOD32 5191 2010.06.11 a variant of Win32/Kryptik.EUO
Norman 6.04.12 2010.06.12 W32/Suspicious_Gen2.AZSRI
nProtect 2010-06-12.01 2010.06.12 -
Panda 10.0.2.7 2010.06.12 W32/Autoit.KT
PCTools 7.0.3.5 2010.06.12 Trojan.FakeAV
Prevx 3.0 2010.06.12 High Risk Cloaked Malware
Rising 22.51.05.02 2010.06.12 Trojan.Win32.Generic.5207EBAD
Sophos 4.54.0 2010.06.12 Mal/FakeAV-CX
Sunbelt 6439 2010.06.12 VirTool.Win32.Obfuscator.hg!b (v)
Symantec 20101.1.0.89 2010.06.12 Trojan.FakeAV!gen29
TheHacker 6.5.2.0.297 2010.06.11 -
TrendMicro 9.120.0.1004 2010.06.12 TROJ_FRAUD.SMAG
TrendMicro-HouseCall 9.120.0.1004 2010.06.12 TROJ_FRAUD.SMAG
VBA32 3.12.12.5 2010.06.11 Malware-Cryptor.Win32.Palka
ViRobot 2010.6.12.3882 2010.06.12 -
VirusBuster 5.0.27.0 2010.06.11 Trojan.Codecpack.Gen.6
Additional information
File size: 176128 bytes
MD5…: 78846b0917fc5019864fc55997405e3b
SHA1..: cf83e418adcfdb465ffa3c16855cecc00aeb3e7f
SHA256: 5677ee37b624f66baed470db423a86640ab981d633cafa0f5c9f5d30814e342f
ssdeep: 3072:XwpPcwOzzIXAGJAoDnA75poTGPTh30TdEFd7uo01buJTj5yuJ7mdd:XGcwM
zIXLO6A75pNPR07bZu5m

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x217be
timedatestamp…..: 0x4a8f3ba6 (Sat Aug 22 00:28:22 2009)
machinetype…….: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x278d0 0x27a00 7.09 1de9ea52f71c5850c0667d10d779447a
.init 0x29000 0x1cca 0x1e00 5.14 3018e24ac41763e9940b1fd4bbe67269
BSS 0x2b000 0xeff2 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.idata 0x3a000 0x378 0x400 0.79 d731cef0dcfb764d0e6abbc50ff6e583

