What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Solved] I have an win32:vundo-IV virus I think

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Help please - help me rid this virus from my computer. below is the scan i got today - thanks! DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 11:01:39.35 on Mon 05/31/2010 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_07 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.135 [GMT -5:00] AV: avast! antivirus 4.8.1368 [VPS 100531-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\Documents and Settings\Desktop\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 TB: Yahoo! ¤u¨ã¦C: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn5\yt.dll TB: {805238C5-D485-42F9-94E2-D7F7523DABD6} - No File EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\progra~1\yahoo!\common\yhexbmesus.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [lahohudan] Rundll32.exe "c:\windows\system32\vodawoja.dll",a DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab Notify: igfxcui - igfxsrvc.dll AppInit_DLLs: c:\windows\system32\vodawoja.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SSODL: tujoninuy - {92a271f5-f206-4c8f-b7f3-1edb2670980f} - c:\windows\system32\vodawoja.dll STS: kupuhivus: {92a271f5-f206-4c8f-b7f3-1edb2670980f} - c:\windows\system32\vodawoja.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll LSA: Notification Packages = scecli gavewuwu.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\desktop\applic~1\mozilla\firefox\profiles\xvyhvjjx.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?.home=ytff FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p= FF - component: c:\documents and settings\desktop\application data\mozilla\firefox\profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - plugin: c:\documents and settings\desktop\application data\move networks\plugins\npqmp071505000011.dll FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPAdbESD.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-4-6 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-4-6 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2007-1-8 138680] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2007-1-8 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2007-1-8 352920] S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] S3 P1120VID;Creative WebCam NX Ultra;c:\windows\system32\drivers\P1120Vid.sys [2004-4-25 759050] =============== Created Last 30 ================ 2010-05-29 16:19 -cd—– C:\New Folder 2010-05-29 16:18 -cd—– C:\Hijack 2010-05-14 17:35 35,226 ac—— C:\brent.jpg 2010-05-14 17:32 11,601 ac—— C:\carolyn.jpg 2010-05-03 18:58 31,744 ac—— C:\Fasweet receipt.doc ==================== Find3M ==================== 2010-05-12 11:21 221,568 ——– c:\windows\system32\MpSigStub.exe 2010-03-11 07:38 832,512 a——- c:\windows\system32\wininet.dll 2010-03-11 07:38 78,336 a——- c:\windows\system32\ieencode.dll 2010-03-11 07:38 17,408 a——- c:\windows\system32\corpol.dll 2010-03-09 06:09 430,080 a——- c:\windows\system32\vbscript.dll 2010-02-27 00:31 71,168 a–sh— c:\windows\system32\gavewuwu.dll 2010-02-27 00:31 71,168 a–sh— c:\windows\system32\kukamibi.dll 2010-02-27 00:31 100,352 a–sh— c:\windows\system32\libukifu.dll 2010-02-27 00:31 71,168 a–sh— c:\windows\system32\neverizi.dll 2010-02-28 00:31 99,328 a–sh— c:\windows\system32\pimihiva.dll 2010-02-27 00:31 71,168 a–sh— c:\windows\system32\tarowata.dll 2010-02-27 12:31 100,352 a–sh— c:\windows\system32\vajarusu.dll 2010-02-26 12:31 100,352 a–sh— c:\windows\system32\vakuhule.dll 0000-00-00 00:00 99,328 a–sh— c:\windows\system32\vodawoja.dll 2008-08-31 12:27 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008083120080901\index.dat ============= FINISH: 11:02:28.18 ===============
Post #2
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
  • Please make sure to carefully read any instruction that I give you.
    Reading too lightly will cause you to miss important steps, which could have destructive effects.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days     failure to reply will result in the topic being closed!
  • Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 4 days) and you need an explanation. If that's the case, just send me a message to me on here. ;)
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
____________________________________________________

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now
Post #3
I followed your instructions - it appears to be running as good as it was before I had this problem.. Below is the combofix logo file it gave me - please let me know if there is anything else I need to do and thank you for your help:

ComboFix 10-05-30.09 - Desktop 05/31/2010 14:10:09.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.248 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100531-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\desktop.ini
c:\documents and settings\Desktop\Application Data\FunWebProducts
c:\documents and settings\Desktop\Application Data\FunWebProducts\Data\Desktop\avatar.dat
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
c:\program files\FunWebProducts\Shared\Cache\MailStampBtn.html
c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
c:\program files\FunWebProducts\Shared\Cache\MyStationeryBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\2.bin\F3BROVLY.DLL
c:\program files\MyWebSearch\bar\2.bin\F3CJpeg.dll
c:\program files\MyWebSearch\bar\2.bin\F3DTactl.dll
c:\program files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SCrctr.dll
c:\program files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MSg.dll
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\close.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\common-x.css
c:\program files\MyWebSearch\bar\Avatar\COMMON\common.css
c:\program files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\htmlctrl.js
c:\program files\MyWebSearch\bar\Avatar\COMMON\include.js
c:\program files\MyWebSearch\bar\Avatar\COMMON\index.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\loading.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\login.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\logo.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\max.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\min.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
c:\program files\MyWebSearch\bar\Avatar\COMMON\unmax.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\wardrobe.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\window.ico
c:\program files\MyWebSearch\bar\Cache\002AF09D.bin
c:\program files\MyWebSearch\bar\Cache\002B5D41.bin
c:\program files\MyWebSearch\bar\Cache\002B68AB.bin
c:\program files\MyWebSearch\bar\Cache\002B7907.bin
c:\program files\MyWebSearch\bar\Cache\002B8D4A.bin
c:\program files\MyWebSearch\bar\Cache\002BA130.bin
c:\program files\MyWebSearch\bar\Cache\002BB833.bin
c:\program files\MyWebSearch\bar\Cache\002BCAF0.bin
c:\program files\MyWebSearch\bar\Cache\013E0A65.bin
c:\program files\MyWebSearch\bar\Cache\013E0DFF.bin
c:\program files\MyWebSearch\bar\Cache\013E137D.bin
c:\program files\MyWebSearch\bar\Cache\057317EB
c:\program files\MyWebSearch\bar\Cache\05731CBE.bin
c:\program files\MyWebSearch\bar\Cache\057DAF1A.bin
c:\program files\MyWebSearch\bar\Cache\0B21B7A6
c:\program files\MyWebSearch\bar\Cache\17F497C9
c:\program files\MyWebSearch\bar\Cache\27D20D4E.bin
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search
c:\program files\MyWebSearch\bar\History\search2
c:\program files\MyWebSearch\bar\Settings\prevcfg.htm
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\program files\MyWebSearch\bar\Settings\settings.dat.bak
c:\program files\MyWebSearch\bar\Settings\settings.htm
c:\program files\seekmo
c:\program files\seekmo\seekmo_gdf.dat
c:\program files\seekmo\seekmo_hpk.dat
c:\program files\seekmo\seekmo_kyf.dat
c:\program files\seekmo\seekmoau.dat
c:\program files\Shared
c:\windows\system32\gavewuwu.dll
c:\windows\system32\vodawoja.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SVCPROC


((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-31 )))))))))))))))))))))))))))))))
.

2010-05-29 21:19 . 2010-05-29 21:19 ——– dc—-w- C:\New Folder
2010-05-29 21:18 . 2010-05-31 16:34 ——– dc—-w- C:\Hijack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:22 . 2009-10-29 02:56 ——– d—–w- c:\program files\QuickTime
2010-05-18 22:12 . 2009-10-12 14:44 ——– d—–w- c:\program files\VPACS
2010-05-12 16:21 . 2009-10-02 20:35 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-04-24 22:11 . 2010-04-24 22:11 ——– d—–w- c:\documents and settings\Desktop\Application Data\TuneUp Software
2010-04-24 22:10 . 2010-04-24 22:09 ——– dc—-w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-04-24 22:09 . 2010-04-24 22:09 ——– dcsh–w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-24 01:56 . 2007-06-01 22:30 ——– d—–w- c:\documents and settings\Desktop\Application Data\Skype
2010-04-23 21:07 . 2010-03-10 08:51 ——– d—–w- c:\documents and settings\Desktop\Application Data\skypePM
2010-03-11 12:38 . 2005-06-18 04:49 832512 —-a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2003-12-02 00:28 17408 —-a-w- c:\windows\system32\corpol.dll
2010-03-10 08:51 . 2010-03-10 08:51 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-03-09 11:09 . 2003-12-02 00:28 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-02-27 05:31 . 2010-02-27 05:31 71168 –sha-w- c:\windows\system32\kukamibi.dll
2010-02-27 05:31 . 2010-02-27 05:31 100352 –sha-w- c:\windows\system32\libukifu.dll
2010-02-27 05:31 . 2010-02-27 05:31 71168 –sha-w- c:\windows\system32\neverizi.dll
2010-02-28 05:31 . 2010-02-28 05:31 99328 –sha-w- c:\windows\system32\pimihiva.dll
2010-02-27 05:31 . 2010-02-27 05:31 71168 –sha-w- c:\windows\system32\tarowata.dll
2010-02-27 17:31 . 2010-02-27 17:31 100352 –sha-w- c:\windows\system32\vajarusu.dll
2010-02-26 17:31 . 2010-02-26 17:31 100352 –sha-w- c:\windows\system32\vakuhule.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HelpCenter4.1"=c:\program files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe /P HelpCenter4.1
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\AOL\\1140953207\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1140953207\\ee\\aim6.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"d:\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\ezSP_Px.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/6/2008 9:18 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/6/2008 9:18 PM 20560]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 P1120VID;Creative WebCam NX Ultra;c:\windows\system32\drivers\P1120Vid.sys [4/25/2004 4:46 PM 759050]
.
Contents of the 'Scheduled Tasks' folder

2010-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 20:57]

2010-05-31 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
FF - ProfilePath - c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?.home=ytff
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - component: c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Desktop\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{805238C5-D485-42F9-94E2-D7F7523DABD6} - (no file)
HKLM-Run-lahohudan - c:\windows\system32\vodawoja.dll
SharedTaskScheduler-{92a271f5-f206-4c8f-b7f3-1edb2670980f} - c:\windows\system32\vodawoja.dll
SSODL-tujoninuy-{92a271f5-f206-4c8f-b7f3-1edb2670980f} - c:\windows\system32\vodawoja.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-31 14:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\windows\system32\muweb.dll 215920 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3828)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
c:\program files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
c:\windows\wanmpsvc.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2010-05-31 14:34:29 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-31 19:34

Pre-Run: 1,367,515,136 bytes free
Post-Run: 2,127,396,864 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - ADFE1CC77E7C793C86C21C8337DD289D
Post #4
Hello,

ComboFix Script
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::
File::
c:\windows\system32\kukamibi.dll
c:\windows\system32\libukifu.dll
c:\windows\system32\neverizi.dll
c:\windows\system32\pimihiva.dll
c:\windows\system32\tarowata.dll
c:\windows\system32\vajarusu.dll
c:\windows\system32\vakuhule.dll

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



NEXT:



Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]


NEXT:



OTL Custom Scan

We need to run an OTL Custom Scan
  • Please reopen [external image: Posted Image] on your desktop.
  • Copy and Paste the following bolded text into the [external image: Posted Image] textbox.


    netsvcs
    %SYSTEMDRIVE%\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /180

  • Push [external image: Posted Image]
  • A report will open. Copy and Paste that report in your next reply.



NEXT:


Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that was produced after running the ComboFix scan.
3. The log that was produced after running the MalwareBytes' Anti-Malware scan.
4. The log that was produced after running the ESET Online Virus Scanner.
5. The log that was produced after running the OTL scan.
6. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Cheers,
SweetTech.
Post #5
I have done everything up to the "OTL" scan part. I have a problem as I do not have the OTL icon on mmy desktop and do not see a link to download it. so I am at a stop. Can you send this download to me or tell me how to find it? Thanks!
Post #6
Whoops.. Sorry about that.

Use this instructions below:

We need to create a New FULL OTL Report
  • Please download OTL from here if you have not done so already:
    • Main Mirror
  • Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "SafeList"
  • Push the [external image: Posted Image] button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <– Will be opened
    • Extra.txt <– Will be minimized
Post #7
Thank you for the link to the OTL desktop icon.

To keep things in order, this email will follow the your instructions you emailed me yesterday by addressing each thing in order as requested and include todays OTL two logs.

1. Question I have for you first concerns the OTL part which I will address below when I get to it in #5 of this reply section. Secondly, just curiously wondering how things are progressing and assume you will let me know when we are complete. You have been so helpful and I sincerely appreciate all your help. Thirdly, I am running Windows XP and may have posted incorrectly on the What The Tech board originally - I am hoping you are aware of this and all we've done is for the Windows XP verison.


2. ComboFix scan logs - see below:
ComboFix 10-05-31.02 - Desktop 05/31/2010 18:37:35.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.221 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Desktop\Desktop\cfscript.txt
AV: avast! antivirus 4.8.1368 [VPS 100531-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\system32\kukamibi.dll"
"c:\windows\system32\libukifu.dll"
"c:\windows\system32\neverizi.dll"
"c:\windows\system32\pimihiva.dll"
"c:\windows\system32\tarowata.dll"
"c:\windows\system32\vajarusu.dll"
"c:\windows\system32\vakuhule.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\kukamibi.dll
c:\windows\system32\libukifu.dll
c:\windows\system32\neverizi.dll
c:\windows\system32\pimihiva.dll
c:\windows\system32\tarowata.dll
c:\windows\system32\vajarusu.dll
c:\windows\system32\vakuhule.dll

.
((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-31 )))))))))))))))))))))))))))))))
.

2010-05-31 19:24 . 2009-08-07 00:23 215920 —-a-w- c:\windows\system32\muweb.dll
2010-05-29 21:19 . 2010-05-29 21:19 ——– dc—-w- C:\New Folder
2010-05-29 21:18 . 2010-05-31 16:34 ——– dc—-w- C:\Hijack

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:22 . 2009-10-29 02:56 ——– d—–w- c:\program files\QuickTime
2010-05-18 22:12 . 2009-10-12 14:44 ——– d—–w- c:\program files\VPACS
2010-05-12 16:21 . 2009-10-02 20:35 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-04-24 22:11 . 2010-04-24 22:11 ——– d—–w- c:\documents and settings\Desktop\Application Data\TuneUp Software
2010-04-24 22:10 . 2010-04-24 22:09 ——– dc—-w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-04-24 22:09 . 2010-04-24 22:09 ——– dcsh–w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-24 01:56 . 2007-06-01 22:30 ——– d—–w- c:\documents and settings\Desktop\Application Data\Skype
2010-04-23 21:07 . 2010-03-10 08:51 ——– d—–w- c:\documents and settings\Desktop\Application Data\skypePM
2010-03-26 15:33 . 2010-04-14 03:41 1496064 —-a-w- c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-03-26 15:33 . 2010-04-14 03:41 43008 —-a-w- c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-03-26 15:33 . 2010-04-14 03:41 339456 —-a-w- c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-03-26 15:32 . 2010-04-14 03:41 346112 —-a-w- c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-03-11 12:38 . 2005-06-18 04:49 832512 —-a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2003-12-02 00:28 17408 —-a-w- c:\windows\system32\corpol.dll
2010-03-10 08:51 . 2010-03-10 08:51 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-03-09 11:09 . 2003-12-02 00:28 430080 —-a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HelpCenter4.1"=c:\program files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe /P HelpCenter4.1
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\AOL\\1140953207\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1140953207\\ee\\aim6.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"d:\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\ezSP_Px.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/6/2008 9:18 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/6/2008 9:18 PM 20560]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 P1120VID;Creative WebCam NX Ultra;c:\windows\system32\drivers\P1120Vid.sys [4/25/2004 4:46 PM 759050]
.
Contents of the 'Scheduled Tasks' folder

2010-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 20:57]

2010-05-31 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
FF - ProfilePath - c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?.home=ytff
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - component: c:\documents and settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Desktop\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-31 18:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\windows\TEMP\TMP0000002DAEB06EB4B6EAA0FF 524288 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1324)
c:\windows\system32\msacm32.drv

- - - - - - - > 'explorer.exe'(756)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
c:\program files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
c:\windows\wanmpsvc.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-05-31 18:54:28 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-31 23:54
ComboFix2.txt 2010-05-31 19:34

Pre-Run: 2,084,339,712 bytes free
Post-Run: 2,098,941,952 bytes free

- - End Of File - - 6638B806DC989E83F84BF67F60FEE99C


3. MalwareBytes' Anti-Malware scan log

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4159

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

5/31/2010 7:12:28 PM
mbam-log-2010-05-31 (19-12-28).txt

Scan type: Quick scan
Objects scanned: 121280
Time elapsed: 6 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 31
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3popularscreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\cpnprt2.cid (Trojan.Agent) -> Quarantined and deleted successfully.


4. ESET Online Virus Scanner log:

C:\Program Files\MSN Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL.vir a variant of Win32/Toolbar.MyWebSearch.A application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL.vir Win32/Toolbar.MyWebSearch.D application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE.vir Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095249.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095250.DLL a variant of Win32/Toolbar.MyWebSearch.A application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095251.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095252.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095253.DLL Win32/Toolbar.MyWebSearch.D application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095254.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095255.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095257.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{45892D38-A0BF-43F9-8C9F-96715222A8FE}\RP1689\A0095261.EXE Win32/Toolbar.MyWebSearch application

5. OTL Custom Scan RAN TODAY following your last email instructions - Note - I "did not" follow the instructions that you gave me in your yesterday email when I did not have availability to the desktop OTL icon. I just thought best to follow your last instructions over yesterday's instructions - Please let me know if I did this correctly.

Todays OTL Custom Scan Log:

OTL logfile created on: 6/1/2010 5:49:43 PM - Run 2
OTL by OldTimer - Version 3.2.5.2 Folder = C:\Documents and Settings\Desktop\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 197.00 Mb Available Physical Memory | 39.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 55.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 13.97 Gb Total Space | 1.76 Gb Free Space | 12.61% Space Free | Partition Type: NTFS
Drive D: | 129.07 Gb Total Space | 127.56 Gb Free Space | 98.83% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 950.94 Mb Total Space | 318.84 Mb Free Space | 33.53% Space Free | Partition Type: FAT
I: Drive not present or media not loaded
Drive K: | 232.88 Gb Total Space | 224.32 Gb Free Space | 96.32% Space Free | Partition Type: NTFS

Computer Name: VALUED-B4B48255
Current User Name: Desktop
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/01 17:46:10 | 000,571,392 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Desktop\Desktop\OTL.exe
PRC - [2009/11/24 18:51:40 | 000,081,000 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009/11/24 18:51:35 | 000,138,680 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009/11/24 18:51:21 | 000,254,040 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009/11/24 18:48:48 | 000,352,920 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009/11/24 18:43:56 | 000,018,752 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/08/30 18:43:18 | 004,670,704 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2004/04/21 12:16:02 | 001,434,848 | —- | M] (America Online, Inc.) – C:\Program Files\Common Files\AOL\ACS\acsd.exe
PRC - [2003/10/21 00:00:40 | 000,712,704 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
PRC - [2003/10/21 00:00:38 | 000,057,344 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
PRC - [2003/10/21 00:00:14 | 000,925,696 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
PRC - [2003/10/21 00:00:08 | 000,503,897 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
PRC - [2003/08/27 10:27:44 | 000,065,536 | —- | M] (America Online, Inc.) – C:\WINDOWS\wanmpsvc.exe


========== Modules (SafeList) ==========

MOD - [2010/06/01 17:46:10 | 000,571,392 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Desktop\Desktop\OTL.exe
MOD - [2008/04/13 19:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx
MOD - [2007/08/30 18:43:14 | 000,006,144 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Messenger\idle.dll
MOD - [2007/08/30 17:17:38 | 000,348,160 | —- | M] (Microsoft Corporation) – C:\Program Files\Yahoo!\Messenger\msvcr71.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/11/24 18:51:35 | 000,138,680 | —- | M] (ALWIL Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast4\ashServ.exe – (avast! Antivirus)
SRV - [2009/11/24 18:51:21 | 000,254,040 | —- | M] (ALWIL Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe – (avast! Mail Scanner)
SRV - [2009/11/24 18:48:48 | 000,352,920 | —- | M] (ALWIL Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe – (avast! Web Scanner)
SRV - [2009/11/24 18:43:56 | 000,018,752 | —- | M] (ALWIL Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe – (aswUpdSv)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2004/04/21 12:16:02 | 001,434,848 | —- | M] (America Online, Inc.) [Auto | Running] – C:\Program Files\Common Files\AOL\ACS\acsd.exe – (AOL ACS)
SRV - [2003/10/21 00:00:56 | 001,286,144 | —- | M] (Sony Corporation) [Auto | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe – (VAIOMediaPlatform-VideoServer-AppServer)
SRV - [2003/10/21 00:00:40 | 000,712,704 | —- | M] (Sony Corporation) [Auto | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-VideoServer-UPnP) VAIO Media Video Server (UPnP)
SRV - [2003/10/21 00:00:40 | 000,712,704 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-PhotoServer-UPnP) VAIO Media Photo Server (UPnP)
SRV - [2003/10/21 00:00:40 | 000,712,704 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-MusicServer-UPnP) VAIO Media Music Server (UPnP)
SRV - [2003/10/21 00:00:38 | 000,057,344 | —- | M] (Sony Corporation) [Auto | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-VideoServer-HTTP) VAIO Media Video Server (HTTP)
SRV - [2003/10/21 00:00:38 | 000,057,344 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-PhotoServer-HTTP) VAIO Media Photo Server (HTTP)
SRV - [2003/10/21 00:00:38 | 000,057,344 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-MusicServer-HTTP) VAIO Media Music Server (HTTP)
SRV - [2003/10/21 00:00:14 | 000,925,696 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe – (VAIOMediaPlatform-PhotoServer-AppServer)
SRV - [2003/10/21 00:00:08 | 000,503,897 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe – (VAIOMediaPlatform-MusicServer-AppServer)
SRV - [2003/08/27 10:27:44 | 000,065,536 | —- | M] (America Online, Inc.) [Auto | Running] – C:\WINDOWS\wanmpsvc.exe – (WANMiniportService) WAN Miniport (ATW)
SRV - [2003/07/28 20:31:14 | 000,065,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe – (SPTISRV)


========== Driver Services (SafeList) ==========

DRV - [2009/11/24 18:50:59 | 000,094,160 | —- | M] (ALWIL Software) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\aswmon2.sys – (aswMon2)
DRV - [2009/11/24 18:50:12 | 000,114,768 | —- | M] (ALWIL Software) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\aswSP.sys – (aswSP)
DRV - [2009/11/24 18:50:00 | 000,020,560 | —- | M] (ALWIL Software) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2009/11/24 18:49:07 | 000,048,560 | —- | M] (ALWIL Software) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\aswTdi.sys – (aswTdi)
DRV - [2009/11/24 18:48:57 | 000,023,120 | —- | M] (ALWIL Software) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\aswRdr.sys – (aswRdr)
DRV - [2009/11/24 18:47:54 | 000,027,408 | —- | M] (ALWIL Software) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\aavmker4.sys – (Aavmker4)
DRV - [2008/07/28 17:26:30 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2008/07/28 17:26:30 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2005/10/23 14:10:27 | 000,028,352 | —- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\MxlW2k.sys – (MxlW2k)
DRV - [2004/11/22 17:36:39 | 000,018,003 | —- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MRENDIS5.sys – (MRENDIS5)
DRV - [2004/11/22 17:36:34 | 000,019,345 | —- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MREMPR5.sys – (MREMPR5)
DRV - [2003/11/16 00:40:34 | 000,621,056 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2003/10/30 14:20:54 | 000,766,848 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\smrt.sys – (smrt)
DRV - [2003/10/28 01:00:00 | 000,016,890 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctpdusb2.sys – (Jukebox)
DRV - [2003/09/19 01:34:06 | 000,759,050 | R— | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\P1120Vid.sys – (P1120VID)
DRV - [2003/08/18 20:56:00 | 001,343,803 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2003/05/23 13:44:00 | 001,171,648 | —- | M] (Agere Systems) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2003/01/10 17:13:04 | 000,033,588 | —- | M] (America Online, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\wanatw4.sys – (wanatw) WAN Miniport (ATW)
DRV - [2001/08/17 07:11:06 | 000,066,591 | —- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\el90xbc5.sys – (EL90XBC)
DRV - [2000/12/05 19:18:02 | 000,003,952 | R— | M] (Sony Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\DMICall.sys – (DMICall)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sony.com/vaiopeople
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sony.com/vaiopeople
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?.home=ytff"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.%(version)s
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p="

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/31 14:15:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/07 22:30:22 | 000,000,000 | —D | M]

[2009/10/28 21:44:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Desktop\Application Data\Mozilla\Extensions
[2009/10/28 21:44:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Desktop\Application Data\Mozilla\Extensions\[removed]
[2010/05/31 21:36:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions
[2010/04/13 22:41:13 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/05/22 21:53:12 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2007/09/18 07:50:27 | 000,000,000 | —D | M] (Yahoo! Photos Easy Upload Tool) – C:\Documents and Settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\extensions\{DD99D76F-5129-4fd3-A2DC-AB41D6FBCF98}
[2008/12/12 13:23:54 | 000,002,158 | —- | M] () – C:\Documents and Settings\Desktop\Application Data\Mozilla\Firefox\Profiles\xvyhvjjx.default\searchplugins\MySpace.xml
[2010/05/31 21:36:23 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2004/11/12 22:36:20 | 000,005,120 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Mozilla Firefox\plugins\NPAdbESD.dll

O1 HOSTS File: ([2010/05/31 18:45:07 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\..\Toolbar\WebBrowser: (Yahoo! ¤u¨ã¦C) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn5\yt.dll File not found
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/0/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\VAIO BrightColor Wallpaper TrueColor 1280x1024.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\VAIO BrightColor Wallpaper TrueColor 1280x1024.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/01 17:46:07 | 000,571,392 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Desktop\Desktop\OTL.exe
[2010/06/01 11:59:03 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/06/01 03:00:30 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/05/31 19:20:01 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/05/31 19:04:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Desktop\Application Data\Malwarebytes
[2010/05/31 19:04:35 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/05/31 19:04:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/05/31 19:04:33 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/05/31 19:04:33 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/31 19:03:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/31 14:09:22 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/05/31 14:06:10 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/05/31 14:06:10 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/05/31 14:06:10 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/05/31 14:06:10 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/05/31 14:06:02 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/05/31 13:58:02 | 000,000,000 | —D | C] – C:\Qoobox
[2010/05/29 16:19:38 | 000,000,000 | —D | C] – C:\New Folder
[2010/05/29 16:18:53 | 000,000,000 | —D | C] – C:\Hijack
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/01 17:46:10 | 000,571,392 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Desktop\Desktop\OTL.exe
[2010/06/01 10:18:23 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/06/01 10:18:23 | 000,001,409 | —- | M] () – C:\WINDOWS\QTFont.for
[2010/06/01 02:27:12 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/05/31 19:15:51 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/05/31 19:14:58 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/05/31 19:14:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/05/31 19:13:32 | 006,291,456 | —- | M] () – C:\Documents and Settings\Desktop\ntuser.dat
[2010/05/31 19:13:32 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Desktop\ntuser.ini
[2010/05/31 19:04:37 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/31 18:45:24 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/05/31 18:45:07 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/31 18:34:27 | 003,701,914 | R— | M] () – C:\Documents and Settings\Desktop\Desktop\ComboFix.exe
[2010/05/31 14:09:28 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/05/31 11:01:11 | 000,359,929 | —- | M] () – C:\Documents and Settings\Desktop\Desktop\dds.scr
[2010/05/29 16:19:44 | 000,001,354 | —- | M] () – C:\Documents and Settings\Desktop\Desktop\HijackThis.lnk
[2010/05/29 11:10:42 | 000,006,456 | -H– | M] () – C:\WINDOWS\System32\ninesige
[2010/05/28 07:34:05 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/26 16:33:59 | 000,004,696 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/26 16:33:57 | 000,357,160 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/05/26 16:33:57 | 000,312,946 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/05/26 16:33:57 | 000,040,664 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/05/14 17:35:49 | 000,035,226 | —- | M] () – C:\brent.jpg
[2010/05/14 17:32:32 | 000,011,601 | —- | M] () – C:\carolyn.jpg
[2010/05/12 11:21:16 | 000,221,568 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/05/08 14:13:33 | 000,063,221 | —- | M] () – C:\Documents and Settings\Desktop\Desktop\Em New years.jpg
[2010/05/08 14:05:41 | 000,059,850 | —- | M] () – C:\Documents and Settings\Desktop\Desktop\Emily Cinco de Mayo.jpg
[2010/05/08 14:04:40 | 000,059,850 | —- | M] () – C:\Documents and Settings\Desktop\Desktop\2010 05 Em.jpg
[2010/05/03 18:58:33 | 000,031,744 | —- | M] () – C:\Fasweet receipt.doc
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/01 10:18:23 | 000,054,156 | -H– | C] () – C:\WINDOWS\QTFont.qfn
[2010/06/01 10:18:23 | 000,001,409 | —- | C] () – C:\WINDOWS\QTFont.for
[2010/05/31 19:04:37 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/31 14:09:28 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/05/31 14:09:24 | 000,260,272 | —- | C] () – C:\cmldr
[2010/05/31 14:06:10 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/05/31 14:06:10 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/05/31 14:06:10 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/05/31 14:06:10 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/05/31 14:06:10 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/05/31 14:05:27 | 003,701,914 | R— | C] () – C:\Documents and Settings\Desktop\Desktop\ComboFix.exe
[2010/05/31 11:01:10 | 000,359,929 | —- | C] () – C:\Documents and Settings\Desktop\Desktop\dds.scr
[2010/05/29 16:18:58 | 000,001,354 | —- | C] () – C:\Documents and Settings\Desktop\Desktop\HijackThis.lnk
[2010/05/14 17:35:49 | 000,035,226 | —- | C] () – C:\brent.jpg
[2010/05/14 17:32:29 | 000,011,601 | —- | C] () – C:\carolyn.jpg
[2010/05/08 14:13:33 | 000,063,221 | —- | C] () – C:\Documents and Settings\Desktop\Desktop\Em New years.jpg
[2010/05/08 14:05:41 | 000,059,850 | —- | C] () – C:\Documents and Settings\Desktop\Desktop\Emily Cinco de Mayo.jpg
[2010/05/08 14:04:35 | 000,059,850 | —- | C] () – C:\Documents and Settings\Desktop\Desktop\2010 05 Em.jpg
[2010/05/03 18:58:32 | 000,031,744 | —- | C] () – C:\Fasweet receipt.doc
[2007/02/03 14:01:45 | 000,006,048 | —- | C] () – C:\WINDOWS\System32\MCC16.dll
[2006/12/31 18:33:53 | 000,000,029 | —- | C] () – C:\WINDOWS\MORTGAGE.INI
[2006/02/20 10:02:04 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/01/31 13:06:53 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/01/31 12:07:33 | 000,000,028 | —- | C] () – C:\WINDOWS\atid.ini
[2006/01/31 09:35:32 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\BJAXSecurityManager.dll
[2006/01/31 09:35:09 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\BJInstaller.dll
[2005/11/28 17:55:20 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXPRMON.DLL
[2005/11/28 17:55:20 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXPMONUI.DLL
[2005/11/28 17:50:24 | 000,000,623 | —- | C] () – C:\WINDOWS\lexstat.ini
[2005/11/28 17:50:00 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbvvs.dll
[2005/11/28 17:49:43 | 000,000,187 | —- | C] () – C:\WINDOWS\System32\lxbvcoin.ini
[2005/05/15 18:39:27 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PdeSrv2p.dll
[2004/12/25 19:56:21 | 000,010,937 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/09/26 20:26:48 | 000,000,045 | —- | C] () – C:\WINDOWS\JGDIFGIM.ini
[2004/07/10 19:55:38 | 000,252,416 | —- | C] () – C:\WINDOWS\System32\wsiShared.dll
[2004/06/05 22:00:48 | 000,000,049 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/01 22:50:46 | 000,001,295 | —- | C] () – C:\WINDOWS\System32\Px.ini
[2004/03/01 22:50:14 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/12/02 15:44:25 | 000,000,890 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/12/02 15:41:26 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\Cpuinf32.dll
[2003/12/02 15:40:09 | 000,262,416 | —- | C] () – C:\WINDOWS\System32\ASFV2.DLL
[2003/12/02 15:39:35 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\TDI-SonyOMG.dll
[2003/12/02 15:01:22 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/12/01 20:53:24 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/12/01 20:39:54 | 000,000,800 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/12/01 19:28:56 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2003/12/01 19:28:51 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\e1000msg.dll
[2003/12/01 19:28:51 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2003/12/01 19:28:41 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\cbldrm.dll
[2003/12/01 19:28:40 | 000,000,730 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/01/07 18:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/06/12 15:21:12 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\winchip.dll
[1999/01/22 16:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
< End of report >


OTL EXTRAS.TXT log (should you need it as well) ran TODAY:
OTL Extras logfile created on: 6/1/2010 5:49:43 PM - Run 2
OTL by OldTimer - Version 3.2.5.2 Folder = C:\Documents and Settings\Desktop\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 197.00 Mb Available Physical Memory | 39.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 55.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 13.97 Gb Total Space | 1.76 Gb Free Space | 12.61% Space Free | Partition Type: NTFS
Drive D: | 129.07 Gb Total Space | 127.56 Gb Free Space | 98.83% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 950.94 Mb Total Space | 318.84 Mb Free Space | 33.53% Space Free | Partition Type: FAT
I: Drive not present or media not loaded
Drive K: | 232.88 Gb Total Space | 224.32 Gb Free Space | 96.32% Space Free | Partition Type: NTFS

Computer Name: VALUED-B4B48255
Current User Name: Desktop
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


Please let me know what else is needed from me or what I should do and again, my sincere thanks!
Post #8
Hello,

just curiously wondering how things are progressing and assume you will let me know when we are complete.

Yes, I will. Your logs are looking pretty clean. We just have some housekeeping issues to address now.

Thirdly, I am running Windows XP and may have posted incorrectly on the What The Tech board originally - I am hoping you are aware of this and all we've done is for the Windows XP verison.

Yes, I am aware of this. :)


OTL Fix

We need to run an OTL Fix
  • Please reopen [external image: Posted Image] on your desktop.
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    :Services
:OTL
O3 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\..\Toolbar\WebBrowser: (Yahoo! ¤u¨ã¦C) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn5\yt.dll File not found
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3583673377-919658688-3763203678-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
[2010/05/29 11:10:42 | 000,006,456 | -H– | M] () – C:\WINDOWS\System32\ninesige
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]
  • Push [external image: Posted Image]
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click [external image: Posted Image].
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:


Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "JDK 6 Update 20 (JDK or JRE)".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
– Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
– Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note:
The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.
To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.


NEXT



Clean Java Cache & Temporary Files
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Post #9
I have complete all your steps below from this evening's email ending last with the security checkup - To follow is the log that resulted from it:

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Antivirus
ESET Online Scanner v3
avast! successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner (remove only)
TweakNow RegCleaner Standard
Java™ 6 Update 20
Adobe Flash Player 10.0.22.87
Adobe Reader 7.0.9
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Alwil Software Avast4 aswUpdSv.exe
Alwil Software Avast4 ashServ.exe
Alwil Software Avast4 ashDisp.exe
Alwil Software Avast4 ashMaiSv.exe
Alwil Software Avast4 ashWebSv.exe
Windows Defender MsMpEng.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````


I assume you wanted a copy of this log to view - what should I do next?

Thanks!
Post #10
Hello,

If you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.


NEXT:


Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.


NEXT:



Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall



NEXT:



OTL Clean-Up
Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.



NEXT:



All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.
  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE
  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
    • If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
      • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.
Post #11
Well first of all thank you for all your help and sticking with me that past few days working on my computer's virus problem. I have gone through your last steps and unfortunately, today was a difficult one for me. I have several things I need to address which may be something or may not or I need your guidance to be assured I do what is needed and done correctly. I will address them below in order to your last email: 1. Adobe Reader - Used the link you provided and all went well with the download - Except….It gave me a message that said "Hard drive is fragmented, this application may not be able to launch as quickly as possible. To optimize performance, please defrag your hard drive and then repair this application under add or remove programs in Control Panel." I am not sure what action to take or if this is something I need to be concern with - Please let me know. 2. ComboFix/Uninstall - Went great - No problems. 3. OTL Clean-Up - Went great - No problems - Have a question though which is "Do I need to now delete the OTL Icon from my Desktop"? I wasn't sure if that was considered a tool. 4. Deletion of Logs & Tools on my desktop - I deleted all the logs saved on my desktop over the last few days but do not know if I should also delete the icon for "Malwarebytes" that I still have on my desktop. I wasn't sure if that was also considered a tool. 5. Password Changes - I've yet to do this as I need to give it some thought but will over the weekend - Is this going to cause a problem now with me doing so at a later date? Do I need to change all passwords I have where ever they may be? 6. Windows Update - All went well - No problems. 7. SpywareBlaster - I tried to download from the link you gave me the "free" version their site offered but it kept kept taking me to a web page that talked you shouldn't pay but we appreciate a donation…push button to "Donate/PayPal". I didn't know what to do at this point so I did nothing and therefore, SpywareBlaster is not downloaded on my computer at this time. 8. SpywareGuard - Same thing as #7 above - I tried to download from the link you gave me the "free" version their site offered but it kept kept taking me to a web page that talked you shouldn't pay but we appreciate a donation…push button to "Donate/PayPal". I didn't know what to do at this point so I did nothing and therefore, SpywareGuard is not downloaded on my computer at this time. 9. Make Internet Explorer More Secure - All went well - No problems. 10. ATF Cleaner - All went well - No problems. 11. MVPS Hosts File - Ok this is where I proved to myself I am nowhere as computer literate as I was beginning to think I am! I followed the link you provided and read through the webpage it provided and totally did not understand what I was suppose to do - it was WAYYYYYYY over my head so I have done nothing with MVPS Hosts File on my computer. Is this something you could provide me in the great simple language you are so good at to me? Curious…Is this going to be a paid site also? 12. WOT - All went well - No problems. 13. NoScript - Couldn't get your link to work/connect to a webpage - Therefore, nothing has been done with NoScript on my computer at this time. I just went to next step in your email when I couldn't get the link to work for me. 14. Keep a backup of your important files - I used your link and connected to this webpage and read through it. I have an "external hard drive" already that I could use to store my backup - It's my Drive "K" I believe. I didn't see on this webpage anything in regards as to "how" to do the backup and I don't know how. I am ashamed to say a backup is something I have never done - well not since way back when I had those 3 inches hard disks a "very" long time ago. Can you assist me with some of your simple language instructions" on how I can do this? I have many digital pictures and music downloads that I need to backup and see the importance in doing so. Any help with this would be greatly appreciated with this area. 15. Erunt - I downloaded from your link Erunt. I was doing well and then got to the end and it tells me more less to go any further I needed to purchase their software programs "Registry Booster" for a discount price of $29.95 and they would throw in for "free" their software "Tweaker". At that point, I stopped . I went into my Control Panel and removed what had been downloaded from their website and then rebooted my system to be sure they were totally deleted. I have not purchased anything or done any thing further with this program. Is this something I should purchase or did I miss something that they offer "free" on their website? Please guide me as to the what to do from here with Erunt. 16. Think Provention - Went well - No problems - Good reading! 17. PC Safety and Security - What do I need? - Downloaded your link for this website. All went well with that but am wondering if I "need to register for an account" which it offers? I wasn't sure if this something I was suppose to do? WIth all the above said, which I bet you werent' expecting - rather expecting to close out my account. I would appreciate you rhelp with the above. Look forward to hearing you and thank you again.
Post #12
Hello,

1. I don't think it could hurt to do a defrag of your hard drive.

You could download a program called JkDefrag which seems to run autmatically once you double click on the JkDefrag.exe file.

Please download JkDefrag by Jeroen Kessels
  • Unzip the program to a folder.
  • Reboot to release most of the files in use.
  • Double Click JkDefrag.exe to run the program.
Note: Everything is done automatically the moment you run JkDefrag.exe

3. You can go ahead and delete the OTL icon.

4. I suggest you keep MalwareBytes' Anti-Malware on your computer and run an updated scan with it at least once a week.

5. If you've used this computer for checking banking information or other sensitive data like it then I'd change the passwords for those sites now. You don't need to change every single one of them, but I suggest you change them for banking sites, and other sites like it.

7. You can use this link here: http://filehippo.com/download_spywareblaster/ to download SpywareBlaster. It shouldn't give you any problems. I should also mention that this is a freeware program. It does allow users to donate and the links for it are sorta hidden in a way. Same goes for the program below.

8. Here is a direct link for SpywareGuard. Link: http://www.javacoolsoftware.net.nyud.net/d…eguardsetup.exe

11. Here is a direct link to download MVPS Hosts File: http://mvps.org/winhelp2002/hosts.zip
Once downloaded you will need to extract (unzip) the file by right clicking on it and selecting Unzip (or extract).
Locate and double click on a file named MVPS.bat
This should install the MVPS Host File on your computer.

If those instructions don't work let me know and I'll whip something else up.

14. See if this Microsoft Link for backing up files is of any help. Link: http://www.microsoft.com/windowsxp/using/s…t_03july14.mspx

15. Here is a direct link for ERUNT: http://www.aumha.org/downloads/erunt-setup.exe You shouldn't have to pay for it. It's a freeware program.

17. It was just something for you to read. No need to register for an account or download anything from there.
Post #13
Just thought I would update you this morning & let you know the only thing I got done last night was to run your #1 on your last email which was scanning my computer. This scanning process took from 7:30 p.m. to 12:00 a.m. - then it was time for bed for me since I had to be at work early this morning. I will complete your other steps in your last email this evening. Thank you and I hope you have a wonderful day!
Post #15
Good afternoon! I have successfully completed the remaining steps you sent me in your email before last posting with the exception of #14 - doing the backup on my computer.

I click on the link http://www.microsoft.com/windowsxp/using/s…t_03july14.mspx you had provided. In literally 2 seconds I got a full "blank" screen that only showed "done" at the very bottom left-and then it does nothing else. I went back to my desktop to see if possibly during this process, it may have downloaded an icon I needed to click on to run this backup program from this link but there was nothing there. Am I missing a step or something? I don't think this worked for me.

To be on the safe side, I located my digital pictures/pictures/music and copied & pasted them to my "K" external drive so they are somewhat backed up. I just don't know about all my programs and whatever else a backup is suppose to cover during its process.

To update you on how my computer is running, it seems to be doing good, moving at a decent speed, nothing I can detect as a problem. Will we run some type of final check run after my backup is completed successfully that prints out a log file for you to review to be sure my computer is where it needs to be and virus free before we close me out?

Again, I never can say thank you enough and how much I sincerely appreciate you. You are one smart guy! and it's been a pleasure working with you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI