Spyware / Malware / Virus Removal

my computer folders start everytime i boot up

17 min read

Looking for the outcome? Ask AI

brian_723 Topic Starter

Post #1June 16, 2010, 6:43 PM UTC

I have reset my host files scanned my machine with malware bytes and I have no infection at preent although i id before but i am sick of my computer folder starting all the time advice please .

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:42:58, on 16/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wbsecsvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\slrundll.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/aolbroadband
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myaolbroadband.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.aol.co.uk/web?isinit=true&query=%s
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AOL Broadband Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol broadband toolbar 5.0\resources\en-GB\local\search.html
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1247340977328
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: avgrsstarter - Invalid registry found
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: wbsecsvc - Integrated System Solution Corp. - C:\WINDOWS\system32\wbsecsvc.exe

–
End of file - 10757 bytes

edruss

Post #2June 18, 2010, 5:39 PM UTC

Hello there, brian_723

I'm edruss, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait.

brian_723

Post #3June 18, 2010, 11:11 PM UTC

thanks for taking the time to help me .

edruss

Post #4June 20, 2010, 2:02 AM UTC

I need you to do the following steps.
I recommend you print this out so you will be able to refer to it because you will have to close your browser and you will be in Safe Mode.

We need to make sure all hidden files are showing so please:

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Run HIJACKTHIS, press SCAN and put a CHECK to the following lines.

R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - (no file)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

Then CLOSE all other windows including this and press FIX CHECKED

After that you need to REBOOT into safe mode. It Is important that you do so or the fix may not work.
To reboot into Safe Mode:

Restart the computer.
as soon as BIOS is loaded ,after the beeps,begin tapping the F8 key until the Advanced Options menu appears.
Use the arrow keys to select the Safe mode menu item
press Enter.

Click on the Start button
Click My Computer.
Double click on Local Disk (C:)
Scroll down to Windows and double click on it.
Scroll down to System32 and double click on it.
Scroll down unti you find CTFMON.EXE and Right click it.
Choose Delete from the pop-up menu.

After that REBOOT and rescan with hijackthis.

Next step:

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Next step:

Download This EXE file. Save it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click the randomly named EXE file. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
Click the Save… button, and save the log as GMER-1.log
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
Click on the Save… button again, and save it this time as "GMER-2.log"

If for some reason the program hangs during the second scan, post me the contents of the first log. If it doesn't hang, then just post me the contents of the second log.

Note: Use Notepad to open the logs so you can copy them in here.

If GMER will not run in normal windows, please run it in Safe Mode

Please post the new HijackThis log, the OTL log, and the GMER log.

edruss

brian_723

Post #5June 20, 2010, 12:08 PM UTC

thanks for al that I will post what i have done so far ,

I di first part no probs

I then ran high jack this and ran the fix ,although 3 line were not on there .the first 2 and line ten but i marked what was there .Now here is where I may of gone wrong .I restarted my computer but as i have dual boot with unbunto so pressing f8 did not work so it booted in normal mode .So I went on net to find how to boot in safe mode and then restated in safe mode ,hope this was okay .

after botting in safe mode i went to delete ctfmon.exe but could only find ctmon so I deleted it anyway ,but still have it in recycle bin if this was wrong .
here is the rescan after rebooting again .

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:02:00, on 20/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wbsecsvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/aolbroadband
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myaolbroadband.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.aol.co.uk/web?isinit=true&query=%s
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AOL Broadband Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol broadband toolbar 5.0\resources\en-GB\local\search.html
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1247340977328
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: avgrsstarter - Invalid registry found
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: wbsecsvc - Integrated System Solution Corp. - C:\WINDOWS\system32\wbsecsvc.exe

–
End of file - 9400 bytes

will continue next post because big files .

brian_723

Post #6June 20, 2010, 12:10 PM UTC

OTL logfile created on: 20/06/2010 11:08:29 - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 146.55 Gb Total Space | 54.10 Gb Free Space | 36.92% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-50C5ECAA5B
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\ThreatFire\TFService.exe (PC Tools)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wbsecsvc.exe (Integrated System Solution Corp.)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
MOD - C:\Program Files\ThreatFire\TFWAH.dll (PC Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (NMIndexingService) – File not found
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (ThreatFire) – C:\Program Files\ThreatFire\TFService.exe (PC Tools)
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (wbsecsvc) – C:\WINDOWS\System32\wbsecsvc.exe (Integrated System Solution Corp.)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)

========== Driver Services (SafeList) ==========

DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (TfSysMon) – C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) – C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) – C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (klbg) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSGbeXP) – C:\WINDOWS\system32\drivers\SiSGbeXP.sys (Silicon Integrated Systems Corp.)
DRV - (W35UND) – C:\WINDOWS\system32\drivers\W35UND.SYS (Integrated System Solution Corp.)
DRV - (wbsecdrv) – C:\WINDOWS\system32\drivers\wbsecdrv.sys (Winbond)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (wanusb) – C:\WINDOWS\system32\drivers\gwausb.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myaolbroadband.co.uk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/aolbroadband
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.17
FF - prefs.js..extensions.enabledItems: [removed]:1.6.3
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:3.0.0.65223
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:3.0.4
FF - prefs.js..extensions.enabledItems: [removed]:4.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.736
FF - prefs.js..extensions.enabledItems: [removed]:0.9948
FF - prefs.js..extensions.enabledItems: [removed]:1.5.1.20090806
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.1
FF - prefs.js..extensions.enabledItems: [removed]:0.9
FF - prefs.js..extensions.enabledItems: [removed]:3.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.2.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: ""

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/13 18:46:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/23 13:43:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010/01/12 21:31:55 | 000,000,000 | —D | M]

[2009/06/27 02:55:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/06/27 02:55:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2010/05/03 15:31:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions
[2009/10/03 15:45:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/04 19:19:49 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009/12/29 21:25:49 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009/10/13 16:30:48 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2009/12/04 19:19:56 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2009/12/04 19:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/10/24 12:23:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/01/17 00:49:40 | 000,002,255 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\searchplugins\askcom.xml
[2010/05/16 11:45:48 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/01/12 21:33:20 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2009/07/17 09:40:12 | 000,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll

Hosts file not found
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O8 - Extra context menu item: &AOL; Toolbar Search - c:\Program Files\AOL\AOL Broadband Toolbar 5.0\resources\en-GB\local\search.html ()
O8 - Extra context menu item: &ieSpell; Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling; - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: &Virtual; keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: URLs c&heck; - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1247340977328 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (") - File not found
O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2009/06/13 01:23:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/20 10:03:09 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2010/06/20 10:01:58 | 000,589,824 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hpost_d02c.dll
[2010/06/20 10:01:57 | 000,712,704 | —- | C] (Hewlett-Packard) – C:\WINDOWS\System32\hposwia_d02c.dll
[2010/06/20 10:01:57 | 000,315,392 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hposc_d02a.dll
[2010/06/20 09:51:53 | 000,372,736 | R— | C] (Hewlett-Packard) – C:\WINDOWS\System32\hppldcoi.dll
[2010/06/20 09:51:53 | 000,309,760 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\difxapi.dll
[2010/06/18 18:27:17 | 000,050,968 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgfwdx.dll
[2010/06/18 18:27:17 | 000,030,104 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgfwdx.sys
[2010/06/18 18:24:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/06/14 19:59:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Google Chrome Backup
[2010/06/13 12:11:45 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/06/12 13:32:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\filterfiles
[2010/06/12 13:24:32 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/06/09 16:31:40 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/05/30 22:28:41 | 000,000,000 | —D | C] – C:\WINDOWS\XSxS
[2010/05/30 22:28:41 | 000,000,000 | —D | C] – C:\Program Files\Xenocode
[2010/05/29 16:28:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\gambia
[2010/05/24 23:08:20 | 000,289,144 | —- | C] (S!Ri) – C:\WINDOWS\System32\VCCLSID.exe
[2010/05/24 23:08:20 | 000,288,417 | —- | C] (S!Ri) – C:\WINDOWS\System32\SrchSTS.exe
[2010/05/24 23:08:20 | 000,135,168 | —- | C] (SteelWerX) – C:\WINDOWS\System32\swreg.exe
[2010/05/24 23:08:20 | 000,087,552 | —- | C] (S!Ri.URZ) – C:\WINDOWS\System32\VACFix.exe
[2010/05/24 23:08:20 | 000,082,944 | —- | C] (S!Ri.URZ) – C:\WINDOWS\System32\IEDFix.exe
[2010/05/24 23:08:20 | 000,082,944 | —- | C] (S!Ri.URZ) – C:\WINDOWS\System32\IEDFix.C.exe
[2010/05/24 23:08:20 | 000,082,432 | —- | C] (S!Ri.URZ) – C:\WINDOWS\System32\404Fix.exe
[2010/05/24 23:08:20 | 000,080,384 | —- | C] (S!Ri.URZ) – C:\WINDOWS\System32\o4Patch.exe
[2010/05/24 23:08:20 | 000,079,360 | —- | C] (SteelWerX) – C:\WINDOWS\System32\swxcacls.exe
[2010/05/24 23:08:20 | 000,078,336 | —- | C] (S!Ri.URZ) – C:\WINDOWS\System32\Agent.OMZ.Fix.exe
[2010/05/24 23:08:19 | 000,053,248 | —- | C] (http://www.beyondlogic.org) – C:\WINDOWS\System32\Process.exe
[2010/05/23 13:38:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/05/23 12:03:15 | 000,000,000 | —D | C] – C:\Program Files\CodeStuff
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/20 11:02:01 | 000,009,401 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\hijackthis sunday
[2010/06/20 11:00:02 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
[2010/06/20 10:59:02 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2010/06/20 10:56:55 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/20 10:56:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/20 10:56:04 | 007,077,888 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/06/20 10:56:04 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/06/20 10:56:01 | 009,520,656 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/06/20 10:05:44 | 000,137,724 | —- | M] () – C:\WINDOWS\hpoins44.dat
[2010/06/20 09:49:04 | 000,001,008 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500UA.job
[2010/06/19 20:49:06 | 000,000,956 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500Core.job
[2010/06/19 19:51:11 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/18 18:27:17 | 000,050,968 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgfwdx.dll
[2010/06/18 18:27:17 | 000,030,104 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgfwdx.sys
[2010/06/16 21:10:22 | 000,071,680 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/15 23:01:22 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/14 19:58:59 | 000,070,400 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/14 16:23:49 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/13 13:00:49 | 000,000,104 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2010/06/13 12:18:53 | 000,256,702 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ScreenHunter_01 Jun. 13 12.18.jpg
[2010/06/13 00:18:36 | 000,010,518 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100613_001822.reg
[2010/06/12 23:57:47 | 000,000,290 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235742.reg
[2010/06/12 23:56:36 | 000,037,462 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235628.reg
[2010/06/12 23:37:27 | 000,270,192 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/12 22:34:47 | 000,000,648 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/12 22:34:47 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/12 22:34:47 | 000,000,209 | -HS- | M] () – C:\boot.ini
[2010/06/12 13:32:26 | 000,003,240 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\settings.ini
[2010/06/12 13:32:26 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\proxy.ini
[2010/06/12 13:32:02 | 000,003,225 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\engines.ini
[2010/06/12 13:22:03 | 000,048,232 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_132156.reg
[2010/06/09 22:59:30 | 000,506,500 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/09 22:59:30 | 000,444,690 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/09 22:59:30 | 000,072,456 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/09 21:50:10 | 000,002,344 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/06/02 13:00:50 | 000,056,811 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Wild.Child[2008]DvDrip-aXXo.4555035.TPB.torrent
[2010/05/31 11:29:35 | 018,499,623 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.0.5-win32.exe
[2010/05/29 18:39:54 | 000,000,196 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183943.reg
[2010/05/29 18:38:55 | 000,030,296 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183839.reg
[2010/05/26 20:24:45 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.bak
[2010/05/24 23:16:00 | 005,759,051 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.old
[2010/05/24 23:11:39 | 000,001,468 | —- | M] () – C:\WINDOWS\System32\tmp.reg
[2010/05/24 22:42:00 | 000,401,074 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100524_224139.reg
[2010/05/24 22:39:27 | 000,001,548 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk
[2010/05/23 13:40:10 | 000,001,604 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/05/23 08:52:59 | 000,204,334 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ScreenHunter_01 May. 23 08.52.jpg
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/20 11:02:00 | 000,009,401 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\hijackthis sunday
[2010/06/20 09:57:48 | 000,137,724 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/06/20 09:57:48 | 000,000,512 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2010/06/13 13:00:49 | 000,000,104 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2010/06/13 12:18:53 | 000,256,702 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ScreenHunter_01 Jun. 13 12.18.jpg
[2010/06/13 12:11:46 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2010/06/13 00:18:29 | 000,010,518 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100613_001822.reg
[2010/06/12 23:57:44 | 000,000,290 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235742.reg
[2010/06/12 23:56:30 | 000,037,462 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235628.reg
[2010/06/12 13:32:26 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\proxy.ini
[2010/06/12 13:32:02 | 000,003,225 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\engines.ini
[2010/06/12 13:22:00 | 000,048,232 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_132156.reg
[2010/06/02 13:00:49 | 000,056,811 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Wild.Child[2008]DvDrip-aXXo.4555035.TPB.torrent
[2010/05/29 18:39:46 | 000,000,196 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183943.reg
[2010/05/29 18:38:50 | 000,030,296 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183839.reg
[2010/05/24 23:11:39 | 000,001,468 | —- | C] () – C:\WINDOWS\System32\tmp.reg
[2010/05/24 23:08:20 | 000,075,776 | —- | C] () – C:\WINDOWS\System32\WS2Fix.exe
[2010/05/24 23:08:20 | 000,051,200 | —- | C] () – C:\WINDOWS\System32\dumphive.exe
[2010/05/24 23:08:20 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\swsc.exe
[2010/05/24 22:41:43 | 000,401,074 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100524_224139.reg
[2010/05/24 22:39:27 | 000,001,548 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk
[2010/05/23 13:40:09 | 000,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/05/23 08:52:59 | 000,204,334 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ScreenHunter_01 May. 23 08.52.jpg
[2010/04/09 16:40:55 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2009/10/24 23:52:51 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2009/10/24 16:55:29 | 000,717,296 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2009/07/18 04:57:03 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/06/22 00:35:14 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/06/20 00:31:19 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/06/20 00:31:18 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/06/20 00:31:16 | 000,881,664 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/06/20 00:31:16 | 000,205,824 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/06/20 00:31:15 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/06/20 00:31:13 | 000,085,504 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/06/20 00:31:13 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/06/16 12:34:11 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\CoInst.dll
[2009/06/16 12:34:10 | 000,016,908 | —- | C] () – C:\WINDOWS\wwdslcfg.ini
[2009/06/15 07:58:23 | 000,092,985 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2009/06/15 07:57:32 | 000,128,191 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2009/06/15 07:51:27 | 000,016,960 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2009/06/15 07:51:05 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/06/15 07:51:02 | 000,016,922 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2009/06/15 07:50:55 | 000,010,288 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/09/17 23:55:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/17 23:55:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/09/17 23:55:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/09/17 23:55:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/09/17 23:55:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005/08/05 14:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll

========== LOP Check ==========

[2010/04/07 22:07:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\acccore
[2009/08/23 22:26:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Camfrog
[2009/12/29 20:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\CheckPoint
[2010/02/28 00:38:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GetRightToGo
[2009/12/31 20:40:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GrabPro
[2009/07/25 22:18:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ieSpell
[2009/12/31 20:55:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ImgBurn
[2010/01/21 22:50:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\InfraRecorder
[2009/10/02 18:53:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/01/01 13:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Launchy
[2009/06/20 02:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\MSNInstaller
[2009/07/01 01:46:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\NotMyIp
[2009/06/18 00:47:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/01/10 16:33:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Orbit
[2009/12/30 02:21:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TigerPlayer
[2010/06/19 19:31:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2010/06/18 18:30:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/03/25 18:26:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Bluetooth
[2009/07/31 18:33:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Cached Installations
[2009/10/03 23:31:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GrabJPG
[2009/12/30 17:39:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hagel Technologies
[2010/01/13 17:23:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2009/07/02 00:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/07/31 18:33:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2009/11/01 17:31:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/07 22:03:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/06/20 11:00:02 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
[2010/02/14 19:30:21 | 000,000,448 | —- | M] () – C:\WINDOWS\Tasks\Wise Disk Cleaner 4.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A2947BEA
< End of report >

OTL Extras logfile created on: 20/06/2010 11:08:29 - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 146.55 Gb Total Space | 54.10 Gb Free Space | 36.92% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-50C5ECAA5B
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"24884:TCP" = 24884:TCP:*:Enabled:BitComet 24884 TCP
"24884:UDP" = 24884:UDP:*:Enabled:BitComet 24884 UDP
"20482:TCP" = 20482:TCP:*:Enabled:BitComet 20482 TCP
"20482:UDP" = 20482:UDP:*:Enabled:BitComet 20482 UDP
"9067:TCP" = 9067:TCP:*:Enabled:BitComet 9067 TCP(ED2K)
"9067:UDP" = 9067:UDP:*:Enabled:BitComet 9067 UDP(ED2K)
"9751:TCP" = 9751:TCP:*:Enabled:BitComet 9751 TCP(ED2K)
"9751:UDP" = 9751:UDP:*:Enabled:BitComet 9751 UDP(ED2K)
"7043:TCP" = 7043:TCP:*:Enabled:BitComet 7043 TCP
"7043:UDP" = 7043:UDP:*:Enabled:BitComet 7043 UDP
"10255:TCP" = 10255:TCP:*:Enabled:BitComet 10255 TCP
"10255:UDP" = 10255:UDP:*:Enabled:BitComet 10255 UDP
"8343:TCP" = 8343:TCP:*:Enabled:BitComet 8343 TCP
"8343:UDP" = 8343:UDP:*:Enabled:BitComet 8343 UDP
"7175:TCP" = 7175:TCP:*:Enabled:BitComet 7175 TCP
"7175:UDP" = 7175:UDP:*:Enabled:BitComet 7175 UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – File not found
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe – File not found
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe – File not found
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – File not found
"C:\WINDOWS\system32\wmisftc.exe" = C:\WINDOWS\system32\wmisftc.exe:*:Enabled:UPnP Firewall – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire – File not found
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – File not found
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player – ()
"C:\Documents and Settings\Administrator\Desktop\Charon.exe" = C:\Documents and Settings\Administrator\Desktop\Charon.exe:*:Enabled:Charon - A proxy checking / scanning program. – ()
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – File not found
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe – File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe – File not found
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe – File not found
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – File not found
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil – File not found
"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialler – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL Connectivity Services – (AOL LLC)
"C:\Program Files\Common Files\AOL\1270674119\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1270674119\ee\aolsoftware.exe:*:Enabled:AOL Shared Components – (AOL LLC)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (America Online, Inc.)
"C:\Program Files\Common Files\AOL\1270674119\ee\AOLDesktop.exe" = C:\Program Files\Common Files\AOL\1270674119\ee\AOLDesktop.exe:*:Enabled:AOL Desktop – (AOL LLC)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard Co.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1A0D2EFC-C4FC-446A-8BC3-57A54CE5EADD}" = Opera 10.53
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.4
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 15
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{5546F4E9-B0F4-4F54-B949-2AB006C9284F}" = DJ_AIO_06_F2400_SW_Min
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{819CA3BC-2FF8-4811-B42F-421F7BFD3559}" = HP Deskjet F2400 All-in-One Driver 14.0 Rel. 6
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software 1.10.13.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"3554AA4B-9B0B-451a-A269-2B5F53982209_is1" = ThreatFire
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Broadband Toolbar" = AOL Broadband Toolbar 5.0
"AOL Regclient" = AOL Registration
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"BT Voyager 105 ADSL Modem" = BT Voyager 105 ADSL Modem
"CCleaner" = CCleaner
"GrabJPG" = GrabJPG
"HijackThis" = HijackThis 2.0.2
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"ImgBurn" = ImgBurn
"InfraRecorder" = InfraRecorder
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"ISSC WLAN" = ISSC WLAN
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"MSNINST" = MSN
"NVIDIA Drivers" = NVIDIA Drivers
"Photo Gadget_is1" = Photo Gadget
"Picasa 3" = Picasa 3
"PROR" = Microsoft Office Professional 2007 Trial
"SiS VGA Driver" = SiS VGA Utilities
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.0.3
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Wisdom-soft ScreenHunter 5.1 Free" = Wisdom-soft ScreenHunter 5.1 Free

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20/06/2010 05:33:59 | Computer Name = USER-50C5ECAA5B | Source = COM+ | ID = 135761
Description = The run-time environment has detected an inconsistency in its internal
state. This indicates a potential instability in the process that could be caused
by the custom components running in the COM+ application, the components they make
use of, or other factors. Error in f:\xpsp3\com\com1x\src\comsvcs\package\cpackage.cpp(1184),
hr = 8007041d: InitEventCollector fail

[ System Events ]
Error - 24/05/2010 15:25:50 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 24/05/2010 15:27:48 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the HTTP SSL service to connect.

Error - 24/05/2010 15:27:50 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7000
Description = The HTTP SSL service failed to start due to the following error: %%1053

Error - 24/05/2010 15:28:32 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the HTTP SSL service to connect.

Error - 24/05/2010 15:28:34 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7000
Description = The HTTP SSL service failed to start due to the following error: %%1053

Error - 29/05/2010 15:47:31 | Computer Name = USER-50C5ECAA5B | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 07/06/2010 11:23:26 | Computer Name = USER-50C5ECAA5B | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service COMSysApp with
arguments "" in order to run the server: {ECABAFBC-7F19-11D2-978E-0000F8757E2A}

Error - 07/06/2010 11:23:26 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the COM+ System Application
service to connect.

Error - 07/06/2010 11:23:26 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7000
Description = The COM+ System Application service failed to start due to the following
error: %%1053

Error - 09/06/2010 11:22:07 | Computer Name = USER-50C5ECAA5B | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.2 for the Network Card with network
address 00248CBC01C9 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

< End of report >

brian_723

Post #7June 20, 2010, 12:15 PM UTC last edited June 20, 2010, 2:02 PM UTC

this last part i had problem with. I ran two scans with gmer but both times got a blue screen .it had been scanning for a while on both occasions ,will running in safe mode fix this .

anyway i shall go and run in safe mode and give it a try and post here .

thanks for all your help hope i am not messing up too much .

okay i forget to mention also my computer folder is still opening on startup .

I have some of the gmer log from safe mode but i ahd to stop it as it was taking over an hour and I had to do somthing important online .

I just hit scan is it suppose to take this long as you mentioned do do full scan ,but i never got an option ,any way here is the result of the incomplete scan for now .I shall rescan if you tell me I need to also .

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-20 14:52:08
Windows 5.1.2600 Service Pack 3
Running: rer9t22i.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kfeoqaow.sys

—- System - GMER 1.0.15 —-

SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwCreateKey [0xF7A31A1C]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwDeleteKey [0xF7A31C10]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwDeleteValueKey [0xF7A31CB6]
SSDT spos.sys ZwEnumerateKey [0xF74F5CA2]
SSDT spos.sys ZwEnumerateValueKey [0xF74F6030]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwOpenKey [0xF7A3190C]
SSDT spos.sys ZwQueryKey [0xF74F6108]
SSDT spos.sys ZwQueryValueKey [0xF74F5F88]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwSetValueKey [0xF7A31E52]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwTerminateProcess [0xF7A33B30]

INT 0x62 ? 8A655BF8
INT 0x63 ? 8A460BF8
INT 0x83 ? 8A655BF8
INT 0xA4 ? 8A460BF8
INT 0xB4 ? 8A460BF8

—- Kernel code sections - GMER 1.0.15 —-

? spos.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload BA5D58AC 5 Bytes JMP 8A4601D8

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 8A5E82D8
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F7508C4C] spos.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7508CA0] spos.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F74D8040] spos.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F74D813C] spos.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F74D80BE] spos.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F74D87FC] spos.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F74D86D2] spos.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F74E8048] spos.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 8A4602D8

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A5E41F8

AttachedDevice \FileSystem\Ntfs \Ntfs TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)

Device \FileSystem\Fastfat \FatCdrom 8A2F5500
Device \Driver\usbohci \Device\USBPDO-0 8A45F1F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A5E61F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A5E61F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A5E61F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A5E61F8
Device \Driver\usbehci \Device\USBPDO-1 8A4481F8
Device \Driver\usbohci \Device\USBPDO-2 8A45F1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A6561F8
Device \Driver\Cdrom \Device\CdRom0 8A5E51F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A6561F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort2 [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F7978B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A6561F8
Device \Driver\usbohci \Device\USBFDO-0 8A45F1F8
Device \Driver\usbohci \Device\USBFDO-1 8A45F1F8
Device \Driver\usbehci \Device\USBFDO-2 8A4481F8
Device \Driver\Ftdisk \Device\FtControl 8A6561F8
Device \FileSystem\Fastfat \Fat 8A2F5500

AttachedDevice \FileSystem\Fastfat \Fat TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)

Device \FileSystem\Cdfs \Cdfs 8A3A1500

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792

—- EOF - GMER 1.0.15 —-

edruss

Post #8June 21, 2010, 2:03 AM UTC

I am looking your logs over and I will get back to you ASAP. edruss

edruss

Post #9June 22, 2010, 9:52 PM UTC

Sorry for the delay. I had a bad case of stomach flu.

Ok. Let's try the following.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"

:Commands
[Resethosts]
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

How is your computer running now?

edruss

brian_723

Post #10June 24, 2010, 4:36 PM UTC

Sorry for the delay. I had a bad case of stomach flu.

Ok. Let's try the following.

Run OTL.exe
Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"

:Commands
[Resethosts]
[purity]
[emptytemp]
[start explorer]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
How is your computer running now?

edruss

I still have problems with my computer opening every time I start my up computer .I ran the fix but something goes wrong when running I think .I tried it twice and both time my machine froze .

anyway i have done a scan .

OTL logfile created on: 24/06/2010 17:21:16 - Run 2
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 52.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 146.55 Gb Total Space | 52.85 Gb Free Space | 36.06% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-50C5ECAA5B
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\ThreatFire\TFService.exe (PC Tools)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wbsecsvc.exe (Integrated System Solution Corp.)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\ThreatFire\TFWAH.dll (PC Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (NMIndexingService) – File not found
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (ThreatFire) – C:\Program Files\ThreatFire\TFService.exe (PC Tools)
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (wbsecsvc) – C:\WINDOWS\System32\wbsecsvc.exe (Integrated System Solution Corp.)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)

========== Driver Services (SafeList) ==========

DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (TfSysMon) – C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) – C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) – C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (klbg) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSGbeXP) – C:\WINDOWS\system32\drivers\SiSGbeXP.sys (Silicon Integrated Systems Corp.)
DRV - (W35UND) – C:\WINDOWS\system32\drivers\W35UND.SYS (Integrated System Solution Corp.)
DRV - (wbsecdrv) – C:\WINDOWS\system32\drivers\wbsecdrv.sys (Winbond)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (wanusb) – C:\WINDOWS\system32\drivers\gwausb.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myaolbroadband.co.uk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/aolbroadband
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.17
FF - prefs.js..extensions.enabledItems: [removed]:1.6.3
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:3.0.0.65223
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:3.0.4
FF - prefs.js..extensions.enabledItems: [removed]:4.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.736
FF - prefs.js..extensions.enabledItems: [removed]:0.9948
FF - prefs.js..extensions.enabledItems: [removed]:1.5.1.20090806
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.1
FF - prefs.js..extensions.enabledItems: [removed]:0.9
FF - prefs.js..extensions.enabledItems: [removed]:3.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.2.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: ""

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/13 18:46:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/23 13:43:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010/01/12 21:31:55 | 000,000,000 | —D | M]

[2009/06/27 02:55:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/06/27 02:55:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2010/05/03 15:31:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions
[2009/10/03 15:45:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/04 19:19:49 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009/12/29 21:25:49 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009/10/13 16:30:48 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2009/12/04 19:19:56 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2009/12/04 19:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/10/24 12:23:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2009/12/04 19:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/01/17 00:49:40 | 000,002,255 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\searchplugins\askcom.xml
[2010/05/16 11:45:48 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/01/12 21:33:20 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2009/07/17 09:40:12 | 000,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll

Hosts file not found
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Broadband Toolbar 5.0\resources\en-GB\local\search.html ()
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1247340977328 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (") - File not found
O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2009/06/13 01:23:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/23 15:26:14 | 000,000,000 | —D | C] – C:\_OTL
[2010/06/20 10:03:09 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2010/06/20 10:01:58 | 000,589,824 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hpost_d02c.dll
[2010/06/20 10:01:57 | 000,712,704 | —- | C] (Hewlett-Packard) – C:\WINDOWS\System32\hposwia_d02c.dll
[2010/06/20 10:01:57 | 000,315,392 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hposc_d02a.dll
[2010/06/20 09:51:53 | 000,372,736 | R— | C] (Hewlett-Packard) – C:\WINDOWS\System32\hppldcoi.dll
[2010/06/20 09:51:53 | 000,309,760 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\difxapi.dll
[2010/06/18 18:27:17 | 000,050,968 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgfwdx.dll
[2010/06/18 18:27:17 | 000,030,104 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgfwdx.sys
[2010/06/18 18:24:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/06/14 19:59:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Google Chrome Backup
[2010/06/13 12:11:45 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/06/12 13:32:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\filterfiles
[2010/06/12 13:24:32 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/06/09 16:31:40 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/05/30 22:28:41 | 000,000,000 | —D | C] – C:\WINDOWS\XSxS
[2010/05/30 22:28:41 | 000,000,000 | —D | C] – C:\Program Files\Xenocode
[2010/05/29 16:28:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\gambia
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/24 17:00:33 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
[2010/06/24 16:49:04 | 000,001,008 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500UA.job
[2010/06/24 16:25:07 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/24 16:24:59 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/23 22:54:20 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/06/23 22:54:19 | 007,077,888 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/06/23 22:54:13 | 004,312,422 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/06/23 22:49:25 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/23 20:49:08 | 000,000,956 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500Core.job
[2010/06/22 23:01:10 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/21 16:28:42 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/20 18:27:43 | 018,499,623 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.0.5-win32.exe
[2010/06/20 18:22:46 | 000,071,680 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/20 11:21:15 | 000,293,376 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rer9t22i.exe
[2010/06/20 11:02:01 | 000,009,401 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\hijackthis sunday
[2010/06/20 10:59:02 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2010/06/20 10:05:44 | 000,137,724 | —- | M] () – C:\WINDOWS\hpoins44.dat
[2010/06/18 18:27:17 | 000,050,968 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgfwdx.dll
[2010/06/18 18:27:17 | 000,030,104 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgfwdx.sys
[2010/06/14 19:58:59 | 000,070,400 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/13 13:00:49 | 000,000,104 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2010/06/13 12:18:53 | 000,256,702 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ScreenHunter_01 Jun. 13 12.18.jpg
[2010/06/13 00:18:36 | 000,010,518 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100613_001822.reg
[2010/06/12 23:57:47 | 000,000,290 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235742.reg
[2010/06/12 23:56:36 | 000,037,462 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235628.reg
[2010/06/12 23:37:27 | 000,270,192 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/12 22:34:47 | 000,000,648 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/12 22:34:47 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/12 22:34:47 | 000,000,209 | -HS- | M] () – C:\boot.ini
[2010/06/12 13:32:26 | 000,003,240 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\settings.ini
[2010/06/12 13:32:26 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\proxy.ini
[2010/06/12 13:32:02 | 000,003,225 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\engines.ini
[2010/06/12 13:22:03 | 000,048,232 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_132156.reg
[2010/06/09 22:59:30 | 000,506,500 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/09 22:59:30 | 000,444,690 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/09 22:59:30 | 000,072,456 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/09 21:50:10 | 000,002,344 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/06/02 13:00:50 | 000,056,811 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Wild.Child[2008]DvDrip-aXXo.4555035.TPB.torrent
[2010/05/29 18:39:54 | 000,000,196 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183943.reg
[2010/05/29 18:38:55 | 000,030,296 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183839.reg
[2010/05/26 20:24:45 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.bak
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/20 11:22:00 | 000,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rer9t22i.exe
[2010/06/20 11:02:00 | 000,009,401 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\hijackthis sunday
[2010/06/20 09:57:48 | 000,137,724 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/06/20 09:57:48 | 000,000,512 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2010/06/13 13:00:49 | 000,000,104 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\My Computer.lnk
[2010/06/13 12:18:53 | 000,256,702 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ScreenHunter_01 Jun. 13 12.18.jpg
[2010/06/13 12:11:46 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2010/06/13 00:18:29 | 000,010,518 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100613_001822.reg
[2010/06/12 23:57:44 | 000,000,290 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235742.reg
[2010/06/12 23:56:30 | 000,037,462 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_235628.reg
[2010/06/12 13:32:26 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\proxy.ini
[2010/06/12 13:32:02 | 000,003,225 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\engines.ini
[2010/06/12 13:22:00 | 000,048,232 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100612_132156.reg
[2010/06/02 13:00:49 | 000,056,811 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Wild.Child[2008]DvDrip-aXXo.4555035.TPB.torrent
[2010/05/29 18:39:46 | 000,000,196 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183943.reg
[2010/05/29 18:38:50 | 000,030,296 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\cc_20100529_183839.reg
[2010/04/09 16:40:55 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2009/10/24 23:52:51 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2009/10/24 16:55:29 | 000,717,296 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2009/07/18 04:57:03 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/06/22 00:35:14 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/06/20 00:31:19 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/06/20 00:31:18 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/06/20 00:31:16 | 000,881,664 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/06/20 00:31:16 | 000,205,824 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/06/20 00:31:15 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/06/20 00:31:13 | 000,085,504 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/06/20 00:31:13 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/06/16 12:34:11 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\CoInst.dll
[2009/06/16 12:34:10 | 000,016,908 | —- | C] () – C:\WINDOWS\wwdslcfg.ini
[2009/06/15 07:58:23 | 000,092,985 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2009/06/15 07:57:32 | 000,128,191 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2009/06/15 07:51:27 | 000,016,960 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2009/06/15 07:51:05 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/06/15 07:51:02 | 000,016,922 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2009/06/15 07:50:55 | 000,010,288 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/09/17 23:55:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/17 23:55:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/09/17 23:55:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/09/17 23:55:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/09/17 23:55:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005/08/05 14:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A2947BEA
< End of report >

Thanks for your help so far .

edruss

Post #11June 25, 2010, 10:14 PM UTC

Let's try something else.

Download the HostsXpert
Unzip HostsXpert to a convenient folder such as C:\HostsXpert
Run HostsXpert from the folder you extracted it to
Click on "File Handling".
Click on "Restore MS Hosts File".
Click OK on the Confirmation box.
Click on "Make Read Only?"
Click the X to exit the program.

Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Please open Notepad.

Copy and paste the contents of the box below into the Notepad window.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"

Save it to your desktop as Myfile.reg

Right click Myfile.reg
Choose Merge from the menu.

After you complete these steps, run another scan with OTL and post the log.

edruss

brian_723

Post #12June 26, 2010, 10:09 AM UTC last edited June 26, 2010, 10:13 AM UTC

I cannot do it this, happens and then the programe closses down . 📎ScreenHunter_02_Jun._26_11.05.jpg 📎ScreenHunter_01_Jun._26_11.05.jpg basically it asks me to if i would like it to creat ehost file,so I click yes then I get an error click ok and the programmes closes .

edruss

Post #13June 27, 2010, 5:20 PM UTC

Ok. Let's try something different.

Download ComboFix from this location:

ComboFix Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

edruss

brian_723

Post #14June 27, 2010, 9:05 PM UTC last edited June 27, 2010, 9:06 PM UTC

Idid as you asked ,not sure if i got it righ,t but saved combo fix to desktop clicked on it ,think something may of gone wrong but I continued because i had a choice to use windows to open a file that i did not recognise .But then combo fix started doing stuff then it restarted my machine ,then a blue box came up took a few minutes then it installed window recovery console and created back up I think . then it said it would search my machine which should not take more than ten minutes .I came back 3 minutes later and my desktop had booted and my antivirus kasperkey was asking me to allow access ,think it was the file that was trying to open before restart .i pressed yes nothing happened so gave up and restarted machine .My computer folder is no longer opening so this is very good thanks .i do not have a log file .is there anything you need me to do or do you think my machine is now okay . thanks for all your help by the way . edit whilst doing all this a virtual drive or something like this got shut down for me .

edruss

Post #15June 28, 2010, 11:42 PM UTC

Ok let's try to find the ComboFix log.
Please follow these instructions.

Click Start then My Computer.
In the window that opens double click Local Disc (C:)
Now click Search in the menu bar at the top
Click All Files and Folders
In the box under All or part of the file name type in Combofix.txt
Make sure the box under Look in: says Local Disc (C:) If it does not click the down arrow beside the box and choose Local Disc (C:)
Now click the Search button beside the Back button at the bottom of the dialog box.

If it finds the file it will show up in the right hand box.

If it finds it please post the contents of the Combofix.txt log.

If it does not find it please rerun Combofix.exe.

edruss

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

my computer folders start everytime i boot up

✨ Ask AI

Ask AI