What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help needed

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
My computer is fine but sometimes when i want to enter msn messenger there would be a problem. is the exploit host a major problem? cause when i tried to troubleshoot my msn messenger there is an exclamation sign beside the host files and not a tick sign. Also i have problems entering an online game so i suspect that it might be a problem too. Will the worm post a threat to my computer if not removed?

Here is the OTL log

OTL logfile created on: 6/20/2010 7:58:28 PM - Run 2
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Tablet PC Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 440.00 Mb Available Physical Memory | 43.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.28 Gb Total Space | 11.82 Gb Free Space | 31.70% Space Free | Partition Type: NTFS
Drive D: | 37.24 Gb Total Space | 3.67 Gb Free Space | 9.86% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-32B7E84D0F
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
PRC - C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
PRC - D:\Program Files\Orbitdownloader\orbitdm.exe (Orbitdownloader.com)
PRC - D:\Program Files\Panasonic\VideoCam Suite 2\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe ()
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\bgsvcgen.exe (B.H.A Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\WINDOWS\system32\wisptis.exe (Microsoft Corporation)
PRC - C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\1XConfig.exe (Intel)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Fujitsu\updnavi\updnavi.exe (FUJITSU LIMITED)
PRC - C:\WINDOWS\system32\o2flash.exe ()
PRC - C:\Program Files\Fujitsu\Utils\FjMnuIco.exe ()
PRC - C:\Program Files\Fujitsu\Utils\FjEvents.exe (Fujitsu Computer Systems Corporation)
PRC - C:\Program Files\Fujitsu\Utils\FjDspMon.exe (Fujitsu PC Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\digtizer.exe (WACOM)
PRC - C:\Program Files\Apoint2K\Hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\system32\tabbtnu.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\Documents and Settings\Administrator\Local Settings\TempIadHide3.dll (BackWeb)
MOD - C:\Program Files\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.)
MOD - C:\Program Files\ScanSoft\OmniPageSE4\OpHookSE4.dll (Nuance Communications, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\xpsp2res.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\ime\SPTIP.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Microsoft Shared\Ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\MSCTFP.dll (Microsoft Corporation)
MOD - C:\WINDOWS\ime\SPGRMR.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Microsoft Shared\Ink\TipComponentsps.dll (Microsoft Corporation)
MOD - C:\Program Files\Windows Journal\nbmaptip.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (npggsvc) – File not found
SRV - (NipSvc) – File not found
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (bgsvcgen) – C:\WINDOWS\System32\bgsvcgen.exe (B.H.A Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (EvtEng) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (O2Flash) – C:\WINDOWS\system32\o2flash.exe ()
SRV - (Digitizer) – C:\WINDOWS\system32\digtizer.exe (WACOM)