( 6 imports )
> KERNEL32.dll: GetDiskFreeSpaceA, GetProcessHeap, WideCharToMultiByte, SizeofResource, GetVersionExA, LoadLibraryA, LockResource, FreeLibrary, lstrcpynA, VirtualAlloc, CompareStringA, GetLocaleInfoA, GetThreadLocale, WaitForSingleObject, EnumCalendarInfoA, GlobalFindAtomA, ReadFile, VirtualQuery, GetStdHandle, ExitProcess, SetThreadLocale, ResetEvent, SetEndOfFile, lstrcmpiA, Sleep, GetEnvironmentStrings, LoadResource, GetFileSize, GetModuleFileNameA, GetACP, HeapDestroy, DeleteFileA, GetUserDefaultLCID, CreateEventA, HeapFree, GetCommandLineA, GetFileType, lstrcatA, SetErrorMode, GetVersion, GetCurrentThread, SetLastError, MoveFileA, lstrcmpA, FindFirstFileA, EnterCriticalSection, FindClose, VirtualFree, GetProcAddress, CloseHandle, WriteFile, GlobalAddAtomA, CreateThread, FreeResource, ExitThread, GetCurrentThreadId, GetCPInfo, GetTickCount, lstrlenA, GetFileAttributesA, lstrcpyA, RaiseException, GetModuleHandleA, GetStringTypeW, GetCurrentProcessId, SetFilePointer, GetFullPathNameA, LoadLibraryExA, GetDateFormatA, LocalAlloc, MulDiv, SetEvent, InitializeCriticalSection, SetHandleCount, HeapAlloc, GetStringTypeA, GetCurrentProcess, GetLastError, VirtualAllocEx, MoveFileExA, FindResourceA, GetOEMCP, GlobalDeleteAtom, LocalFree, GetLocalTime, LocalReAlloc
> USER32.dll: GetTopWindow, EnableScrollBar, IsWindowVisible, ShowWindow, MsgWaitForMultipleObjects, MapVirtualKeyA, GetScrollPos, SetWindowsHookExA, MoveWindow, IsWindowUnicode, SendMessageA, LoadIconA, KillTimer, wsprintfA, ReleaseDC, CharLowerBuffA, GetKeyNameTextA, IsDialogMessageA, OffsetRect, EqualRect, PostQuitMessage, ActivateKeyboardLayout, DrawEdge, EnableMenuItem, DrawIconEx, SetScrollPos, PeekMessageW, GetParent, RemovePropA, EnumThreadWindows, GetWindowLongA, GetIconInfo, LoadKeyboardLayoutA, GetClientRect, DispatchMessageA, EndPaint, EnableWindow, GetSystemMenu, RedrawWindow, GetMenuStringA, CreateIcon, SetActiveWindow, DestroyMenu, SetWindowTextA, ShowOwnedPopups, SetRect, SetMenuItemInfoA, IsDialogMessageW, SetCursor, EmptyClipboard, CreateWindowExA, CallWindowProcA, GetClassNameA, UnregisterClassA, InsertMenuA, FillRect, DefWindowProcA, SetWindowPlacement, SetWindowLongW, GetWindow, ScrollWindow, InsertMenuItemA, GetMenuState, ReleaseCapture, CreateMenu, DrawAnimatedRects, GetDC, SendMessageW, SetMenu, CharNextW, GetSystemMetrics, GetCapture, DestroyCursor, GetWindowRect, GetMenuItemInfoA, GetKeyboardLayout, GetPropA, SetFocus, ShowScrollBar, IsIconic, DefMDIChildProcA, DestroyIcon, CharUpperBuffA, IsRectEmpty, OpenClipboard, InvalidateRect, IsWindowEnabled, IntersectRect, SetTimer, CheckMenuItem, GetClipboardData, SystemParametersInfoA, GetActiveWindow, LoadStringA, GetKeyboardType, GetSubMenu, RegisterClipboardFormatA, BeginPaint, CloseClipboard, TranslateMessage, GetMenuItemID, GetKeyState, FindWindowA, ChildWindowFromPoint, GetDesktopWindow, SetParent, GetDlgItem, GetKeyboardLayoutList, InflateRect, GetWindowDC, MessageBoxA, LoadCursorA, ClientToScreen, FrameRect, SetScrollInfo, EnumWindows, GetScrollInfo, GetFocus, ScreenToClient, RegisterWindowMessageA, SetClipboardData, GetClassLongA, MapWindowPoints, OemToCharA, GetMessagePos, GetSysColorBrush, GetScrollRange, TrackPopupMenu, CharToOemA, DrawTextA, DispatchMessageW, SetScrollRange, CharLowerA, PeekMessageA, UnhookWindowsHookEx, EnumChildWindows, GetWindowTextA, GetMenu, DrawIcon, CreatePopupMenu, UpdateWindow, TranslateMDISysAccel, SetWindowPos, SetForegroundWindow, DrawFrameControl, DeleteMenu, PostMessageA, GetKeyboardLayoutNameA, GetSysColor, GetWindowLongW, CallNextHookEx, RegisterClassA, SetWindowLongA, SetPropA, GetDCEx, SetClassLongA, SetCapture, DrawMenuBar, GetKeyboardState, IsChild, GetCursor, DefFrameProcA, CharNextA, GetClassInfoA, WindowFromPoint, GetMenuItemCount, RemoveMenu, GetLastActivePopup, GetWindowPlacement, WaitMessage, IsZoomed, IsWindow, PtInRect
> COMDLG32.dll: GetOpenFileNameA
> shell32.dll: SHGetDiskFreeSpaceA, SHFileOperationA
> ole32.dll: CoGetContextToken, StgOpenStorage, CreateStreamOnHGlobal, PropVariantClear, CoCreateInstanceEx, CoRevokeClassObject, CoUninitialize, WriteClassStm
> msvcrt.dll: memmove, strncmp, log10, strcmp, memcpy, wcscspn

( 0 exports )

RDS…: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (58.5%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

http://info.prevx.com/aboutprogramtext.asp?PX5=2E25CF0E00699277B02A0262CAFCAB00A841E7E8' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=2E25CF0E00699277B02A0262CAFCAB00A841E7E8

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

Satchfan

Post #27June 12, 2010, 4:29 PM UTC

Gbsk

Things are looking better but I still need the Gmer log that I asked for in the last post.

Before running Gmer, (instructions in previous post), I need to see the contents of the hosts.ics and then we’ll get rid of the file that was looked at.

To show the contents of hosts.ics:
• Open Windows Explorer (Windows key+E}
• Navigate to C:\WINDOWS\SYSTEM32\DRIVERS\Etc
• Click on etc to show the contents
• In the right window, right-click on hosts.ics and then on Open
• A list will appear asking what to open it with: choose Notepad
• Copy and paste the contents in your next reply.
Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WIXP\Qtabua.exe () [2010/06/07 09:27:24 | 000,176,128 | —- | C] () – C:\WIXP\Qtabua.exe [start explorer] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
Post the log it produces in your next reply.

Please follow the previous instructions to run Gmer.

Let me know if there is any improvement now and include:

Contents of hosts.ics
OTL.txt
Gmer.txt

Thanks

Satchfan

gbsk

Post #28June 14, 2010, 8:55 AM UTC

Satchfan, Sorry about the gmer. I thought I sent it but I guess not.. The computer seems to be working better. I even went to Safe Mode and I could log on as Owner. When I restarted the computer, I got a message that said I got rid of a serious threat or something like that. The computer seems to be working better. However, some items onn task bar are not blue but orange and do not open right away. I am guessinga memory problem but am not sure. I am guessing I only have a half gig open according to Task Manager. but have 1.5 gigs available. Thanks so much. Here are the logs. I do not have a hosts.ics file but I included all 3 files in etc. folder. All processes killed ========== OTL ========== No active process named explorer.exe was found! Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\M5T8QL3YW3 deleted successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\temp\Qcd.exe moved successfully. C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully. C:\WIXP\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job moved successfully. ADS C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:5C321E34 deleted successfully. ADS C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:A8ADE5D8 deleted successfully. ADS C:\Documents and Settings\All Users.WIXP\Application Data\TEMP:DFC5A2B2 deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer| /E : value set successfully! HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\NameServer| /E : value set successfully! C:\WIXP\tasks\MSWD-0c81ca32.job moved successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\0c81ca32.exe moved successfully. C:\WIXP\System32\ernel32.dll moved successfully. ========== COMMANDS ========== C:\WIXP\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->FireFox cache emptied: 3351883 bytes User: Administrator.KHALSA-FAMILY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 593 bytes User: All Users User: All Users.WIXP User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Default User.WIXP ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: GB ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 4468870 bytes ->Flash cache emptied: 405 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: HAKK ->Temp folder emptied: 5534718 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 14506 bytes ->FireFox cache emptied: 52186921 bytes ->Flash cache emptied: 40870 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Owner ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 78579819 bytes ->Flash cache emptied: 675 bytes User: Owner.KHALSA-FAMILY ->Temp folder emptied: 283675646 bytes ->Temporary Internet Files folder emptied: 721014230 bytes ->Java cache emptied: 2972 bytes ->Google Chrome cache emptied: 182868310 bytes ->Flash cache emptied: 2127659 bytes User: OWNER~1~KHA %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1126364 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 625147 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 2454259 bytes RecycleBin emptied: 787 bytes Total Files Cleaned = 1,276.00 mb OTL by OldTimer - Version 3.2.1.1 log created on 06122010_010314 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\FQSWZG2T\%253Futm_source%253Dabc%2526utm_medium%253Dcpc%2526utm_campaign%253Dabc117143%253Faffiliate%253Dmu1-939287day%252520Weather%252520Of%252520Lexington%252520Kentucky[1] not found! File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\FQSWZG2T\_hid=999305559&ga_fc=0&u_tz=-480&u_his=3&u_java=1&u_h=768&u_w=1024&u_ah=738&u_aw=1024&u_cd=32&u_nplug=0&u_nmime=0&biw=-12245933&bih=-12245933&ifk=2908320451&fu=0&ifi=1&dtd=62 not found! File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\DH9QFIQ2\%253Futm_source%253Dabc%2526utm_medium%253Dcpc%2526utm_campaign%253Dabc117144%253Faffiliate%253Dmx3-33070Move%252520Modules%252520On%252520Myspace[1] not found! File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\DH9QFIQ2\;net=btg;u=,btg-8316551_1275956764,11938b4ee60aa7d,entertainment,;;loc=af;dcopt=ist;lan=es;tile= 1;ord1=918390;sz=728x90;if=0;contx=entertainment;btg=;ord=4048358600[2] not found! File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\DH9QFIQ2\id=1913729464&ga_fc=0&u_tz=-480&u_his=2&u_java=1&u_h=768&u_w=1024&u_ah=738&u_aw=1024&u_cd=32&u_nplug=0&u_nmime=0&biw=-12245933&bih=-12245933&ifk=2908320451&fu=0&ifi=1&dtd=156 not found! File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\CINOPOWA\;net=btg;u=,btg-1095871_1275956844,11938b4ee60aa7d,entertainment,;;loc=bf;dcopt=ist;lan=es;tile= 1;ord1=615413;sz=300x250;if=1;contx=entertainment;btg=;ord=2970587774[2] not found! File\Folder C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\Temporary Internet Files\Content.IE5\CINOPOWA\;net=btg;u=,btg-41516977_1275959931,11938b4ee60aa7d,entertainment,;;loc=af;dcopt=ist;lan=es;tile =1;ord1=846853;sz=728x90;if=0;contx=entertainment;btg=;ord=6453813649[2] not found! C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\~DF6BE.tmp moved successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\~DF7739.tmp moved successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temp\~DFFBED.tmp moved successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temporary Internet Files\Content.IE5\CRM3ASO2\iframe[1].htm moved successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temporary Internet Files\Content.IE5\CRM3ASO2\pixel[1].gif moved successfully. C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Temporary Internet Files\Content.IE5\CRM3ASO2\pixel[2].gif moved successfully. File move failed. C:\WIXP\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. File\Folder C:\WIXP\temp\Perflib_Perfdata_450.dat not found! Registry entries deleted on Reboot… # Copyright © 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost # Copyright © 1993-1999 Microsoft Corp. # # This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to computernames # (NetBIOS) names. Each entry should be kept on an individual line. # The IP address should be placed in the first column followed by the # corresponding computername. The address and the computername # should be separated by at least one space or tab. The "#" character # is generally used to denote the start of a comment (see the exceptions # below). # # This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts # files and offers the following extensions: # # #PRE # #DOM:

gbsk

Post #29June 14, 2010, 2:35 PM UTC

Satchfan I just noticed that when I click on some links, I also get links on commercial sites - some kind of spyware. GB

Satchfan

Post #30June 14, 2010, 2:43 PM UTC

gbsk Can you give an example of a link that you are clicking on and one that you gt which is a "commercial" one. Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Microsoft did not Fix

✨ Ask AI

Ask AI