Spyware / Malware / Virus Removal

[Resolved] PC infected w/ possible antispyware soft virus, also z0g7ya

15 min read

Looking for the outcome? Ask AI

Troyr30 Topic Starter

Post #1June 2, 2010, 11:28 AM UTC last edited June 2, 2010, 11:29 AM UTC

I am using webroot antispy anti malware and it is finding different things but still they will not go away. Another user wrote they had the same thing. Ok, the issues i starting having were, when ever i google something , i get re-directed, i have gotten hit with several viruses which my webroot let me know abbout that the viruses are Z0G7YA1I0.com MAL/ZBOT B MAL/QBOT B various advertiseing cookies ive tried getting rid of this stuff via webroot anti virus, malwarebytes, registry mechanic , AVG, in regular mode and safe mode, im still getting the redirects with google, im still getting prompted by webroot antivirus, it just happened again as im writeing it says: THE PROGRAM HAS BLOCKED ACCESS TO A POTENTIALLY THREATENING WEB SITE. THE INTERNET COMMUNICATION SHEILD HAS BLOCKED ACCESS TO Z0G7YA1I0.com this site is on a list of known to be related to spyware. The only way I can seem to get away from the redirects is in safe mode. I have already run DDS, here is what it says: DDS (Ver_09-06-26.01) - NTFSx86 NETWORK Run by [removed] at 7:22:21.47 on Wed 06/02/2010 Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_18 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1918.1380 [GMT -4:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Troy\Downloads\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l;=0409&s;=1&o;=vb32&d;=0309&m;=et1161-05 mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l;=0409&s;=1&o;=vb32&d;=0309&m;=et1161-05 mDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l;=0409&s;=1&o;=vb32&d;=0309&m;=et1161-05 uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = uURLSearchHooks: H - No File BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll mRun: [RtHDVCpl] "RtHDVCpl.exe" mRun: [eRecoveryService] mRun: [Fellowes Proxy] "c:\windows\system32\r3proxy.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [SpySweeper] c:\program files\webroot\webrootsecurity\SpySweeperUI.exe /startintray mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab ================= FIREFOX =================== FF - ProfilePath - c:\users\troy\appdata\roaming\mozilla\firefox\profiles\j3ganupr.default\ FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - component: c:\users\troy\appdata\roaming\mozilla\firefox\profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\users\troy\appdata\roaming\mozilla\firefox\profiles\j3ganupr.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808] R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-7-11 1201640] R3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\drivers\FeMouWDM.sys [2009-7-12 12672] S2 ETService;Empowering Technology Service;c:\program files\emachines\emachines recovery management\service\ETService.exe [2009-3-22 24576] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-4 135664] S2 SessionLauncher;SessionLauncher;c:\users\troy\appdata\local\temp\dx9\sessionlauncher.exe –> c:\users\troy\appdata\local\temp\dx9\SessionLauncher.exe [?] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] =============== Created Last 30 ================ 2010-05-25 21:30 2,048 a——- c:\windows\system32\tzres.dll 2010-05-21 14:19 –d—– c:\programdata\BlitPop 2010-05-21 14:19 –d—– c:\progra~2\BlitPop 2010-05-20 11:43 –d—– c:\users\troy\appdata\roaming\Namco 2010-05-20 11:43 –d—– c:\programdata\PlayFirst 2010-05-20 11:41 –d—– c:\program files\Games 2010-05-18 17:27 –d—– c:\users\troy\appdata\roaming\HillStoneAnimationStudios_MBV 2010-05-18 17:26 4,096 a——- c:\windows\d3dx.dat 2010-05-18 10:29 –d—– c:\users\troy\appdata\roaming\Boolat Games 2010-05-17 19:29 –d—– c:\users\troy\appdata\roaming\Gogii 2010-05-16 10:12 –d—– c:\programdata\Intenium 2010-05-16 10:12 –d—– c:\progra~2\Intenium 2010-05-15 15:22 –d—– c:\users\troy\appdata\roaming\VendelGAMES 2010-05-12 23:04 –d—– c:\users\troy\appdata\roaming\Top Evidence 2010-05-12 23:04 –d—– c:\programdata\Top Evidence 2010-05-12 23:04 –d—– c:\progra~2\Top Evidence 2010-05-12 00:11 738,816 a——- c:\windows\system32\inetcomm.dll 2010-05-10 20:50 –d—– c:\program files\common files\DivX Shared 2010-05-10 20:47 –d—– c:\program files\DivX 2010-05-10 20:46 –d—– c:\programdata\DivX 2010-05-10 20:46 –d—– c:\progra~2\DivX 2010-05-03 22:08 –d—– c:\program files\softendo.com ==================== Find3M ==================== 2010-06-02 06:45 34,800 a——- c:\programdata\nvModes.dat 2010-06-02 06:45 34,800 a——- c:\progra~2\nvModes.dat 2010-03-08 13:59 94,208 a——- c:\windows\system32\dpl100.dll 2010-03-05 10:01 420,352 a——- c:\windows\system32\vbscript.dll 2010-01-16 08:42 143,360 a——- c:\windows\inf\infstrng.dat 2010-01-16 08:42 51,200 a——- c:\windows\inf\infpub.dat 2010-01-16 08:42 86,016 a——- c:\windows\inf\infstor.dat 2009-11-05 00:06 665,600 a——- c:\windows\inf\drvindex.dat 2009-09-22 17:50 37 a——- c:\users\troy\jagex_runescape_preferences.dat 2009-09-22 17:31 45 a——- c:\users\troy\jagex_runescape_preferences2.dat 2008-01-20 22:57 174 a–sh— c:\program files\desktop.ini 2006-11-02 08:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 08:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 08:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 08:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2009-10-31 03:00 245,760 a–sh— c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-10-15 18:40 245,760 a–sh— c:\windows\system32\%appdata%\microsoft\windows\ietldcache\index.dat ============= FINISH: 7:22:40.95 =============== Please help. Thank you, Troy

SweetTech

Post #2June 2, 2010, 4:50 PM UTC

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 4 days) and you need an explanation. If that's the case, just send me a message to me on here.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Download TDSSKiller and save it to your Desktop.

Extract the file and run it.

If TDSSKiller asks you to close all programs please allow it to do so.

Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)

If TDSSKiller asks to reboot your computer please allow it to do so.

Please post the content of that log TDSSKiller

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that is produced after running TDSSKiller.
3. The log that is produced after running the ComboFix scan.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Troyr30

Post #3June 3, 2010, 1:17 AM UTC

First let me say THANK YOU for your assistance. Here is the information you requested.

20:32:20:779 2860 TDSS rootkit removing tool 2.3.2.0 May 31 2010 10:39:48
20:32:20:779 2860 ================================================================================
20:32:20:779 2860 SystemInfo:

20:32:20:779 2860 OS Version: 6.0.6002 ServicePack: 2.0
20:32:20:779 2860 Product type: Workstation
20:32:20:802 2860 ComputerName: TROY-PC
20:32:20:802 2860 UserName: Troy
20:32:20:803 2860 Windows directory: C:\Windows
20:32:20:803 2860 Processor architecture: Intel x86
20:32:20:803 2860 Number of processors: 1
20:32:20:803 2860 Page size: 0x1000
20:32:20:803 2860 Boot type: Normal boot
20:32:20:803 2860 ================================================================================
20:32:42:944 2860 Initialize success
20:32:42:945 2860
20:32:42:945 2860 Scanning Services …
20:32:45:702 2860 Raw services enum returned 424 services
20:32:45:709 2860
20:32:45:709 2860 Scanning Drivers …
20:33:05:064 2860 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
20:33:06:033 2860 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
20:33:06:680 2860 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
20:33:06:969 2860 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
20:33:07:215 2860 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
20:33:07:787 2860 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
20:33:08:414 2860 AgereSoftModem (7560f465f1ce69c53bf17559ee195548) C:\Windows\system32\DRIVERS\AGRSM.sys
20:33:09:498 2860 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
20:33:09:710 2860 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:33:09:974 2860 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
20:33:10:284 2860 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
20:33:10:546 2860 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
20:33:10:796 2860 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
20:33:10:968 2860 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
20:33:11:067 2860 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
20:33:11:662 2860 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
20:33:11:775 2860 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
20:33:11:936 2860 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
20:33:12:174 2860 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
20:33:12:423 2860 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
20:33:12:501 2860 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
20:33:12:800 2860 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:33:12:938 2860 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:33:13:114 2860 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:33:13:201 2860 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:33:13:289 2860 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:33:13:385 2860 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:33:13:911 2860 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:33:14:135 2860 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
20:33:14:186 2860 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
20:33:14:318 2860 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
20:33:14:385 2860 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
20:33:14:437 2860 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
20:33:14:446 2860 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys
20:33:14:455 2860 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
20:33:14:463 2860 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
20:33:14:511 2860 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
20:33:14:562 2860 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
20:33:14:594 2860 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
20:33:14:619 2860 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
20:33:14:637 2860 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
20:33:14:679 2860 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
20:33:14:944 2860 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
20:33:15:497 2860 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:33:16:093 2860 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
20:33:16:539 2860 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
20:33:17:062 2860 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
20:33:17:732 2860 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
20:33:18:365 2860 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
20:33:18:903 2860 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
20:33:19:436 2860 FeMouWDM (f755065f61393a71cb89b2eb24c8cf00) C:\Windows\system32\DRIVERS\FeMouWDM.sys
20:33:19:879 2860 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
20:33:20:279 2860 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
20:33:20:563 2860 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
20:33:21:082 2860 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
20:33:21:505 2860 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
20:33:21:842 2860 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
20:33:22:294 2860 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:33:22:592 2860 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
20:33:23:265 2860 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:33:23:875 2860 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:33:24:368 2860 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
20:33:24:876 2860 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
20:33:25:538 2860 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
20:33:25:958 2860 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
20:33:26:978 2860 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
20:33:27:519 2860 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
20:33:27:960 2860 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
20:33:28:819 2860 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:33:29:335 2860 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
20:33:29:972 2860 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys
20:33:32:151 2860 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
20:33:32:944 2860 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
20:33:33:045 2860 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:33:33:515 2860 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
20:33:33:741 2860 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
20:33:33:934 2860 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
20:33:33:998 2860 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
20:33:34:071 2860 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
20:33:34:100 2860 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:33:34:114 2860 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:33:34:221 2860 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
20:33:34:279 2860 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
20:33:34:329 2860 klmd23 (67e1faa88fb397b3d56909d7e04f4dd3) C:\Windows\system32\drivers\klmd.sys
20:33:34:507 2860 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
20:33:34:719 2860 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) C:\Windows\system32\DRIVERS\L8042Kbd.sys
20:33:34:879 2860 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
20:33:35:113 2860 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
20:33:35:482 2860 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
20:33:35:912 2860 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
20:33:36:318 2860 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
20:33:36:448 2860 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
20:33:36:534 2860 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
20:33:36:563 2860 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
20:33:36:649 2860 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
20:33:36:704 2860 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
20:33:36:838 2860 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
20:33:36:952 2860 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
20:33:37:002 2860 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
20:33:37:114 2860 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
20:33:37:362 2860 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:33:37:503 2860 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
20:33:37:559 2860 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:33:37:608 2860 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:33:37:628 2860 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:33:37:884 2860 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
20:33:38:016 2860 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
20:33:38:084 2860 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
20:33:38:249 2860 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
20:33:38:365 2860 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
20:33:38:426 2860 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
20:33:38:493 2860 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
20:33:38:556 2860 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
20:33:38:636 2860 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
20:33:38:801 2860 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
20:33:39:141 2860 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
20:33:39:451 2860 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
20:33:39:984 2860 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
20:33:40:150 2860 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
20:33:40:401 2860 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
20:33:40:832 2860 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
20:33:41:125 2860 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
20:33:41:338 2860 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
20:33:41:518 2860 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
20:33:41:694 2860 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:33:41:885 2860 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
20:33:42:343 2860 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
20:33:42:871 2860 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
20:33:44:119 2860 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:33:44:547 2860 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
20:33:45:031 2860 NVENETFD (d958a2b5f6ad5c3b8ccdc4d7da62466c) C:\Windows\system32\DRIVERS\nvmfdx32.sys
20:33:48:117 2860 nvlddmkm (8b75f652726a2ba3197860f300514e3f) C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:33:51:461 2860 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
20:33:51:579 2860 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
20:33:51:806 2860 nvstor32 (fa7b8eca6e845b244b7e30a9dcd82c6c) C:\Windows\system32\DRIVERS\nvstor32.sys
20:33:51:959 2860 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
20:33:52:066 2860 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
20:33:52:559 2860 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:33:52:984 2860 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
20:33:53:384 2860 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:33:53:462 2860 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
20:33:53:554 2860 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
20:33:53:956 2860 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
20:33:54:463 2860 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:33:54:821 2860 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
20:33:54:950 2860 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
20:33:55:291 2860 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
20:33:55:923 2860 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
20:33:56:315 2860 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:33:56:428 2860 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
20:33:56:546 2860 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
20:33:56:605 2860 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:33:56:716 2860 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
20:33:57:023 2860 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
20:33:57:572 2860 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
20:33:58:473 2860 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
20:33:58:629 2860 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
20:33:58:854 2860 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
20:33:59:417 2860 RimUsb (f17713d108aca124a139fde877eef68a) C:\Windows\system32\Drivers\RimUsb.sys
20:33:59:883 2860 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
20:34:00:010 2860 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
20:34:00:105 2860 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
20:34:00:530 2860 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:34:00:819 2860 SCDEmu (b7f06e48cab48f0f52f341fcee94f260) C:\Windows\system32\drivers\SCDEmu.sys
20:34:00:928 2860 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:34:00:984 2860 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
20:34:01:022 2860 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
20:34:01:100 2860 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
20:34:01:332 2860 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
20:34:01:615 2860 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
20:34:01:932 2860 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
20:34:02:274 2860 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:34:02:526 2860 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
20:34:02:885 2860 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
20:34:03:131 2860 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
20:34:03:535 2860 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
20:34:03:828 2860 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
20:34:04:451 2860 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
20:34:04:451 2860 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
20:34:04:925 2860 srv (0debafcc0e3591fca34f077cab62f7f7) C:\Windows\system32\DRIVERS\srv.sys
20:34:05:589 2860 srv2 (6b6f3658e0a58c6c50c5f7fbdf3df633) C:\Windows\system32\DRIVERS\srv2.sys
20:34:05:659 2860 srvnet (0c5ab1892ae0fa504218db094bf6d041) C:\Windows\system32\DRIVERS\srvnet.sys
20:34:05:719 2860 ssfs0bbc (a3cc244f1e043c2b7ae32899ff99a0a0) C:\Windows\system32\DRIVERS\ssfs0bbc.sys
20:34:05:754 2860 sshrmd (e041026dafa17af2610afc4da8f4ea14) C:\Windows\system32\DRIVERS\sshrmd.sys
20:34:05:798 2860 ssidrv (5a40b485825cc31b3a49bb4701b30d35) C:\Windows\system32\DRIVERS\ssidrv.sys
20:34:05:855 2860 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
20:34:05:880 2860 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:34:05:903 2860 symsnap (5c66e6aa29dad1875cc74662dd13c87e) C:\Windows\system32\DRIVERS\symsnap.sys
20:34:05:922 2860 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:34:05:933 2860 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:34:05:989 2860 Tcpip (48cbe6d53632d0067c2d6b20f90d84ca) C:\Windows\system32\drivers\tcpip.sys
20:34:06:114 2860 Tcpip6 (48cbe6d53632d0067c2d6b20f90d84ca) C:\Windows\system32\DRIVERS\tcpip.sys
20:34:06:168 2860 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
20:34:06:191 2860 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
20:34:06:216 2860 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
20:34:06:272 2860 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
20:34:06:351 2860 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
20:34:06:387 2860 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:34:06:407 2860 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
20:34:06:469 2860 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
20:34:06:477 2860 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
20:34:06:520 2860 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
20:34:06:550 2860 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
20:34:06:569 2860 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
20:34:06:609 2860 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:34:06:636 2860 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:34:06:659 2860 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
20:34:06:702 2860 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\Windows\system32\Drivers\usbaapl.sys
20:34:06:756 2860 usbbus (5353218b3265e3b8190335059f697a11) C:\Windows\system32\DRIVERS\lgusbbus.sys
20:34:06:804 2860 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
20:34:06:859 2860 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:34:06:906 2860 UsbDiag (7dd3eefc62a1ef44e5f940fa651ed9ed) C:\Windows\system32\DRIVERS\lgusbdiag.sys
20:34:06:957 2860 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
20:34:06:998 2860 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
20:34:07:142 2860 USBModem (083031a78822eccbd7510bccd3e20d4c) C:\Windows\system32\DRIVERS\lgusbmodem.sys
20:34:07:176 2860 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
20:34:07:210 2860 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
20:34:07:233 2860 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:34:07:243 2860 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
20:34:07:252 2860 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
20:34:07:425 2860 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
20:34:07:484 2860 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
20:34:07:495 2860 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
20:34:07:504 2860 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
20:34:07:525 2860 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
20:34:07:600 2860 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
20:34:07:631 2860 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
20:34:07:681 2860 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
20:34:07:724 2860 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:34:07:738 2860 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:34:07:742 2860 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:34:07:768 2860 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
20:34:07:867 2860 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
20:34:07:909 2860 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys
20:34:07:954 2860 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
20:34:07:977 2860 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
20:34:07:998 2860 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:34:08:001 2860
20:34:08:001 2860 Completed
20:34:08:001 2860
20:34:08:001 2860 Results:
20:34:08:001 2860 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
20:34:08:002 2860 File objects infected / cured / cured on reboot: 0 / 0 / 0
20:34:08:002 2860
20:34:08:097 2860 KLMD(ARK) unloaded successfully

ComboFix 10-06-02.02 - Troy 06/02/2010 20:40:44.1.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1918.934 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\%appdata%

.
((((((((((((((((((((((((( Files Created from 2010-05-03 to 2010-06-03 )))))))))))))))))))))))))))))))
.

2010-06-03 00:51 . 2010-06-03 00:52 ——– d—–w- c:\users\Troy\AppData\Local\temp
2010-06-03 00:51 . 2010-06-03 00:51 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-06-02 11:19 . 2010-06-02 11:19 680 —-a-w- c:\users\Troy\AppData\Local\d3d9caps.dat
2010-06-02 11:07 . 2010-06-03 00:26 ——– d—–w- c:\users\Troy\AppData\Local\nvrpxmcaa
2010-06-02 11:07 . 2010-06-03 00:26 ——– d—–w- c:\users\Troy\AppData\Local\ihjqxkoxg
2010-06-01 02:49 . 2010-06-01 10:38 ——– d—–w- c:\users\Troy\AppData\Local\uaanprycu
2010-05-26 01:30 . 2010-04-23 14:13 2048 —-a-w- c:\windows\system32\tzres.dll
2010-05-21 18:19 . 2010-05-21 18:19 ——– d—–w- c:\documents and settings\All Users\Application Data\BlitPop
2010-05-20 15:43 . 2010-05-20 15:43 ——– d—–w- c:\users\Troy\AppData\Roaming\Namco
2010-05-20 15:43 . 2010-05-20 15:43 ——– d—–w- c:\users\Troy\AppData\Roaming\PlayFirst
2010-05-20 15:43 . 2010-05-20 15:43 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2010-05-20 15:41 . 2010-05-22 04:23 ——– d—–w- c:\program files\Games
2010-05-18 21:27 . 2010-05-18 21:27 ——– d—–w- c:\users\Troy\AppData\Roaming\HillStoneAnimationStudios_MBV
2010-05-18 21:26 . 2010-05-18 21:26 4096 —-a-w- c:\windows\d3dx.dat
2010-05-18 14:29 . 2010-05-18 14:29 ——– d—–w- c:\users\Troy\AppData\Roaming\Boolat Games
2010-05-17 23:29 . 2010-05-17 23:29 ——– d—–w- c:\users\Troy\AppData\Roaming\Gogii
2010-05-16 14:12 . 2010-05-16 14:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Intenium
2010-05-15 19:22 . 2010-05-15 19:22 ——– d—–w- c:\users\Troy\AppData\Roaming\VendelGAMES
2010-05-13 03:04 . 2010-05-13 03:04 ——– d—–w- c:\users\Troy\AppData\Roaming\Top Evidence
2010-05-13 03:04 . 2010-05-13 03:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Top Evidence
2010-05-12 04:11 . 2010-01-29 15:40 738816 —-a-w- c:\windows\system32\inetcomm.dll
2010-05-11 00:51 . 2010-05-11 00:53 ——– d—–w- c:\users\Troy\AppData\Roaming\DivX
2010-05-11 00:50 . 2010-05-11 00:50 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-05-11 00:47 . 2010-05-11 00:51 ——– d—–w- c:\program files\DivX
2010-05-11 00:46 . 2010-05-11 00:51 ——– d—–w- c:\documents and settings\All Users\Application Data\DivX
2010-05-04 02:08 . 2010-05-11 03:31 ——– d—–w- c:\program files\softendo.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-03 00:52 . 2009-11-11 11:52 34800 —-a-w- c:\documents and settings\All Users\Application Data\nvModes.dat
2010-05-14 01:32 . 2009-07-13 14:31 ——– d—–w- c:\users\Troy\AppData\Roaming\BitTorrent
2010-05-12 07:01 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-05-11 00:51 . 2009-08-20 22:21 ——– d—–w- c:\program files\Common Files\PX Storage Engine
2010-04-26 11:03 . 2010-02-21 03:30 ——– d—–w- c:\program files\ABC Amber BlackBerry Converter
2010-04-25 13:08 . 2010-04-25 13:08 ——– d—–w- c:\users\Troy\AppData\Roaming\ERS G-Studio
2010-04-19 02:49 . 2010-04-19 02:49 ——– d—–w- c:\users\Troy\AppData\Roaming\Ludia
2010-04-19 02:49 . 2010-04-19 02:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Ludia
2010-03-26 14:33 . 2010-04-28 00:37 1496064 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-03-26 14:33 . 2010-04-28 00:37 43008 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-03-26 14:33 . 2010-04-28 00:37 339456 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-03-26 14:32 . 2010-04-28 00:37 346112 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-03-17 01:18 . 2010-03-17 01:18 691696 —-a-w- c:\windows\system32\drivers\sptd.sys
2010-03-10 02:02 . 2009-07-12 02:48 85376 —-a-w- c:\users\Troy\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-08 17:59 . 2010-03-08 17:59 94208 —-a-w- c:\windows\system32\dpl100.dll
2010-03-05 14:01 . 2010-04-14 09:28 420352 —-a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-05-13 19:34 238968 —-a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-23 6183456]
"Fellowes Proxy"="c:\windows\system32\r3proxy.exe" [2007-04-05 98304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Users^Troy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TTWebInfo_Autostart.lnk]
path=c:\users\Troy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TTWebInfo_Autostart.lnk
backup=c:\windows\pss\TTWebInfo_Autostart.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-02 18:05 40368 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-11-20 03:29 623960 —-a-w- c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46 1135912 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2007-08-30 15:50 205480 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 21:33 141600 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-09 05:17 52256 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 20:39 5244216 —-a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2006-11-06 08:27 200704 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 04:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 04:01 71216 ——w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-12 02:46 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2008-06-14 01:11 210216 ——w- c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2008-09-25 01:33 210216 ——w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:33 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

:a1,34,1b,54,c3,38,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2730761411-3726730529-697826823-1000]
"EnableNotificationsRef"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 135664]
R2 SessionLauncher;SessionLauncher;c:\users\Troy\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-17 691696]
S0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2009-11-06 29808]
S2 ETService;Empowering Technology Service;c:\program files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [2008-06-11 24576]
S2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2009-11-21 1201640]
S3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\DRIVERS\FeMouWDM.sys [2007-04-05 12672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
getPlusHelper REG_MULTI_SZ getPlusHelper
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 19:03]

2010-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 19:03]

2010-06-03 c:\windows\Tasks\User_Feed_Synchronization-{6501D066-9E2F-47C0-9FCE-969DE09A615E}.job
- c:\windows\system32\msfeedssync.exe [2010-03-31 04:54]

2010-06-03 c:\windows\Tasks\wrSpySweeper_L27B2A58B167942F58416CB3BA8661166.job
- c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2009-07-12 20:19]

2010-06-03 c:\windows\Tasks\wrSpySweeper_L27B2A58B167942F58416CB3BA8661166.job
- c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2009-07-12 20:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l;=0409&s;=1&o;=vb32&d;=0309&m;=et1161-05
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - component: c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-eRecoveryService - (no file)
MSConfigStartUp-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-Norton Ghost 12 - c:\program files\Norton Ghost\Agent\VProTray.exe
MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-xsywaywt - c:\users\Troy\AppData\Local\uaanprycu\ibknuditssd.exe
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
AddRemove-LSI Soft Modem - c:\windows\agrsmdel

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-02 20:54
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x84CF31F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87da2d24
\Driver\ACPI -> acpi.sys @ 0x8292fd68
\Driver\atapi -> 0x84cf21f8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(760)
c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Webroot\WebrootSecurity\SSU.EXE
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-06-02 21:01:19 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-03 01:01

Pre-Run: 72,945,623,040 bytes free
Post-Run: 72,804,499,456 bytes free

- - End Of File - - 5D3EB5557C23E28D0CF47DEE4F9FAFBD

After I rebooted my machine, and before it loaded Windows, I received a Webroot message saying it had blocked certain files (was too fast for me to read it all), then it went into Windows and after it loaded, it came up with 3 new malware files (it hadn't detected in the last 3 scans). It almost appears as if whatever I have keeps changing itself somehow to re-infect the machine each time Webroot tries to Quarantine it.

I have attempted to open multiple Firefox windows and haven't been redirected yet…YAY….

What I am noticing is that ever since the last reboot from Combofix, my hard drive is constantly being hit but I can not see anything in task manger / processes that appears to be hogging resources.

I did notice something called etservice.exe (Acer empowering technology framework service) I don't recall seeing this, do I need this?

SweetTech

Post #4June 3, 2010, 1:33 AM UTC

Hello,

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

NEXT:

ComboFix Script

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::
Folder::
c:\users\Troy\AppData\Local\nvrpxmcaa
c:\users\Troy\AppData\Local\ihjqxkoxg
c:\users\Troy\AppData\Local\uaanprycu

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT:

Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT:

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

NEXT:

OTL Custom Scan

We need to run an OTL Custom Scan

Please reopen [external image: Posted Image] on your desktop.
Copy and Paste the following bolded text into the [external image: Posted Image] textbox.

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /180
Push [external image: Posted Image]
A report will open. Copy and Paste that report in your next reply.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that was produced after running the ComboFix scan.
3. The log that was produced after running the MalwareBytes' Anti-Malware scan.
4. The log that was produced after running the ESET Online Virus Scanner.
5. The log that was produced after running the OTL scan.
6. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Cheers,
SweetTech.

Troyr30

Post #5June 3, 2010, 10:41 AM UTC

1. OK, I ran all but the OTL because you said to run it again but I wasn't asked to run it in the first place (unless it has a different name)

2. The log that was produced after running the ComboFix scan.

ComboFix 10-06-02.02 - Troy 06/02/2010 23:25:03.2.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1918.1209 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Troy\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Troy\AppData\Local\ihjqxkoxg
c:\users\Troy\AppData\Local\nvrpxmcaa
c:\users\Troy\AppData\Local\uaanprycu

.
((((((((((((((((((((((((( Files Created from 2010-05-03 to 2010-06-03 )))))))))))))))))))))))))))))))
.

2010-06-03 03:34 . 2010-06-03 03:36 ——– d—–w- c:\users\Troy\AppData\Local\temp
2010-06-03 03:34 . 2010-06-03 03:34 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-06-03 03:34 . 2010-06-03 03:34 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-06-03 03:34 . 2010-06-03 03:34 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-06-02 11:19 . 2010-06-02 11:19 680 —-a-w- c:\users\Troy\AppData\Local\d3d9caps.dat
2010-05-26 01:30 . 2010-04-23 14:13 2048 —-a-w- c:\windows\system32\tzres.dll
2010-05-21 18:19 . 2010-05-21 18:19 ——– d—–w- c:\documents and settings\All Users\Application Data\BlitPop
2010-05-20 15:43 . 2010-05-20 15:43 ——– d—–w- c:\users\Troy\AppData\Roaming\Namco
2010-05-20 15:43 . 2010-05-20 15:43 ——– d—–w- c:\users\Troy\AppData\Roaming\PlayFirst
2010-05-20 15:43 . 2010-05-20 15:43 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2010-05-20 15:41 . 2010-05-22 04:23 ——– d—–w- c:\program files\Games
2010-05-18 21:27 . 2010-05-18 21:27 ——– d—–w- c:\users\Troy\AppData\Roaming\HillStoneAnimationStudios_MBV
2010-05-18 21:26 . 2010-05-18 21:26 4096 —-a-w- c:\windows\d3dx.dat
2010-05-18 14:29 . 2010-05-18 14:29 ——– d—–w- c:\users\Troy\AppData\Roaming\Boolat Games
2010-05-17 23:29 . 2010-05-17 23:29 ——– d—–w- c:\users\Troy\AppData\Roaming\Gogii
2010-05-16 14:12 . 2010-05-16 14:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Intenium
2010-05-15 19:22 . 2010-05-15 19:22 ——– d—–w- c:\users\Troy\AppData\Roaming\VendelGAMES
2010-05-13 03:04 . 2010-05-13 03:04 ——– d—–w- c:\users\Troy\AppData\Roaming\Top Evidence
2010-05-13 03:04 . 2010-05-13 03:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Top Evidence
2010-05-12 04:11 . 2010-01-29 15:40 738816 —-a-w- c:\windows\system32\inetcomm.dll
2010-05-11 00:51 . 2010-05-11 00:53 ——– d—–w- c:\users\Troy\AppData\Roaming\DivX
2010-05-11 00:50 . 2010-05-11 00:50 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-05-11 00:47 . 2010-05-11 00:51 ——– d—–w- c:\program files\DivX
2010-05-11 00:46 . 2010-05-11 00:51 ——– d—–w- c:\documents and settings\All Users\Application Data\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-03 03:36 . 2009-11-11 11:52 34800 —-a-w- c:\documents and settings\All Users\Application Data\nvModes.dat
2010-05-14 01:32 . 2009-07-13 14:31 ——– d—–w- c:\users\Troy\AppData\Roaming\BitTorrent
2010-05-12 07:01 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-05-11 03:31 . 2010-05-04 02:08 ——– d—–w- c:\program files\softendo.com
2010-05-11 00:51 . 2009-08-20 22:21 ——– d—–w- c:\program files\Common Files\PX Storage Engine
2010-04-26 11:03 . 2010-02-21 03:30 ——– d—–w- c:\program files\ABC Amber BlackBerry Converter
2010-04-25 13:08 . 2010-04-25 13:08 ——– d—–w- c:\users\Troy\AppData\Roaming\ERS G-Studio
2010-04-19 02:49 . 2010-04-19 02:49 ——– d—–w- c:\users\Troy\AppData\Roaming\Ludia
2010-04-19 02:49 . 2010-04-19 02:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Ludia
2010-03-26 14:33 . 2010-04-28 00:37 1496064 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-03-26 14:33 . 2010-04-28 00:37 43008 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-03-26 14:33 . 2010-04-28 00:37 339456 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-03-26 14:32 . 2010-04-28 00:37 346112 —-a-w- c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-03-17 01:18 . 2010-03-17 01:18 691696 —-a-w- c:\windows\system32\drivers\sptd.sys
2010-03-10 02:02 . 2009-07-12 02:48 85376 —-a-w- c:\users\Troy\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-08 17:59 . 2010-03-08 17:59 94208 —-a-w- c:\windows\system32\dpl100.dll
2010-03-05 14:01 . 2010-04-14 09:28 420352 —-a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-05-13 19:34 238968 —-a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-23 6183456]
"Fellowes Proxy"="c:\windows\system32\r3proxy.exe" [2007-04-05 98304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Users^Troy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TTWebInfo_Autostart.lnk]
path=c:\users\Troy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TTWebInfo_Autostart.lnk
backup=c:\windows\pss\TTWebInfo_Autostart.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-02 18:05 40368 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-11-20 03:29 623960 —-a-w- c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46 1135912 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2007-08-30 15:50 205480 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 21:33 141600 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-09 05:17 52256 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 20:39 5244216 —-a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2006-11-06 08:27 200704 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 04:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 04:01 71216 ——w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-12 02:46 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2008-06-14 01:11 210216 ——w- c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2008-09-25 01:33 210216 ——w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:33 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

:a1,34,1b,54,c3,38,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2730761411-3726730529-697826823-1000]
"EnableNotificationsRef"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 135664]
R2 SessionLauncher;SessionLauncher;c:\users\Troy\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-17 691696]
S0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2009-11-06 29808]
S2 ETService;Empowering Technology Service;c:\program files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [2008-06-11 24576]
S2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2009-11-21 1201640]
S3 FeMouWDM;Fellowes Mouse Driver;c:\windows\system32\DRIVERS\FeMouWDM.sys [2007-04-05 12672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
getPlusHelper REG_MULTI_SZ getPlusHelper
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 19:03]

2010-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 19:03]

2010-06-03 c:\windows\Tasks\User_Feed_Synchronization-{6501D066-9E2F-47C0-9FCE-969DE09A615E}.job
- c:\windows\system32\msfeedssync.exe [2010-03-31 04:54]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l;=0409&s;=1&o;=vb32&d;=0309&m;=et1161-05
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - component: c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-02 23:36
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(3600)
c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Webroot\WebrootSecurity\SSU.EXE
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-06-02 23:44:06 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-03 03:44
ComboFix2.txt 2010-06-03 01:01

Pre-Run: 72,725,409,792 bytes free
Post-Run: 72,643,141,632 bytes free

- - End Of File - - ADABE11DAAC0F782544CCC7448838074

3. The log that was produced after running the MalwareBytes' Anti-Malware scan.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4166

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

6/2/2010 11:51:04 PM
mbam-log-2010-06-02 (23-51-04).txt

Scan type: Quick scan
Objects scanned: 128381
Time elapsed: 4 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

4. The log that was produced after running the ESET Online Virus Scanner.

C:\Users\Troy\Downloads\Nero 8.3.6.0 Ultra Edition + keymaker and instructions\Nero 8 install + keymaker + instructions.zip Win32/Toolbar.AskSBar application
C:\Windows\winsxs\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6001.18000_none_d4db241b3e3ef7e4\RDPCDD.sys Win32/Olmarik.ZC trojan
E:\Program Files\Uninstall Fun Web Products.dll a variant of Win32/Toolbar.MyWebSearch.K application
E:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL a variant of Win32/Toolbar.MyWebSearch.K application
E:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL Win32/Toolbar.MyWebSearch application

5. The log that was produced after running the OTL scan.

I don't know what OTL is

6. An update on how your computer is currently running. Same as before, so far no popups and also nothing found by Webroot. I am going to work and will await your response but as of right now, my machine has no antivirus on and the cd drive emulators are still off.

SweetTech

Post #6June 3, 2010, 3:47 PM UTC

Running OTL

We need to create a New FULL OTL Report

Please download OTL from here if you have not done so already:
- Main Mirror
Save it to your desktop.
Double click on the [external image: Posted Image] icon on your desktop.
Click the "Scan All Users" checkbox.
Change the "Extra Registry" option to "SafeList"
Push the [external image: Posted Image] button.
Two reports will open, copy and paste them in a reply here:
- OTL.txt <– Will be opened
- Extra.txt <– Will be minimized

Troyr30

Post #7June 4, 2010, 12:07 AM UTC

OTL.TXT
OTL logfile created on: 6/3/2010 7:44:11 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Users\Troy\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 139.05 Gb Total Space | 67.25 Gb Free Space | 48.36% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 465.76 Gb Total Space | 246.45 Gb Free Space | 52.91% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TROY-PC
Current User Name: Troy
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/03 19:43:14 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Troy\Desktop\OTL.exe
PRC - [2010/04/03 01:10:31 | 000,910,296 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/11/21 00:41:37 | 001,201,640 | —- | M] (Webroot Software, Inc. ) – C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
PRC - [2009/11/06 16:19:58 | 006,515,784 | —- | M] (Webroot Software, Inc.) – C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe
PRC - [2009/11/06 13:00:22 | 004,048,240 | —- | M] (Webroot Software, Inc. (www.webroot.com)) – C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
PRC - [2009/11/06 13:00:22 | 000,165,232 | —- | M] (Webroot Software, Inc. (www.webroot.com)) – C:\Program Files\Webroot\WebrootSecurity\SSU.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/07/23 14:25:32 | 006,183,456 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2008/07/22 22:14:28 | 000,012,800 | —- | M] (Agere Systems) – C:\Windows\System32\agrsmsvc.exe
PRC - [2008/06/11 14:18:30 | 000,024,576 | —- | M] () – C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe
PRC - [2007/04/04 20:53:02 | 000,098,304 | —- | M] (Fellowes, Inc.) – C:\Windows\System32\r3proxy.exe

========== Modules (SafeList) ==========

MOD - [2010/06/03 19:43:14 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Troy\Desktop\OTL.exe
MOD - [2009/04/11 02:21:38 | 001,686,016 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/20 22:34:21 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – – (SessionLauncher)
SRV - File not found [Auto | Stopped] – – (RoxLiveShare9)
SRV - [2010/04/07 19:21:30 | 000,246,520 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files\eMachines Games\eMachines Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2009/11/21 00:41:37 | 001,201,640 | —- | M] (Webroot Software, Inc. ) [Auto | Running] – C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe – (WRConsumerService)
SRV - [2009/11/06 13:00:22 | 004,048,240 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] – C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe – (WebrootSpySweeperService)
SRV - [2009/09/24 21:27:04 | 000,793,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2008/07/22 22:14:28 | 000,012,800 | —- | M] (Agere Systems) [Auto | Running] – C:\Windows\System32\agrsmsvc.exe – (AgereModemAudio)
SRV - [2008/06/11 14:18:30 | 000,024,576 | —- | M] () [Auto | Running] – C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe – (ETService)
SRV - [2008/01/20 22:33:00 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] – – (catchme)
DRV - [2010/03/16 21:18:23 | 000,691,696 | —- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\System32\Drivers\sptd.sys – (sptd)
DRV - [2009/11/06 13:00:36 | 000,176,752 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\ssidrv.sys – (ssidrv)
DRV - [2009/11/06 13:00:36 | 000,023,152 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\sshrmd.sys – (sshrmd)
DRV - [2009/11/06 13:00:34 | 000,029,808 | —- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\ssfs0bbc.sys – (ssfs0bbc)
DRV - [2009/09/28 00:12:22 | 009,509,832 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2009/08/13 16:07:12 | 001,163,328 | —- | M] (LSI Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2009/06/17 12:55:18 | 000,020,240 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\L8042Kbd.sys – (L8042Kbd)
DRV - [2008/08/01 19:51:14 | 001,052,704 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvmfdx32.sys – (NVENETFD)
DRV - [2008/07/23 14:28:32 | 002,152,344 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RTKVHDA.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/06/11 14:13:24 | 000,015,392 | —- | M] (Acer, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\int15.sys – (int15)
DRV - [2008/01/25 08:02:02 | 000,140,832 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\nvstor32.sys – (nvstor32)
DRV - [2008/01/20 22:32:53 | 000,149,560 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2008/01/20 22:32:53 | 000,031,288 | —- | M] (LSI Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2008/01/20 22:32:52 | 000,386,616 | —- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasr.sys – (MegaSR)
DRV - [2008/01/20 22:32:52 | 000,101,432 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2008/01/20 22:32:52 | 000,074,808 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2008/01/20 22:32:52 | 000,040,504 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2008/01/20 22:32:51 | 000,300,600 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2008/01/20 22:32:51 | 000,089,656 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2008/01/20 22:32:50 | 001,122,360 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2008/01/20 22:32:50 | 000,118,784 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2008/01/20 22:32:50 | 000,079,928 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2008/01/20 22:32:49 | 000,235,064 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2008/01/20 22:32:49 | 000,130,616 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2008/01/20 22:32:49 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2008/01/20 22:32:49 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2008/01/20 22:32:49 | 000,079,416 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2008/01/20 22:32:48 | 000,342,584 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2008/01/20 22:32:48 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2008/01/20 22:32:47 | 000,102,968 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2008/01/20 22:32:47 | 000,045,112 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2008/01/20 22:32:46 | 000,422,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2008/01/20 22:32:45 | 000,238,648 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2008/01/20 22:32:21 | 000,020,024 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/01/20 22:32:21 | 000,019,000 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/01/20 22:32:21 | 000,017,464 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/04/04 20:51:36 | 000,012,672 | —- | M] (Fellowes, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\FeMouWDM.sys – (FeMouWDM)
DRV - [2007/03/28 20:29:12 | 000,131,944 | —- | M] (StorageCraft) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\symsnap.sys – (symsnap)
DRV - [2006/11/06 04:28:11 | 000,030,988 | —- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\scdemu.sys – (SCDEmu)
DRV - [2006/11/02 05:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 05:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 05:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 05:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 04:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2005/06/24 18:36:16 | 000,039,036 | —- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lgusbmodem.sys – (USBModem)
DRV - [2005/05/26 11:01:36 | 000,038,144 | —- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lgusbdiag.sys – (UsbDiag)
DRV - [2005/05/26 11:01:18 | 000,021,344 | —- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lgusbbus.sys – (usbbus)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A…amp;m=et1161-05
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A…amp;m=et1161-05

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.3
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.13
FF - prefs.js..extensions.enabledItems: {6e84150a-d526-41f1-a480-a67d3fed910d}:1.4.5.1
FF - prefs.js..extensions.enabledItems: [removed]:3.6.2

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/16 16:17:15 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/16 16:17:15 | 000,000,000 | —D | M]

[2009/07/12 12:52:59 | 000,000,000 | —D | M] – C:\Users\Troy\AppData\Roaming\Mozilla\Extensions
[2010/06/02 23:54:24 | 000,000,000 | —D | M] – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions
[2010/05/08 00:34:41 | 000,000,000 | —D | M] (No name found) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/27 20:07:06 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/27 20:37:05 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/03/18 23:05:51 | 000,000,000 | —D | M] (Flashblock) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2010/01/27 08:10:07 | 000,000,000 | —D | M] (IE View) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
[2010/05/31 22:54:47 | 000,000,000 | —D | M] (Fire.fm) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2009/09/10 19:03:58 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/01/29 00:01:50 | 000,000,000 | —D | M] – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\extensions\[removed]
[2009/09/16 23:40:12 | 000,003,915 | —- | M] () – C:\Users\Troy\AppData\Roaming\Mozilla\Firefox\Profiles\j3ganupr.default\searchplugins\sweetim.xml
[2010/06/02 23:54:24 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/02/11 15:16:16 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2009/08/03 16:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\Mozilla Firefox\plugins\npOGAPlugin.dll

O1 HOSTS File: ([2010/06/02 23:35:54 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Fellowes Proxy] C:\Windows\System32\r3proxy.exe (Fellowes, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (0529-697826823-1000) - File not found
O30 - LSA: Security Packages - (᱌&) - File not found
O30 - LSA: Security Packages - (ꘄ) - File not found
O30 - LSA: Security Packages - () - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2005/01/04 08:03:35 | 000,000,000 | —- | M] () - E:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/03 19:43:31 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Users\Troy\Desktop\OTL.exe
[2010/06/02 23:52:11 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/06/02 23:46:12 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\Malwarebytes
[2010/06/02 23:46:05 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/06/02 23:46:03 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/06/02 23:46:03 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/06/02 23:46:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/02 23:46:02 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/02 23:44:08 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/06/02 23:44:08 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Local\temp
[2010/06/02 23:43:13 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/06/02 23:22:43 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/06/02 20:37:56 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/06/02 20:37:56 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/06/02 20:37:56 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/06/02 20:37:44 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/06/02 20:32:11 | 000,000,000 | —D | C] – C:\Users\Troy\Desktop\tdsskiller
[2010/06/02 20:31:15 | 000,000,000 | —D | C] – C:\Qoobox
[2010/05/25 21:30:38 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/05/21 14:19:09 | 000,000,000 | —D | C] – C:\ProgramData\BlitPop
[2010/05/21 14:19:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\BlitPop
[2010/05/20 11:43:25 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\Namco
[2010/05/20 11:43:10 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\PlayFirst
[2010/05/20 11:43:10 | 000,000,000 | —D | C] – C:\ProgramData\PlayFirst
[2010/05/20 11:43:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2010/05/20 11:41:12 | 000,000,000 | —D | C] – C:\Program Files\Games
[2010/05/19 00:35:02 | 000,000,000 | —D | C] – C:\Config.Msi
[2010/05/18 17:27:24 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\HillStoneAnimationStudios_MBV
[2010/05/18 10:29:55 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\Boolat Games
[2010/05/17 19:29:32 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\Gogii
[2010/05/16 10:12:48 | 000,000,000 | —D | C] – C:\ProgramData\Intenium
[2010/05/16 10:12:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Intenium
[2010/05/15 15:22:19 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\VendelGAMES
[2010/05/12 23:04:06 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\Top Evidence
[2010/05/12 23:04:06 | 000,000,000 | —D | C] – C:\ProgramData\Top Evidence
[2010/05/12 23:04:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Top Evidence
[2010/05/10 23:33:25 | 000,000,000 | —D | C] – C:\Users\Troy\Desktop\ToonTown
[2010/05/10 20:51:28 | 000,000,000 | —D | C] – C:\Users\Troy\AppData\Roaming\DivX
[2010/05/10 20:50:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2010/05/10 20:47:04 | 000,000,000 | —D | C] – C:\Program Files\DivX
[2010/05/10 20:46:47 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/05/10 20:46:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\DivX

========== Files - Modified Within 30 Days ==========

[2010/06/03 19:43:50 | 002,097,152 | -HS- | M] () – C:\Users\Troy\NTUSER.DAT
[2010/06/03 19:43:14 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Troy\Desktop\OTL.exe
[2010/06/03 19:35:53 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/03 19:35:53 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/03 19:20:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/02 23:46:08 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/02 23:43:18 | 000,000,444 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6501D066-9E2F-47C0-9FCE-969DE09A615E}.job
[2010/06/02 23:42:20 | 000,751,146 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/06/02 23:42:20 | 000,636,754 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/06/02 23:42:20 | 000,117,882 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/06/02 23:36:14 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/06/02 23:36:10 | 000,034,800 | —- | M] () – C:\ProgramData\nvModes.dat
[2010/06/02 23:36:10 | 000,034,800 | —- | M] () – C:\Documents and Settings\All Users\Application Data\nvModes.dat
[2010/06/02 23:36:09 | 000,034,800 | —- | M] () – C:\ProgramData\nvModes.001
[2010/06/02 23:36:09 | 000,034,800 | —- | M] () – C:\Documents and Settings\All Users\Application Data\nvModes.001
[2010/06/02 23:35:58 | 000,000,000 | —- | M] () – C:\Windows\System32\LogConfigTemp.xml
[2010/06/02 23:35:54 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/06/02 23:35:52 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/02 23:35:47 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/06/02 23:35:44 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/06/02 23:34:50 | 000,524,288 | -HS- | M] () – C:\Users\Troy\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2010/06/02 23:34:50 | 000,065,536 | -HS- | M] () – C:\Users\Troy\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2010/06/02 23:34:49 | 001,664,267 | -H– | M] () – C:\Users\Troy\AppData\Local\IconCache.db
[2010/06/02 23:17:15 | 000,000,020 | —- | M] () – C:\Users\Troy\defogger_reenable
[2010/06/02 20:30:50 | 003,702,596 | R— | M] () – C:\Users\Troy\Desktop\ComboFix.exe
[2010/06/02 20:30:05 | 000,966,213 | —- | M] () – C:\Users\Troy\Desktop\tdsskiller.zip
[2010/06/02 07:19:35 | 000,000,680 | —- | M] () – C:\Users\Troy\AppData\Local\d3d9caps.dat
[2010/05/18 17:26:57 | 000,004,096 | —- | M] () – C:\Windows\d3dx.dat
[2010/05/05 21:32:49 | 000,344,640 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2010/06/02 23:46:08 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/02 23:17:05 | 000,000,020 | —- | C] () – C:\Users\Troy\defogger_reenable
[2010/06/02 20:37:56 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/06/02 20:37:56 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/06/02 20:37:56 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/06/02 20:37:56 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/06/02 20:37:56 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/06/02 20:31:30 | 003,702,596 | R— | C] () – C:\Users\Troy\Desktop\ComboFix.exe
[2010/06/02 20:30:26 | 000,966,213 | —- | C] () – C:\Users\Troy\Desktop\tdsskiller.zip
[2010/06/02 07:19:35 | 000,000,680 | —- | C] () – C:\Users\Troy\AppData\Local\d3d9caps.dat
[2010/05/18 17:26:57 | 000,004,096 | —- | C] () – C:\Windows\d3dx.dat
[2009/11/06 13:00:28 | 000,031,088 | —- | C] () – C:\Windows\System32\wrLZMA.dll
[2009/09/18 06:08:57 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/12 09:04:15 | 000,131,072 | —- | C] () – C:\Windows\System32\language.dll
[2009/07/11 22:49:01 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/03/22 03:56:49 | 000,487,424 | —- | C] () – C:\Windows\System32\INT15.dll
[2008/10/24 11:41:58 | 000,215,144 | R— | C] () – C:\Windows\pw32a.dll
[2008/10/24 11:41:58 | 000,215,144 | R— | C] () – C:\Windows\patchw32.dll
[2006/11/22 17:16:18 | 000,003,612 | —- | C] () – C:\Windows\ReaderString.ini
[2006/11/21 13:50:06 | 000,000,037 | —- | C] () – C:\Windows\sunkist.ini
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2004/01/30 15:07:46 | 000,245,408 | —- | C] () – C:\Windows\System32\unicows.dll
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI

========== Files - Unicode (All) ==========
[2009/07/13 08:51:01 | 006,016,512 | —- | M] ()(C:\Windows\System32\??.m01) – C:\Windows\System32\态Ŀ.m01
[2009/07/13 08:51:01 | 000,067,604 | —- | M] ()(C:\Windows\System32\??.vol) – C:\Windows\System32\态Ŀ.vol
[2009/07/13 08:51:01 | 000,000,512 | —- | M] ()(C:\Windows\System32\??.f01) – C:\Windows\System32\态Ŀ.f01
[2009/07/13 08:49:37 | 006,016,512 | —- | C] ()(C:\Windows\System32\??.m01) – C:\Windows\System32\态Ŀ.m01
[2009/07/13 08:49:37 | 000,067,604 | —- | C] ()(C:\Windows\System32\??.vol) – C:\Windows\System32\态Ŀ.vol
[2009/07/13 08:49:37 | 000,000,512 | —- | C] ()(C:\Windows\System32\??.f01) – C:\Windows\System32\态Ŀ.f01

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:FAB64002
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:FAB64002
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:92D91D7E
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:92D91D7E
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:AC733A73
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:AC733A73
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:FF251D87
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:4EE323A4
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:FF251D87
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:4EE323A4
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:F0AB86C0
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:F0AB86C0
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:11E79CC9
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:11E79CC9
< End of report >

Extras.txt

OTL Extras logfile created on: 6/3/2010 7:44:11 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Users\Troy\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 139.05 Gb Total Space | 67.25 Gb Free Space | 48.36% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 465.76 Gb Total Space | 246.45 Gb Free Space | 52.91% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TROY-PC
Current User Name: Troy
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2730761411-3726730529-697826823-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2730761411-3726730529-697826823-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01A368DA-0AA7-448A-A03B-6A6C3EC74238}" = rport=10243 | protocol=6 | dir=out | app=system |
"{05859B67-3872-4574-9CC3-6ACE04F4AA68}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2DAF9DF6-1705-47BA-AA2D-B5B8F17D6891}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2FE95820-935F-481D-BD4E-0225C8B003B2}" = lport=10243 | protocol=6 | dir=in | app=system |
"{33C2617C-F928-4BDC-9364-2FFADB520CED}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3658C923-CB26-4227-B851-B40CFBE28364}" = lport=2869 | protocol=6 | dir=in | app=system |
"{3A812F06-4FC8-40F8-A436-71BDA413A45A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{3BE7A324-E580-4208-9FE0-D8F8FAEFDFB9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{48D5C8B0-249F-4791-998E-24485639F8F7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6BEC7413-F449-4EB8-A4F8-812D07F9825B}" = rport=138 | protocol=17 | dir=out | app=system |
"{727DA3B5-522C-4A3C-BC37-4B53A565FA2A}" = lport=137 | protocol=17 | dir=in | app=system |
"{79769F26-E9BD-4D8C-AB36-578A34017997}" = lport=139 | protocol=6 | dir=in | app=system |
"{8FE073E5-7D2D-47CC-98C3-691B115E5952}" = rport=445 | protocol=6 | dir=out | app=system |
"{A7676BAB-D26C-47DD-A223-96BDEA807CCF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{A928064B-3135-4085-9948-3B7D2D687092}" = rport=137 | protocol=17 | dir=out | app=system |
"{BFA52AFD-EE89-494B-93B0-19B4BF42BA65}" = lport=445 | protocol=6 | dir=in | app=system |
"{C952F319-2D75-4708-B1E3-0ABCC06CDEB7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D29709E7-08E3-41A0-8EAD-47B86A06AC03}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D8DE89B7-C012-48DC-9454-93FE9D4625E5}" = lport=138 | protocol=17 | dir=in | app=system |
"{E8DDBC35-5561-4997-9625-3C935140DB06}" = rport=139 | protocol=6 | dir=out | app=system |
"{F2AF351C-6511-4945-AE61-60D9BB126CC5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0076760A-41C1-4691-BF22-7C898B476690}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{033EB7FD-B900-4A37-9ECE-5716AFC87DBA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{09AB74E0-3662-47D9-9E07-4CCD3FE7A53C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{0C1EF46D-F2D1-4B28-BF8A-AA0249F5DFC2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0DBF9834-C9B1-431E-9DDE-AC6A1C7C6C02}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3D3FAE3D-60F8-40C6-9DC8-AF49DFD67284}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3F154BDD-6F14-4A8C-A4C7-F095B99A3DCE}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{44AB385E-4169-4A9E-8F0F-12EB0278BB0F}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{45103A2B-DA36-40BD-A9B1-B32B6D21D889}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{53D2935E-A4E1-42F6-9C0D-ECE917391AB7}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{555C56DD-9DA0-4BDD-A2EE-5FC0DEB38C43}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{55662466-A8E8-42C1-9683-F46A742D0414}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{5BD87508-B3E9-4025-BE9C-21C1F78ED396}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{5CC5C773-66D8-4C0C-AD78-2733B0FB8364}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{5E62857D-7BDD-4627-98B1-2C6E849ECD2E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{811FBD74-009A-42B3-8B96-41A23C3EC8F4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{827093BA-B4A4-4F61-BC0D-61C430FCCE91}" = protocol=6 | dir=out | app=system |
"{91118D8B-CF40-468B-AD62-9696C7F9610D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{926131E4-D745-41E8-B783-7654789C4C00}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{93A02A45-C429-460A-8A30-66784D0D42CF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{9FC0018E-1D1F-4E08-8644-E93A7A9A63EF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A5FFFE85-2DA5-4FC9-AEAF-CD0E3EFCF4C3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A7AF5761-87D6-4930-B11B-459836E639D4}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{AE93D13F-84AE-496A-ACD5-A9E7C14EA100}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B6230B8A-16AD-411F-8E65-7E41A6B41387}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C15373E0-590A-43AE-9D70-3F3C973678A1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C568822F-E328-4919-92DC-A3C82F48EB6E}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{CEBB0483-FE9C-4F58-8F9F-F1E99F5D5884}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D494544C-ED9A-49B7-B74B-8231398B3ADD}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{E12F2E83-9951-40B5-BF84-A4621555D173}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E5B93D42-8E94-4B5B-B08B-E58758298E16}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{FE8C50D9-D2AD-4301-B270-74C44C768FC2}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{A0AFB379-8642-492A-A895-4390B371D72F}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B503DA62-D40B-45CE-97AA-AE8CA664FA8D}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
"UDP Query User{AB7824DE-A4D0-4625-90DC-1EEA343B5ECA}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |
"UDP Query User{ED6E748E-414E-4580-89A0-F6AC16DF7948}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{1FCC574F-AFA2-4432-9EF1-79CA7BA73431}_is1" = Webroot AntiVirus with Spy Sweeper
"{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 18
"{26B0AFFA-761C-4D6A-9CF7-395E8A0AD167}" = EasyPoint USB Mouse Software
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3F5B6210-0903-4DC6-8034-8F488AA3A782}" = Spy Sweeper Core
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = CyberLink PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6DE13770-01B7-4366-8DA6-48237793F445}" = VoiceOver Kit
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = eMachines Recovery Management
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.2
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BE2CC4A5-2128-4EA2-941D-14F7A6A1AB61}" = Digital Media Reader
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"BlackBerry_{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"DFX for Windows Media Player" = DFX for Windows Media Player
"Disney Toontown Online" = Disney Toontown Online
"DivX Setup.divx.com" = DivX Setup
"EasyBCD" = EasyBCD 2.0 Beta
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{BE2CC4A5-2128-4EA2-941D-14F7A6A1AB61}" = Digital Media Reader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"NVIDIA Drivers" = NVIDIA Drivers
"PowerISO" = PowerISO
"Toontown Keep-Alive" = Toontown Keep-Alive
"WildTangent emachines Master Uninstall" = eMachines Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2730761411-3726730529-697826823-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/19/2010 11:58:50 AM | Computer Name = Troy-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/19/2010 10:04:35 PM | Computer Name = Troy-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/20/2010 6:56:11 AM | Computer Name = Troy-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2010 9:12:41 AM | Computer Name = Troy-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ System Events ]
Error - 11/5/2009 12:08:05 AM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/5/2009 12:08:05 AM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 11/7/2009 2:19:25 PM | Computer Name = Troy-PC | Source = DCOM | ID = 10005
Description =

Error - 11/7/2009 2:19:26 PM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 11/7/2009 2:19:26 PM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/8/2009 1:43:21 PM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 11/8/2009 1:43:21 PM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 11/11/2009 7:47:54 AM | Computer Name = Troy-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 11/11/2009 7:47:54 AM | Computer Name = Troy-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 11/11/2009 7:50:49 AM | Computer Name = Troy-PC | Source = Service Control Manager | ID = 7016
Description =

< End of report >

SweetTech

Post #8June 4, 2010, 12:25 AM UTC

Hello,

How are things running??

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
DRV - File not found [Kernel | On_Demand | Running] – – (catchme)
IE - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2730761411-3726730529-697826823-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (0529-697826823-1000) - File not found
O30 - LSA: Security Packages - (á±Œ&) - File not found
O30 - LSA: Security Packages - (ê˜„) - File not found
O30 - LSA: Security Packages - () - File not found
[2010/06/02 20:30:05 | 000,966,213 | —- | M] () – C:\Users\Troy\Desktop\tdsskiller.zip
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:FAB64002
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:FAB64002
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:92D91D7E
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:92D91D7E
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:AC733A73
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:AC733A73
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:FF251D87
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:4EE323A4
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:FF251D87
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:4EE323A4
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:F0AB86C0
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:F0AB86C0
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:11E79CC9
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:11E79CC9
:Files
C:\Users\Troy\Downloads\Nero 8.3.6.0 Ultra Edition + keymaker and instructions
C:\Windows\winsxs\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6001.18000_none_d4db241b3e3ef7e4\RDPCDD.sys
E:\Program Files\Uninstall Fun Web Products.dll
E:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
E:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "JDK 6 Update 20 (JDK or JRE)".
Click the "Download JRE" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.
If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

– Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
– Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note:
The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.
To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.

NEXT

Clean Java Cache & Temporary Files

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

Go to Start > Control Panel > Add/Remove Programs
Remove ALL instances of Adobe Reader
Re-boot your computer as required.
Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader

Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

NEXT

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Troyr30

Post #9June 4, 2010, 2:14 AM UTC last edited June 4, 2010, 2:19 AM UTC

HOUSTON WE HAVE A PROBLEM I copied and pasted everything like you asked and it went through it's processes. It went to reboot the machine and it keeps taking me to the login screen (which I never used before) and now keeps coming up saying "THE HANDLE IS INVALID" it won't let me login. I have no password on the machine and when I hit enter it doesn't do anything except say "THE HANDLE IS INVALID" Then it reboots and I get the same error messages. I can no longer log into the machine. How do I get around this???

SweetTech

Post #10June 4, 2010, 2:25 AM UTC

Last Known Good Configuration

Start the computer by using the last known good configuration. To start the computer by using the last known good configuration, follow these steps:

Restart your computer.
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
This will bring up a menu.
Use the Up and Down Arrow Keys to scroll to Last Known Good Configuration
Then press the Enter Key on your Keyboard
Go into your usual account

Troyr30

Post #11June 4, 2010, 2:27 AM UTC

Ok that worked. Thank you. Where should I continue from this point? is there something I need to do to get my cd drives back online? Do I need to update the java and go from there or do I need to do something more with the OTL file?

SweetTech

Post #12June 4, 2010, 2:30 AM UTC

Skip the OTL Fix.

Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "JDK 6 Update 20 (JDK or JRE)".
Click the "Download JRE" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.
If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

Go to Start > Control Panel > Add/Remove Programs
Remove ALL instances of Adobe Reader
Re-boot your computer as required.
Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Troyr30

Post #13June 4, 2010, 2:51 AM UTC

Results of screen317's Security Check version 0.99.4
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET Online Scanner v3
Webroot AntiVirus with Spy Sweeper
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 20
Adobe Flash Player 10.0.45.2
Adobe Reader 9.3
````````````````````````````````
Process Check:
objlist.exe by Laurent
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

SweetTech

Post #14June 4, 2010, 2:56 AM UTC

Hello,

If you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

NEXT:

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

NEXT:

Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

NEXT:

OTL Clean-Up
Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

NEXT:

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
- If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
  - NoScript - for blocking ads and other potential website attacks
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.

Troyr30

Post #15June 4, 2010, 3:22 AM UTC

Let me again say THANK YOU for all your patience and assistance. I certainly appreciate all your time. Do I need to remove all the programs I have installed from the add/remove list as they all seem to be in there? I am using Firefox and Webroot Antivirus/Antimalware. I already had no script, java blockers and several other programs loaded into Firefox, but I appreciate the information. I have downloaded some of the other programs you suggested and will continue to use them. When I hit the paypal button and donate, will the donation go to you and your time. If not, is there some way I can send it directly to you for all your assistance?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] PC infected w/ possible antispyware soft virus, also z0g7ya

✨ Ask AI

Ask AI