========== Driver Services (SafeList) ==========

DRV - (GarenaPEngine) – C:\Documents and Settings\Administrator\Local Settings\Temp\PHT5D.tmp ()
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (Mkd2kfNt) – C:\WINDOWS\system32\drivers\Mkd2kfNT.sys (AhnLab, Inc.)
DRV - (btnetBUs) – C:\WINDOWS\system32\drivers\btnetBus.sys ()
DRV - (BtHidBus) – C:\WINDOWS\System32\Drivers\BtHidBus.sys (IVT Corporation.)
DRV - (Mkd2Nadr) – C:\WINDOWS\system32\drivers\Mkd2Nadr.sys (AhnLab, Inc.)
DRV - (IvtBtBUs) – C:\WINDOWS\system32\drivers\IvtBtBus.sys (IVT Corporation.)
DRV - (vaxscsi) – C:\WINDOWS\System32\Drivers\vaxscsi.sys (Alcohol Soft Co., Ltd.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (USBModem) – C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (UsbDiag) – C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (pccsmcfd) – C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (speedfan) – C:\WINDOWS\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (cdrbsdrv) – C:\WINDOWS\system32\drivers\cdrbsdrv.sys (B.H.A Corporation)
DRV - (EverestDriver) – C:\Documents and Settings\Administrator\My Documents\Downloads\New Folder (2)\kerneld.wnt ()
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (BlueletAudio) – C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation)
DRV - (Btcsrusb) – C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation)
DRV - (BTHidEnum) – C:\WINDOWS\system32\drivers\vbtenum.sys ()
DRV - (BTHidMgr) – C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation)
DRV - (BT) – C:\WINDOWS\system32\drivers\BtNetDrv.sys (IVT Corporation)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (VcommMgr) – C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (O2SDRDR) – C:\WINDOWS\system32\DRIVERS\o2sd.sys (O2 Micro )
DRV - (O2MDRDR) – C:\WINDOWS\system32\DRIVERS\o2media.sys (O2Micro )
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (tfsnudfa) – C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (sscdbhk5) – C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (O2SCBUS) – C:\WINDOWS\system32\drivers\ozscr.sys (O2Micro)
DRV - (VComm) – C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (IWCA) – C:\WINDOWS\system32\drivers\iwca.sys (Intel Corporation)
DRV - (BtnHnd) – C:\Program Files\Fujitsu\BtnHnd\BtnHnd.sys (FUJITSU LIMITED)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (hidpen) – C:\WINDOWS\system32\drivers\hidpen.sys (Wacom Co., Ltd)
DRV - (DX02) – C:\WINDOWS\system32\drivers\dx02.sys (Knowles Acoustics)
DRV - (FUJ02E3) – C:\WINDOWS\system32\drivers\fuj02e3.sys (FUJITSU LIMITED)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Fjbtndrv) – C:\WINDOWS\system32\drivers\FjBtndrv.sys (Fujitsu PC Corporation)
DRV - (LVVI500A) – C:\WINDOWS\system32\drivers\lvvi500a.sys (Logitech Inc.)
DRV - (LVBulk) – C:\WINDOWS\system32\drivers\LVBulk.sys (Logitech Inc.)
DRV - (lusbaudio) – C:\WINDOWS\system32\drivers\LVSound2.sys (Logitech Inc.)
DRV - (FUJ02E1) – C:\WINDOWS\system32\drivers\FUJ02E1.sys (Fujitsu Limited)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (FUJ02B1) – C:\WINDOWS\system32\drivers\fuj02b1.sys (FUJITSU LIMITED)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sg.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.live.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.live.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com/
IE - HKCU\..\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/03 18:52:18 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/03 18:53:37 | 000,000,000 | —D | M]

[2009/07/10 18:30:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/06/19 19:16:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions
[2009/11/05 18:22:07 | 000,000,000 | —D | M] (Freecorder Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2009/09/02 23:26:53 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/07 23:25:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions\[removed]
[2010/06/03 18:52:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c5l4hguv.default\extensions
[2009/07/10 18:18:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c5l4hguv.default\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
[2009/12/07 23:25:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c5l4hguv.default\extensions\[removed]
[2010/06/19 19:16:50 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/06/09 20:19:28 | 000,405,458 | R— | M]) - C:\WINDOWS\System32\Drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 14020 more lines…
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe File not found
O4 - HKLM..\Run: [FjDspMon] C:\Program Files\Fujitsu\Utils\FjDspMon.exe (Fujitsu PC Corporation)
O4 - HKLM..\Run: [FjEvents] C:\Program Files\Fujitsu\Utils\FjEvents.exe (Fujitsu Computer Systems Corporation)
O4 - HKLM..\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\updnavi\updnavi.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [Fujitsu Menu] C:\Program Files\Fujitsu\Utils\FjMnuIco.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Snippet] C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [TabletTip] C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TabletWizard] C:\WINDOWS\Help\splshwrp.exe (Microsoft Corporation)
O4 - HKCU..\Run: [LClock] C:\Program Files\LClock\LClock.exe File not found
O4 - HKCU..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe ()
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - HKCU..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe File not found
O4 - HKCU..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe File not found
O4 - HKCU..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Orbit.lnk = D:\Program Files\Orbitdownloader\orbitdm.exe (Orbitdownloader.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VideoCam Suite 2.0.lnk = D:\Program Files\Panasonic\VideoCam Suite 2\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMovingBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarsOnTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 4 = reg.exe (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 2 = zionle.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 3 = zion2wc.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 1 = zion-3-setup-wmirc.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O8 - Extra context menu item: &Download by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\IntelWireless: DllName - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\loginkey: DllName - C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll - C:\Program Files\Common Files\Microsoft Shared\Ink\LoginKey.dll (Microsoft Corporation)
O20 - Winlogon\Notify\TabBtnWL: DllName - TabBtnWL.dll - C:\WINDOWS\System32\tabbtnwl.dll (Microsoft Corporation)
O20 - Winlogon\Notify\tpgwlnotify: DllName - tpgwlnot.dll - C:\WINDOWS\System32\tpgwlnot.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - Unable to read "AutoRun" value or value not present!
O32 - AutoRun File - [2009/03/06 22:20:02 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2009/03/06 22:20:04 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/15 11:05:35 | 000,000,000 | —D | C] – C:\_OTL
[2010/06/11 21:59:22 | 000,572,416 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/06/11 21:47:37 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/06/11 21:46:53 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/06/11 17:49:51 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/10 20:42:18 | 000,000,000 | —D | C] – C:\Program Files\SpeedFan
[2010/06/09 19:54:46 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/06/09 19:54:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/06/09 19:47:58 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/06/09 09:30:40 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/09 09:30:38 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/09 09:30:38 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/08 00:21:09 | 000,000,000 | —D | C] – C:\Program Files\AhnLab
[2010/06/08 00:09:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Sunbelt
[2010/06/08 00:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sunbelt
[2010/06/07 23:16:19 | 000,000,000 | —D | C] – C:\Program Files\Sunbelt Software
[2010/06/07 21:05:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Threat Expert
[2010/06/05 17:51:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\VS Revo Group
[2010/06/05 17:51:09 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2010/06/05 17:50:55 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/06/05 15:10:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\IsolatedStorage
[2010/06/05 14:41:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PrevxCSI
[2010/06/04 21:56:08 | 000,164,048 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/04 21:56:08 | 000,019,024 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/04 21:56:07 | 000,046,672 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/04 21:56:07 | 000,023,376 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/04 21:56:05 | 000,100,432 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/04 21:56:05 | 000,094,800 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/04 21:56:04 | 000,028,880 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/04 21:53:08 | 000,165,032 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/06/04 21:53:08 | 000,038,848 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\avastSS.scr
[2010/06/04 21:52:29 | 000,000,000 | —D | C] – C:\Program Files\Alwil Software
[2010/06/04 21:52:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/06/04 19:21:19 | 000,221,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/06/04 18:47:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Runscanner.net
[2010/06/04 16:11:48 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/06/03 18:56:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\maple
[2010/06/02 10:04:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\AppData

========== Files - Modified Within 30 Days ==========

[2010/06/20 19:53:59 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{89A3D8AD-309F-4E52-B9B6-F594E1E07DA7}.job
[2010/06/20 19:51:09 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/20 19:51:03 | 000,000,540 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Orbit.lnk
[2010/06/20 19:50:37 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/20 17:06:43 | 012,582,912 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/06/20 17:06:19 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/06/20 17:05:18 | 002,110,612 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/06/20 17:04:51 | 000,098,816 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/20 16:49:10 | 000,001,010 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-529166198-2231506752-346657940-500UA.job
[2010/06/19 22:49:07 | 000,000,958 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-529166198-2231506752-346657940-500Core.job
[2010/06/19 19:04:21 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/18 16:51:00 | 000,003,319 | —- | M] () – C:\WINDOWS\System32\msexcr.ini
[2010/06/14 21:07:16 | 000,006,341 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\kjkk.CLP
[2010/06/14 20:54:28 | 000,006,461 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\dsd.CLP
[2010/06/14 20:53:53 | 000,001,397 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\clipbrd.exe.lnk
[2010/06/13 22:50:00 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/06/11 21:59:25 | 000,572,416 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/06/11 21:48:56 | 000,000,020 | —- | M] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/06/11 21:46:54 | 000,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/06/11 21:46:54 | 000,000,592 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/06/11 21:31:41 | 000,294,864 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/11 19:31:08 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/06/11 19:16:40 | 000,502,798 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/11 19:16:40 | 000,442,618 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/11 19:16:40 | 000,071,162 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/10 20:42:19 | 000,000,682 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\SpeedFan.lnk
[2010/06/10 20:42:18 | 000,000,045 | —- | M] () – C:\WINDOWS\System32\initdebug.nfo
[2010/06/10 20:42:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\initdebug.nfo
[2010/06/10 10:21:57 | 000,122,765 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture2123.jpg
[2010/06/10 10:19:32 | 000,102,585 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture122.jpg
[2010/06/10 00:54:20 | 000,002,344 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/06/09 21:26:22 | 000,000,408 | —- | M] () – C:\WINDOWS\wininit.ini
[2010/06/09 20:19:28 | 000,405,458 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/06/09 19:54:58 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2010/06/09 09:30:43 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/07 22:43:13 | 000,000,481 | —- | M] () – C:\Documents and Settings\All Users\Desktop\MapleStory.lnk
[2010/06/07 21:44:47 | 000,054,537 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\me.jpg
[2010/06/07 20:42:52 | 000,458,365 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture14.jpg
[2010/06/07 20:42:43 | 000,444,707 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture23.jpg
[2010/06/05 17:51:11 | 000,000,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2010/06/05 15:14:27 | 000,337,249 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture3.jpg
[2010/06/05 15:14:17 | 000,372,491 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture2.jpg
[2010/06/04 21:56:10 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/06/04 21:56:06 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/06/04 19:16:53 | 000,081,168 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/04 18:44:28 | 000,011,108 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\To.docx
[2010/06/04 18:44:19 | 000,000,452 | RHS- | M] () – C:\Documents and Settings\Administrator\ntuser.pol
[2010/06/03 22:59:43 | 000,000,241 | —- | M] () – C:\WINDOWS\QSync.INI
[2010/05/30 13:08:34 | 000,010,502 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Our system operates by relays.docx
[2010/05/23 20:35:21 | 000,010,101 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\websites for gpp.docx

========== Files Created - No Company Name ==========

[2010/06/17 14:55:09 | 000,003,319 | —- | C] () – C:\WINDOWS\System32\msexcr.ini
[2010/06/14 21:07:16 | 000,006,341 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\kjkk.CLP
[2010/06/14 20:54:28 | 000,006,461 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\dsd.CLP
[2010/06/14 20:53:28 | 000,001,397 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\clipbrd.exe.lnk
[2010/06/11 22:17:56 | 000,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\gmer.exe
[2010/06/11 21:48:26 | 000,000,648 | —- | C] () – C:\Documents and Settings\Administrator\defogger_disable.log
[2010/06/11 21:48:26 | 000,000,020 | —- | C] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/06/11 21:46:54 | 000,000,611 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/06/11 21:46:54 | 000,000,592 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/06/10 20:42:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\SpeedFan.lnk
[2010/06/10 20:42:18 | 000,000,045 | —- | C] () – C:\WINDOWS\System32\initdebug.nfo
[2010/06/10 20:42:18 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\initdebug.nfo
[2010/06/10 10:21:57 | 000,122,765 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture2123.jpg
[2010/06/10 10:19:32 | 000,102,585 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture122.jpg
[2010/06/09 19:54:58 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2010/06/09 12:01:40 | 000,011,042 | —- | C] () – C:\Documents and Settings\Administrator\FixQhost.log
[2010/06/09 09:30:43 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/07 22:43:13 | 000,000,481 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapleStory.lnk
[2010/06/07 21:44:46 | 000,054,537 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\me.jpg
[2010/06/07 20:42:51 | 000,458,365 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture14.jpg
[2010/06/07 20:42:43 | 000,444,707 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture23.jpg
[2010/06/05 17:51:11 | 000,000,821 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2010/06/05 15:14:27 | 000,337,249 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture3.jpg
[2010/06/05 15:14:16 | 000,372,491 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture2.jpg
[2010/06/04 21:56:10 | 000,001,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/06/04 18:44:27 | 000,011,108 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\To.docx
[2010/05/23 20:35:19 | 000,010,101 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\websites for gpp.docx
[2010/05/22 05:44:18 | 000,010,502 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Our system operates by relays.docx
[2010/03/15 21:10:10 | 000,013,304 | —- | C] () – C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2009/02/28 23:04:55 | 000,000,412 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2009/02/28 22:58:45 | 000,003,584 | —- | C] () – C:\WINDOWS\System32\CNCFLcNL.DLL
[2009/02/27 19:10:37 | 000,011,860 | —- | C] () – C:\WINDOWS\System32\drivers\vbtenum.sys
[2008/12/31 21:52:38 | 000,000,050 | —- | C] () – C:\WINDOWS\MegaManager.INI
[2008/12/07 12:44:54 | 000,022,528 | —- | C] () – C:\WINDOWS\System32\drivers\btnetBus.sys
[2008/12/02 14:25:10 | 000,000,241 | —- | C] () – C:\WINDOWS\QSync.INI
[2008/12/02 14:24:03 | 000,294,912 | —- | C] () – C:\WINDOWS\System32\liplW7.dll
[2008/12/02 14:24:02 | 000,290,816 | —- | C] () – C:\WINDOWS\System32\liplA6.dll
[2008/12/02 14:24:02 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\liplPX.dll
[2008/12/02 14:24:02 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\liplP6.dll
[2008/12/02 14:24:02 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\liplM6.dll
[2008/12/02 14:24:02 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\lipl.dll
[2008/12/02 14:24:02 | 000,005,187 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/12/02 14:23:59 | 000,000,816 | —- | C] () – C:\WINDOWS\_delis32.ini
[2008/12/01 23:29:02 | 000,009,728 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2008/11/15 22:42:13 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/10/24 00:24:59 | 000,000,004 | —- | C] () – C:\WINDOWS\System32\XPerWin.dll
[2008/10/24 00:24:56 | 000,000,037 | —- | C] () – C:\WINDOWS\System32\xsystem.dll
[2006/03/01 07:00:33 | 000,116,224 | —- | C] () – C:\WINDOWS\System32\pdfcmnnt.dll
[2005/08/09 21:31:51 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/08/07 04:20:10 | 000,000,408 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/08/07 04:15:13 | 000,000,694 | —- | C] () – C:\WINDOWS\System32\FJSaver.ini
[2005/08/07 03:52:03 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\RMDevice.dll
[2005/05/31 07:49:12 | 000,000,720 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/03/04 07:50:16 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/01/04 06:53:04 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2005/01/04 06:53:04 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/08/12 22:44:10 | 000,016,384 | —- | C] () – C:\WINDOWS\System32\iwca.dll
[2003/04/11 06:04:00 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[1996/04/04 03:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2009/05/01 23:46:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\aAvgApi
[2006/03/01 07:24:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Alias
[2009/02/28 23:31:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Canon
[2008/12/01 17:04:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools
[2008/12/02 00:26:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2008/11/12 11:24:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DMCache
[2010/06/06 14:06:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DNA
[2010/06/03 18:58:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FrostWire
[2009/06/30 22:54:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GameRanger
[2008/08/19 19:48:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GrabPro
[2008/10/21 17:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\gunz-mrb
[2006/03/01 07:00:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\HeuPrinter
[2008/10/30 22:08:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IDM
[2010/04/10 18:27:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2009/09/05 21:08:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\LG Electronics
[2008/12/31 21:44:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Megaupload
[2010/04/10 19:06:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\muvee Technologies
[2008/08/19 20:36:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Nexon
[2009/08/01 00:14:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\OpenOffice.org
[2010/06/20 19:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Orbit
[2010/04/04 15:42:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Panasonic
[2009/02/28 23:04:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ScanSoft
[2008/12/30 23:30:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Styler
[2008/12/01 16:53:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
[2008/12/30 16:42:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\vghd
[2009/08/03 21:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alias
[2010/06/04 21:52:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/02/28 22:59:32 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/09/05 18:11:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2010/03/09 20:59:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2010/04/10 18:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2010/04/04 15:12:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panasonic
[2010/06/06 15:59:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PrevxCSI
[2009/02/28 23:04:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/04/10 18:34:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2010/06/12 13:54:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/13 22:50:00 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/06/20 19:53:59 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{89A3D8AD-309F-4E52-B9B6-F594E1E07DA7}.job

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2010/05/04 21:57:15 | 000,000,000 | —D | M](C:\Program Files\????????????) – C:\Program Files\韩国语生活中应急的一句话
(C:\Program Files\????????????) – C:\Program Files\韩国语生活中应急的一句话
< End of report >
Post #17
Hi,

Every computer infection poses a threat if not removed.

when i tried to troubleshoot my msn messenger there is an exclamation sign beside the host files and not a tick sign

Am sorry I don't use MSN. Can you attach a picture of it?

Can you tell me the contents of this folder? -> C:\Program Files\韩国语生活中应急的一句话

The folder's name is in Unicode.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :dir
C:\Program Files\韩国语生活中应急的一句话
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #18
I installed this program from a disc . It teaches how to speak in korean. I could not get the messenger pic because sometimes there would be this problem and i could not go in but sometimes it would be fine. And i realised that my external hard drive contains this recycler folder and inside contains some hidden files (translucent icons) and they have the same S 1- something code as the picture i uploaded on my first post . i think my com might have infected my hard disk too. but i dont really know what this worms do but the source seems to be the same which is megaupload i guess? SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 16:01 on 22/06/2010 by Administrator (Administrator - Elevation successful) ========== dir ========== C:\Program Files\韩国语生活中应急的一句话 - Parameters: "(none)" —Files— tmp.wav –a— 23642112 bytes [15:58 23/03/2009] [16:00 23/03/2009] —Folders— Record d—– [15:58 23/03/2009] -=End Of File=-
Post #19
Hi,

There are many ways a computer can get infected. One of them is through downloads.

Please do the following:

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
IE - HKCU\..\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost
O3 - HKLM\..\Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - No CLSID value found.
O32 - AutoRun File - [2009/03/06 22:20:02 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2009/03/06 22:20:04 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ FAT32 ]

:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
  • Then click the Run Fix button at the top.
  • Let the program run unhindered, reboot when it is done.
  • Then post the result.
–Next–

Let's run another MBAM scan but this time we'll run it full scan.
  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • Be sure to check all the drives in your computer including the external hard drive.
  • Click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


–Next–

Fresh OTL log:
  • Open OTL.exe.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • There will only be a single log produced. OTL.Txt.
    Note:This log can be located in the OTL. folder on you C:\ drive if it fails to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.
To post in your next reply:
1. OTL logs.
2. Malwarebytes' log.
3. How is your computer?
Post #21
OTL log Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot… __________________________________ Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4238 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 6/26/2010 1:05:04 AM mbam-log-2010-06-26 (01-05-04).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 204403 Time elapsed: 1 hour(s), 19 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #22
Hi,

Please do the following:

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
–Next–
  • Open OTL.exe.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • There will only be a single log produced. OTL.Txt.
    Note:This log can be located in the OTL. folder on you C:\ drive if it fails to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.
To post in your next reply:
1. Kaspersky log.
2. OTL log.
3. How is your computer?
Post #23
Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 48 hours.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI