Spyware / Malware / Virus Removal

possible infected system. unexpected computer behaviour

14 min read

Looking for the outcome? Ask AI

tranquillizer Topic Starter

Post #1July 18, 2010, 10:46 AM UTC last edited July 18, 2010, 10:47 AM UTC

untill a week ago my system was running without any problem and for last few days i am feeling some change in the behaviour of the system. some times its busy for no reason(busy here refers to contiuous hard disk being busy and red light being on.) also some times system closes all the windows itself. another problem is that computer helds and then the only fix for me is to force restart it using the reset button. also for the record. i think all these problems are due to an added user of computer for last three weeks or so. if i could have some help please. thanks

tranquillizer

Post #2July 21, 2010, 9:42 AM UTC

is there anyone to help out please

mowman

Post #3July 21, 2010, 10:03 AM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post
•Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
•This may cause a delay in response time, but I will do my best to keep it as short as possible.
•I will reply back shortly with instructions.

tranquillizer

Post #4July 21, 2010, 11:30 AM UTC

thank you. i am waiting and shall follow your instructions.

mowman

Post #5July 21, 2010, 5:33 PM UTC

Please do the following.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.

In your next reply please post the following.

Both OTL logs
GMER log

tranquillizer

Post #6July 23, 2010, 9:07 PM UTC

i have tried three or four times but every time i do the gmer scan, system either hangs up or restarts itself. is there any other way of doing that. i am attaching otl and extra logs.

====================
Extra
====================

OTL Extras logfile created on: 23/07/2010 11:29:28 AM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Mianz\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.29 Gb Total Space | 4.27 Gb Free Space | 14.58% Space Free | Partition Type: NTFS
Drive D: | 14.65 Gb Total Space | 10.88 Gb Free Space | 74.26% Space Free | Partition Type: NTFS
Drive E: | 14.65 Gb Total Space | 7.76 Gb Free Space | 53.01% Space Free | Partition Type: NTFS
Drive F: | 14.65 Gb Total Space | 1.79 Gb Free Space | 12.20% Space Free | Partition Type: NTFS
Drive G: | 19.53 Gb Total Space | 0.16 Gb Free Space | 0.81% Space Free | Partition Type: NTFS
Drive H: | 19.53 Gb Total Space | 0.82 Gb Free Space | 4.19% Space Free | Partition Type: NTFS
Drive I: | 19.53 Gb Total Space | 0.47 Gb Free Space | 2.43% Space Free | Partition Type: NTFS
Drive J: | 19.53 Gb Total Space | 5.03 Gb Free Space | 25.75% Space Free | Partition Type: NTFS
Drive K: | 19.53 Gb Total Space | 0.79 Gb Free Space | 4.06% Space Free | Partition Type: NTFS
Drive L: | 19.53 Gb Total Space | 10.11 Gb Free Space | 51.76% Space Free | Partition Type: NTFS
Drive M: | 19.53 Gb Total Space | 9.22 Gb Free Space | 47.20% Space Free | Partition Type: NTFS
Drive N: | 19.53 Gb Total Space | 9.74 Gb Free Space | 49.84% Space Free | Partition Type: NTFS
Drive O: | 14.65 Gb Total Space | 4.42 Gb Free Space | 30.17% Space Free | Partition Type: NTFS
Drive P: | 14.65 Gb Total Space | 4.32 Gb Free Space | 29.46% Space Free | Partition Type: NTFS
Drive Q: | 14.65 Gb Total Space | 1.51 Gb Free Space | 10.31% Space Free | Partition Type: NTFS
Drive R: | 14.65 Gb Total Space | 6.99 Gb Free Space | 47.73% Space Free | Partition Type: NTFS
Drive S: | 9.99 Gb Total Space | 4.64 Gb Free Space | 46.42% Space Free | Partition Type: NTFS
Drive T: | 4.36 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: TRQLZR
Current User Name: Mianz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] – "C:\Program Files\ACD Systems\ACDSee\5.0\ACDSee5.exe" "%1" (ACD Systems, Ltd.)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 – (IniCom Networks, Inc.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 – (IniCom Networks, Inc.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09C468CA-2940-466A-AAE8-DCC0C6E9323C}" = Nokia Software Updater
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{204CDC04-F831-4D6A-8F4C-DDA5B4995382}" = Quake Live Internet Explorer Plugin
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 20
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2EB44B16-05EF-42FD-9300-A85CDEF60864}" = Free Word Excel Password Wizard
"{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" = Component Framework
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{55A6283C-638A-4EE0-B491-51118554BDA2}" = Norton Confidential Core
"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3
"{5B09BD67-4C99-46A1-8161-B7208CE18121}" = QuickTime
"{5B76C03E-14B1-4B8C-AF6E-9C55F522B1CA}" = SymNet
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62120008-8E1E-4807-860D-A8B48F8552DB}" = Norton Protection Center
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6E19F210-3813-4002-B561-94D66AA182B6}" = Atheros Communications Inc.® L1 Gigabit Ethernet Driver
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}" = Nokia PC Suite
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8A508AAA-3B69-4326-B89E-A6166FA05D3C}" = Canon MultiPASS Suite 4.40
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}" = FlashFXP v3
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-F400-7760-000000000003}" = Adobe Acrobat 8 Professional - English, Français, Deutsch
"{ADE91A13-434D-4229-00BC-182BAD607303}" = Need for Speed™ Most Wanted
"{AF5E8D43-49AD-4BE7-A941-2BB0A8CACA62}" = ACDSee 5.0 Standard
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB406CEB-6207-4512-9BB2-89950DC9D6B6}_is1" = ConvertXtoDVD 2.2.2.256
"{BB81360F-041C-4CF7-B15E-71380D154244}" = Adobe Setup
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C6A0FD8A-F107-44CA-AA1B-49341936F76A}" = USB2.0 PC Camera
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}" = Symantec Real Time Storage Protection Component
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DABC334D-C52B-4AF6-AC85-490D10D5942F}" = ArcSoft PhotoImpression 6
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DCD22647-6D31-479D-8F97-16D0AA934D9E}" = PC Connectivity Solution
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton AntiVirus Help
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88}" = Need for Speed™ Undercover
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{F80DDFFD-D030-4CCC-AF03-BD8EEE5E20ED}" = General Module
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"6A630DCEC5EEC912115F2FF59D8C2C769798D930" = Windows Driver Package - Nokia Modem (10/12/2007 3.6)
"819D45A9F73817F5B6D7C71A33ADAB88C5DA1765" = Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2)
"Ad-Aware" = Ad-Aware
"Adobe Acrobat 8 Professional - English, Français, Deutsch" = Adobe Acrobat 8.1.0 Professional
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Adobe_32fdd767b4383606e8168e834af5d90" = Adobe Premiere Pro CS3
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.9 (Unicode)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-09-21 16:18
"Easy RM to MP3 Converter_is1" = Easy RM to MP3 Converter 1.59.20
"Fraps" = Fraps (remove only)
"Free FLV to AVI Video Converter_is1" = Free FLV to AVI Video Converter v. 1.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"iVisit Presenter_is1" = iVisit Presenter 02/19/10
"Magic ISO Maker v5.5 (build 0259)" = Magic ISO Maker v5.5 (build 0259)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"PhotomatixPro3_is1" = Photomatix Pro version 3.1.3
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"RealDownload" = RealDownload
"RealPlayer 6.0" = RealPlayer
"RichFX Player" = RichFX Player
"SymSetup.{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security (Symantec Corporation)
"Total Video Converter 3.10_is1" = Total Video Converter 3.10
"VSO DivxToDVD_is1" = DivxToDVD 0.5.2
"WampServer 2_is1" = WampServer 2.0
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPatrol" = WinPatrol
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Yahoo! Companion" = Yahoo!7 Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"3a23ab72acc2090b" = EncryptFile
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/07/2010 9:58:19 AM | Computer Name = TRQLZR | Source = Application Hang | ID = 1002
Description = Hanging application PowerDVD.exe, version 5.0.0.603, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/07/2010 12:46:58 AM | Computer Name = TRQLZR | Source = Application Hang | ID = 1002
Description = Hanging application msnmsgr.exe, version 14.0.8089.726, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/07/2010 12:54:22 PM | Computer Name = TRQLZR | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 11/07/2010 12:54:22 PM | Computer Name = TRQLZR | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 15/07/2010 7:18:34 PM | Computer Name = TRQLZR | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 17/07/2010 5:58:45 AM | Computer Name = TRQLZR | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 13/07/2010 9:29:59 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:45:09 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:45:39 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:46:44 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:47:14 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:47:44 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:48:14 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:48:44 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:49:14 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

Error - 18/07/2010 3:49:44 AM | Computer Name = TRQLZR | Source = DCOM | ID = 10010
Description = The server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register
with DCOM within the required timeout.

< End of report >

====================
OTL
====================

OTL logfile created on: 23/07/2010 7:22:25 PM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Mianz\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.29 Gb Total Space | 4.21 Gb Free Space | 14.37% Space Free | Partition Type: NTFS
Drive D: | 14.65 Gb Total Space | 10.88 Gb Free Space | 74.26% Space Free | Partition Type: NTFS
Drive E: | 14.65 Gb Total Space | 7.76 Gb Free Space | 53.01% Space Free | Partition Type: NTFS
Drive F: | 14.65 Gb Total Space | 1.79 Gb Free Space | 12.20% Space Free | Partition Type: NTFS
Drive G: | 19.53 Gb Total Space | 0.16 Gb Free Space | 0.81% Space Free | Partition Type: NTFS
Drive H: | 19.53 Gb Total Space | 0.82 Gb Free Space | 4.19% Space Free | Partition Type: NTFS
Drive I: | 19.53 Gb Total Space | 0.47 Gb Free Space | 2.43% Space Free | Partition Type: NTFS
Drive J: | 19.53 Gb Total Space | 5.03 Gb Free Space | 25.75% Space Free | Partition Type: NTFS
Drive K: | 19.53 Gb Total Space | 0.79 Gb Free Space | 4.06% Space Free | Partition Type: NTFS
Drive L: | 19.53 Gb Total Space | 10.11 Gb Free Space | 51.76% Space Free | Partition Type: NTFS
Drive M: | 19.53 Gb Total Space | 9.22 Gb Free Space | 47.20% Space Free | Partition Type: NTFS
Drive N: | 19.53 Gb Total Space | 9.74 Gb Free Space | 49.84% Space Free | Partition Type: NTFS
Drive O: | 14.65 Gb Total Space | 4.42 Gb Free Space | 30.17% Space Free | Partition Type: NTFS
Drive P: | 14.65 Gb Total Space | 4.32 Gb Free Space | 29.46% Space Free | Partition Type: NTFS
Drive Q: | 14.65 Gb Total Space | 1.51 Gb Free Space | 10.31% Space Free | Partition Type: NTFS
Drive R: | 14.65 Gb Total Space | 6.99 Gb Free Space | 47.73% Space Free | Partition Type: NTFS
Drive S: | 9.99 Gb Total Space | 4.64 Gb Free Space | 46.42% Space Free | Partition Type: NTFS
Drive T: | 4.36 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: TRQLZR
Current User Name: Mianz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mianz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe (Skype Technologies S.A.)
PRC - C:\WINDOWS\system32\PrintCtrl.exe (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\CCSVCHST.EXE (Symantec Corporation)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation)
PRC - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\Program Files\Canon\MultiPASS4\mpservic.exe (Canon Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mianz\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll (BillP Studios)

========== Win32 Services (SafeList) ==========

SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Printer Control) – C:\WINDOWS\system32\PrintCtrl.exe (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM)
SRV - (vvdsvc) – C:\WINDOWS\system32\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (LiveUpdate Notice) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (CLTNetCnService) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (wampmysqld) – H:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe ()
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (wampapache) – H:\wamp\bin\apache\apache2.2.8\bin\httpd.exe (Apache Software Foundation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (comHost) – C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (Symantec Corporation)
SRV - (MpService) – C:\Program Files\Canon\MultiPASS4\mpservic.exe (Canon Inc.)

========== Driver Services (SafeList) ==========

DRV - (APL531) – C:\WINDOWS\System32\Drivers\ov550i.sys File not found
DRV - (aiptektp) – C:\WINDOWS\System32\DRIVERS\aiptektp.sys File not found
DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100721.020\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100721.020\NAVENG.SYS (Symantec Corporation)
DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20100720.001\SymIDSCo.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (UsbserFilt) – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) – C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) – C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SymIMMP) – C:\WINDOWS\system32\drivers\SymIM.sys (Symantec Corporation)
DRV - (SymIM) – C:\WINDOWS\system32\drivers\SymIM.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMDNS) – C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (GUCI_AVS) – C:\WINDOWS\system32\drivers\GUCI_AVS.sys (PixArt Imaging Incorporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (pccsmcfd) – C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (COH_Mon) – C:\WINDOWS\system32\drivers\COH_Mon.sys (Symantec Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (SRTSPL) – C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) – C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (CO_Mon) – C:\WINDOWS\system32\drivers\CO_Mon.sys (Symantec Corporation)
DRV - (AtcL001) – C:\WINDOWS\system32\drivers\l151x86.sys (Atheros Communications Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM) – C:\WINDOWS\system32\drivers\s116unic.sys (MCCI Corporation)
DRV - (s116obex) – C:\WINDOWS\system32\drivers\s116obex.sys (MCCI Corporation)
DRV - (s116nd5) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS) – C:\WINDOWS\system32\drivers\s116nd5.sys (MCCI Corporation)
DRV - (s116mgmt) Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\system32\drivers\s116mgmt.sys (MCCI Corporation)
DRV - (s116mdm) – C:\WINDOWS\system32\drivers\s116mdm.sys (MCCI Corporation)
DRV - (s116mdfl) – C:\WINDOWS\system32\drivers\s116mdfl.sys (MCCI Corporation)
DRV - (s116bus) Sony Ericsson Device 116 driver (WDM) – C:\WINDOWS\system32\drivers\s116bus.sys (MCCI Corporation)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2010/01/03 11:53:05 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [WinPatrol System Monitor] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
O4 - HKCU..\Run: [AdobeBridge] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {82FFA573-38AA-482A-99AD-91F697B91631} http://static.35mb.com/applet/applet_o.cab (Installer.InstallControl)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} http://www.ooxtv.com/livetv.ocx (KooPlayer Control)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} http://www.ooxtv.com/vjocx-en.cab (VodClient Control Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab (DownloadManager Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Mianz\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mianz\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/19 17:55:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/12/31 20:08:13 | 000,000,000 | —D | M] - O:\automan – [ NTFS ]
O33 - MountPoints2\{1366aef6-043a-11dd-b557-001d60196f62}\Shell\AutoRun\command - "" = driver\S-1-4-89-654352344-54323413-6452342-4545\service.exe
O33 - MountPoints2\{1366aef6-043a-11dd-b557-001d60196f62}\Shell\open\command - "" = driver\S-1-4-89-654352344-54323413-6452342-4545\service.exe
O33 - MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\Shell\AutoRun\command - "" = .\Docs\print.exe
O33 - MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\Shell\explore\command - "" = .\\\\Docs/print.exe
O33 - MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\Shell\open\command - "" = Docs////print.exe
O33 - MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\Shell - "" = AutoRun
O33 - MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\Shell\AutoRun\command - "" = U:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/23 11:26:35 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mianz\Desktop\OTL.exe
[2010/07/14 04:08:57 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/07/10 21:57:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Real
[2010/07/04 23:14:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Mianz\Desktop\New Folder (4)
[2010/06/29 08:16:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Mianz\Desktop\aniver dine out
[2010/06/24 16:24:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/06/24 00:21:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Mianz\Desktop\New Folder (3)

========== Files - Modified Within 30 Days ==========

[2010/07/23 18:17:21 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/07/23 17:47:16 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{9E778CB5-D3CF-4D0C-B311-A0ECC96E9A68}.job
[2010/07/23 17:34:51 | 014,155,776 | -H– | M] () – C:\Documents and Settings\Mianz\NTUSER.DAT
[2010/07/23 12:17:11 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/07/23 11:41:26 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/23 11:41:26 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/07/23 11:41:26 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/07/23 11:40:34 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/23 11:40:27 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/23 11:39:54 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/23 11:39:40 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/23 11:26:43 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mianz\Desktop\OTL.exe
[2010/07/23 00:18:47 | 000,084,480 | —- | M] () – C:\Documents and Settings\Mianz\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/20 20:23:42 | 000,036,520 | —- | M] () – C:\Documents and Settings\Mianz\Desktop\654104-nmachi-ihegboro.jpg
[2010/07/19 20:00:54 | 000,000,622 | —- | M] () – C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Mianz.job
[2010/07/10 22:57:53 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/07/10 22:57:53 | 000,001,409 | —- | M] () – C:\WINDOWS\QTFont.for
[2010/07/10 22:25:11 | 002,098,230 | —- | M] () – C:\WINDOWS\ACD Wallpaper.bmp
[2010/07/03 10:25:00 | 003,295,907 | —- | M] () – C:\Documents and Settings\Mianz\Desktop\IMG_9759.JPG
[2010/06/28 18:01:15 | 000,018,590 | —- | M] () – C:\Documents and Settings\Mianz\Desktop\july namaz calander.pdf
[2010/06/24 00:21:56 | 000,523,110 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/24 00:21:56 | 000,444,358 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/24 00:21:56 | 000,072,108 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/24 00:17:55 | 000,001,908 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Nokia Software Updater.lnk

========== Files Created - No Company Name ==========

[2010/07/20 20:33:20 | 000,036,520 | —- | C] () – C:\Documents and Settings\Mianz\Desktop\654104-nmachi-ihegboro.jpg
[2010/07/10 22:57:53 | 000,054,156 | -H– | C] () – C:\WINDOWS\QTFont.qfn
[2010/07/10 22:57:53 | 000,001,409 | —- | C] () – C:\WINDOWS\QTFont.for
[2010/07/03 10:25:00 | 003,295,907 | —- | C] () – C:\Documents and Settings\Mianz\Desktop\IMG_9759.JPG
[2010/06/29 15:17:06 | 000,000,422 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{9E778CB5-D3CF-4D0C-B311-A0ECC96E9A68}.job
[2010/06/28 18:01:15 | 000,018,590 | —- | C] () – C:\Documents and Settings\Mianz\Desktop\july namaz calander.pdf
[2010/06/23 16:15:29 | 001,391,616 | —- | C] () – C:\WINDOWS\System32\ActPDF.dll
[2010/03/01 22:22:36 | 000,002,057 | —- | C] () – C:\WINDOWS\System32\GUCI_AVS.ini
[2009/12/27 17:27:41 | 000,000,048 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/11/14 13:07:04 | 000,138,184 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/10/10 23:20:04 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/03/30 20:32:38 | 000,003,200 | —- | C] () – C:\WINDOWS\PSPICEEV.INI
[2009/03/30 20:32:36 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\lffax60n.dll
[2009/03/30 20:32:36 | 000,141,824 | —- | C] () – C:\WINDOWS\System32\lfcmp60n.dll
[2009/03/30 20:32:36 | 000,110,080 | —- | C] () – C:\WINDOWS\System32\lfpng60n.dll
[2009/03/30 20:32:36 | 000,046,080 | —- | C] () – C:\WINDOWS\System32\lftif60n.dll
[2009/03/30 20:32:36 | 000,043,008 | —- | C] () – C:\WINDOWS\System32\ltfil60n.dll
[2009/03/30 20:32:36 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\lfpcx60n.dll
[2009/03/30 20:32:36 | 000,022,528 | —- | C] () – C:\WINDOWS\System32\lfpct60n.dll
[2009/03/30 20:32:36 | 000,022,528 | —- | C] () – C:\WINDOWS\System32\lfeps60n.dll
[2009/03/30 20:32:36 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\lfbmp60n.dll
[2009/03/30 20:32:36 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\lfpsd60n.dll
[2009/03/30 20:32:36 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\lftga60n.dll
[2009/03/30 20:32:36 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\lfwpg60n.dll
[2009/03/30 20:32:36 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\lfwmf60n.dll
[2009/03/30 20:32:36 | 000,018,432 | —- | C] () – C:\WINDOWS\System32\lfmsp60n.dll
[2009/03/30 20:32:36 | 000,017,920 | —- | C] () – C:\WINDOWS\System32\lfmac60n.dll
[2009/03/30 20:32:36 | 000,017,920 | —- | C] () – C:\WINDOWS\System32\implode.dll
[2009/02/15 21:56:22 | 000,036,864 | —- | C] () – C:\WINDOWS\JPGL.DLL
[2009/02/15 21:56:22 | 000,032,768 | —- | C] () – C:\WINDOWS\DIV_IYUV.DLL
[2008/04/25 23:13:16 | 000,000,071 | —- | C] () – C:\WINDOWS\RmFile.ini
[2008/04/25 23:13:15 | 000,000,010 | —- | C] () – C:\WINDOWS\System32\MprExe.Ini
[2008/03/22 11:36:47 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2008/03/21 01:29:46 | 000,003,394 | —- | C] () – C:\WINDOWS\affi.drv
[2008/03/21 01:29:46 | 000,003,106 | —- | C] () – C:\WINDOWS\System32\fpfnpf.drv
[2008/03/21 01:29:46 | 000,002,482 | —- | C] () – C:\WINDOWS\ongbp.drv
[2008/03/21 01:29:46 | 000,000,978 | —- | C] () – C:\WINDOWS\aahn.drv
[2008/03/21 01:29:46 | 000,000,850 | —- | C] () – C:\WINDOWS\ballll.drv
[2008/03/21 01:29:46 | 000,000,706 | —- | C] () – C:\WINDOWS\ffaahfp.drv
[2008/03/21 01:29:46 | 000,000,132 | —- | C] () – C:\WINDOWS\System32\aaoaoa.sys
[2008/03/04 17:52:34 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\libcurl.dll
[2007/12/14 12:52:54 | 000,010,831 | —- | C] () – C:\WINDOWS\System32\MpUpMon.dll
[2007/12/14 12:52:38 | 000,001,302 | —- | C] () – C:\WINDOWS\System32\MpEnum.ini
[2007/12/14 12:52:38 | 000,000,026 | —- | C] () – C:\WINDOWS\System32\MpNetIpc.ini
[2007/11/20 19:05:12 | 000,013,269 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2007/11/20 18:58:01 | 000,010,959 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2007/11/20 18:57:21 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2007/11/20 18:56:59 | 000,010,288 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007/11/20 18:39:42 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/10/31 08:39:54 | 000,059,904 | —- | C] () – C:\WINDOWS\System32\zlib1.dll
[2007/06/29 02:43:00 | 001,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2007/06/29 02:43:00 | 001,474,560 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2007/06/29 02:43:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2007/06/29 02:43:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2007/06/29 02:43:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/05/17 12:58:10 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\libexpatw.dll
[2006/04/19 08:30:56 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2006/03/22 10:38:42 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2004/09/28 05:38:30 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\wmatimer.dll
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/21 12:51:52 | 000,503,808 | R— | C] () – C:\WINDOWS\System32\lt_xtrans.dll
[2002/03/21 12:51:52 | 000,286,720 | R— | C] () – C:\WINDOWS\System32\MrSIDD.dll
[2002/03/21 12:51:52 | 000,163,840 | R— | C] () – C:\WINDOWS\System32\lt_common.dll
[2002/03/21 12:51:52 | 000,126,976 | R— | C] () – C:\WINDOWS\System32\lt_trans.dll
[2002/03/21 12:51:52 | 000,069,632 | R— | C] () – C:\WINDOWS\System32\lt_meta.dll
[2002/03/21 12:51:52 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\lt_encrypt.dll
[2002/03/21 12:51:52 | 000,020,480 | R— | C] () – C:\WINDOWS\System32\lt_messagetext.dll
[2002/03/20 21:01:06 | 000,006,688 | R— | C] () – C:\WINDOWS\System32\Digita.sys
[2002/03/20 21:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 21:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 21:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 21:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportIrCOMM.dll

========== LOP Check ==========

[2007/12/12 22:54:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ACD Systems
[2007/12/14 12:52:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canon
[2007/12/26 20:49:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FlashFXP
[2009/04/10 01:45:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\id Software
[2010/05/28 18:00:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2010/05/28 19:44:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nokia
[2007/12/14 20:24:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2010/05/06 20:29:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2009/12/27 18:33:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2010/01/01 01:34:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2010/06/23 16:15:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Temp
[2007/12/30 23:50:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2007/12/14 11:28:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/12/12 17:16:08 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2008/01/03 16:17:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\ACD Systems
[2009/03/04 22:50:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\AI Internet Solutions
[2009/09/18 23:52:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Audacity
[2008/09/05 02:06:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Bytescout SWF To Video Scout
[2008/07/04 20:56:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Canon
[2010/05/06 20:40:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2007/12/26 20:52:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\FlashFXP
[2009/02/26 00:00:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\HDRsoft
[2009/01/14 16:59:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\ICQ
[2009/04/10 11:25:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\id Software
[2010/06/23 16:17:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\iVisit Data
[2008/11/19 16:43:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Leadertech
[2010/06/24 00:22:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Nokia
[2009/05/01 20:48:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Opera
[2009/08/28 20:30:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\PC Suite
[2007/12/25 20:59:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Teleca
[2008/10/11 21:05:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\TextPad
[2010/07/21 08:30:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\uTorrent
[2009/09/30 21:09:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\Vso
[2008/05/07 10:56:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\WeGame
[2007/12/12 22:51:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Mianz\Application Data\WinPatrol
[2010/07/23 18:17:21 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/07/23 11:41:26 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/07/23 11:41:26 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/07/23 12:17:11 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/07/23 11:41:26 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/07/23 17:47:16 | 000,000,422 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{9E778CB5-D3CF-4D0C-B311-A0ECC96E9A68}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/07/23 11:39:27 | 000,053,529 | —- | M] () – C:\aaw7boot.log
[2007/11/19 17:55:32 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2007/11/19 17:50:36 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/01/03 13:42:43 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/03 22:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2007/11/19 17:55:32 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/07/07 14:06:30 | 000,003,532 | —- | M] () – C:\drmHeader.bin
[2007/11/19 17:55:32 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/04/15 03:59:57 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2007/11/19 17:55:32 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/03 22:38:34 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/09/14 18:39:38 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/07/23 11:39:32 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010/03/01 22:42:57 | 000,230,436 | —- | M] () – C:\PAP7501.dat
[2007/11/20 19:00:41 | 000,000,575 | —- | M] () – C:\RHDSetup.log
[2007/12/07 02:49:02 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2007/12/07 11:01:01 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2007/12/07 12:20:38 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2007/12/07 13:22:29 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2007/12/11 10:13:23 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2007/12/12 09:10:59 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2007/12/12 20:37:31 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2007/12/07 02:49:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2007/12/07 11:01:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2007/12/07 12:20:38 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2007/12/07 13:22:29 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2007/12/11 10:13:23 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2007/12/12 09:10:59 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2007/12/12 20:37:31 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/11/19 17:55:16 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/11/22 02:46:30 | 000,030,208 | —- | M] (ActMask Co.,Ltd) – C:\WINDOWS\system32\spool\prtprocs\w32x86\ActPrint.dll
[2002/10/09 16:35:24 | 000,013,824 | R— | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPDyc.DLL
[2002/10/09 16:35:24 | 000,043,008 | R— | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPPyc.DLL
[2008/07/06 22:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 20:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/11/20 04:40:51 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2007/11/20 04:40:51 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2007/11/20 04:40:51 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 10:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 10:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 10:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-14 11:30:45
< End of report >

mowman

Post #7July 24, 2010, 5:27 PM UTC

Please do the following.

Please download this file, and save it to your Desktop. Once you have downloaded it, save and close all other programs and run it by double-clicking on the file named "RootRepeal.exe".

Once the main window shows up, please click on the "Report" button on the bottom of the window. Next, please click the "Scan" button.

Another window will pop up asking you to select what to include in the scan. Please uncheck everything except for the "Stealth Code" checkbox, and then click OK.

Once the program has finished scanning, the results will appear. Click on the "Save Report" button, and save the report to your desktop.

Finally, please open this report with Notepad, and post it here

tranquillizer

Post #8July 25, 2010, 12:23 PM UTC

here is the saved stuff from RooRepeal file. ========== ROOTREPEAL © AD, 2007-2010 ================================================== Report Save Time: 2010/07/25 22:18 Program Version: Version 2.0.0.0 Windows Version: Windows XP SP3 ================================================== STEALTH CODE ——————- ==================

mowman

Post #9July 25, 2010, 9:11 PM UTC

Please do the following.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O33 - MountPoints2\{1366aef6-043a-11dd-b557-001d60196f62}\Shell\AutoRun\command - "" = driver\S-1-4-89-654352344-54323413-6452342-4545\service.exe
O33 - MountPoints2\{1366aef6-043a-11dd-b557-001d60196f62}\Shell\open\command - "" = driver\S-1-4-89-654352344-54323413-6452342-4545\service.exe
O33 - MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\Shell\AutoRun\command - "" = .\Docs\print.exe
O33 - MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\Shell\explore\command - "" = .\\\\Docs/print.exe
O33 - MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\Shell\open\command - "" = Docs////print.exe
O33 - MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\Shell - "" = AutoRun
O33 - MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\Shell\AutoRun\command - "" = U:\LaunchU3.exe – File not found
[2008/03/21 01:29:46 | 000,003,394 | —- | C] () – C:\WINDOWS\affi.drv
[2008/03/21 01:29:46 | 000,003,106 | —- | C] () – C:\WINDOWS\System32\fpfnpf.drv
[2008/03/21 01:29:46 | 000,002,482 | —- | C] () – C:\WINDOWS\ongbp.drv
[2008/03/21 01:29:46 | 000,000,978 | —- | C] () – C:\WINDOWS\aahn.drv
[2008/03/21 01:29:46 | 000,000,850 | —- | C] () – C:\WINDOWS\ballll.drv
[2008/03/21 01:29:46 | 000,000,706 | —- | C] () – C:\WINDOWS\ffaahfp.drv
[2008/03/21 01:29:46 | 000,000,132 | —- | C] () – C:\WINDOWS\System32\aaoaoa.sys

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

tranquillizer

Post #10July 27, 2010, 10:39 AM UTC

all went well this time.here are the logs
=============================
OTL Log
=============================

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\control panel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\control panel\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1366aef6-043a-11dd-b557-001d60196f62}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1366aef6-043a-11dd-b557-001d60196f62}\ not found.
File driver\S-1-4-89-654352344-54323413-6452342-4545\service.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1366aef6-043a-11dd-b557-001d60196f62}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1366aef6-043a-11dd-b557-001d60196f62}\ not found.
File driver\S-1-4-89-654352344-54323413-6452342-4545\service.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d278e382-499e-11dd-b5cc-001d60196f62}\ not found.
File .\Docs\print.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d278e382-499e-11dd-b5cc-001d60196f62}\ not found.
File .\\\\Docs/print.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d278e382-499e-11dd-b5cc-001d60196f62}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d278e382-499e-11dd-b5cc-001d60196f62}\ not found.
File Docs////print.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d36228a1-7eac-11de-b87e-001d60196f62}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d36228a1-7eac-11de-b87e-001d60196f62}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d36228a1-7eac-11de-b87e-001d60196f62}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d36228a1-7eac-11de-b87e-001d60196f62}\ not found.
File move failed. U:\LaunchU3.exe scheduled to be moved on reboot.
C:\WINDOWS\affi.drv moved successfully.
C:\WINDOWS\system32\fpfnpf.drv moved successfully.
C:\WINDOWS\ongbp.drv moved successfully.
C:\WINDOWS\aahn.drv moved successfully.
C:\WINDOWS\ballll.drv moved successfully.
C:\WINDOWS\ffaahfp.drv moved successfully.
C:\WINDOWS\system32\aaoaoa.sys moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41704 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 137749 bytes

User: Mianz
->Temp folder emptied: 157979691 bytes
->Temporary Internet Files folder emptied: 735935714 bytes
->Java cache emptied: 27878560 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 1656250 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 81286517 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 40720728 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 1557733330 bytes

Total Files Cleaned = 2,483.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07272010_200651

Files\Folders moved on Reboot…
File move failed. U:\LaunchU3.exe scheduled to be moved on reboot.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\XDB8EJRD\iframe[1].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\XDB8EJRD\iframe[2].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\XDB8EJRD\iframe[3].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\XDB8EJRD\iframe[4].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\HXT72HJY\iframe[1].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\HXT72HJY\iframe[2].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\HXT72HJY\iframe[3].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\HXT72HJY\index[1].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\Content.IE5\7I7J8DDX\like[1].htm moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Documents and Settings\Mianz\Local Settings\Temporary Internet Files\SuggestedSites.dat moved successfully.
File\Folder C:\WINDOWS\temp\JETB15E.tmp not found!

Registry entries deleted on Reboot…

===================
End OTL Log
===================

===================
ComboFix Log
===================
ComboFix 10-07-24.06 - Mianz 27/07/2010 20:25:48.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1349 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

—– BITS: Possible infected sites —–

hxxp://au.download.windowsupdate.coj+|Cv+@J:NGD_DQ{zcxLJS@mN5-:EWU Client DownloadS-1-5-18`HT4?? 6VwoQZCDHM6VwoQZCDHMXu1"1"1"1"oicxLJS@GD_DQ{zGD_DQ{zGD_DQ{z+@J:Nj+|Cvupdate.com
.
((((((((((((((((((((((((( Files Created from 2010-06-27 to 2010-07-27 )))))))))))))))))))))))))))))))
.

2010-07-27 10:06 . 2010-07-27 10:06 ——– d—–w- C:\_OTL
2010-07-13 18:08 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-10 11:57 . 2010-07-10 11:57 452104 —-a-w- c:\documents and settings\Mianz\Application Data\Real\Update\setup3.12\setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 10:28 . 2007-11-20 09:05 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-07-27 09:16 . 2009-02-13 11:48 ——– d—–w- c:\documents and settings\Mianz\Application Data\Skype
2010-07-27 06:06 . 2009-02-13 11:51 ——– d—–w- c:\documents and settings\Mianz\Application Data\skypePM
2010-07-27 03:08 . 2007-11-20 09:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-07-20 22:30 . 2007-12-12 13:39 ——– d—–w- c:\documents and settings\Mianz\Application Data\uTorrent
2010-06-24 06:24 . 2009-02-13 11:48 ——– d—–r- c:\program files\Skype
2010-06-24 06:24 . 2010-06-24 06:24 ——– d—–w- c:\program files\Common Files\Skype
2010-06-24 06:23 . 2009-02-13 11:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-06-23 14:22 . 2007-12-14 10:19 ——– d—–w- c:\documents and settings\Mianz\Application Data\Nokia
2010-06-23 06:17 . 2010-06-23 06:17 ——– d—–w- c:\documents and settings\Mianz\Application Data\iVisit Data
2010-06-23 06:15 . 2010-06-23 06:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Temp
2010-06-14 14:31 . 2007-11-19 07:53 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-12 18:30 . 2009-12-24 20:54 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-06-04 10:49 . 2010-06-04 10:49 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
2010-06-04 10:49 . 2010-06-04 10:49 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-05-28 08:00 . 2010-05-28 08:00 36864 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\Installer\CommonCustomActions\Sleep.exe
2010-05-28 08:00 . 2010-05-28 08:00 3351812 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\Installer\CommonCustomActions\msxml6Exec.exe
2010-05-28 08:00 . 2010-05-28 08:00 3203453 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\Installer\CommonCustomActions\vcredistExec.exe
2010-05-28 07:59 . 2010-05-28 08:01 35607992 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\NokiaSoftwareUpdaterSetup_en.exe
2010-05-22 18:30 . 2010-05-22 18:30 503808 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-18b61010-n\msvcp71.dll
2010-05-22 18:30 . 2010-05-22 18:30 499712 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-18b61010-n\jmc.dll
2010-05-22 18:30 . 2010-05-22 18:30 348160 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-18b61010-n\msvcr71.dll
2010-05-22 18:30 . 2010-05-22 18:30 61440 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d43e4ba-n\decora-sse.dll
2010-05-22 18:30 . 2010-05-22 18:30 12800 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d43e4ba-n\decora-d3d.dll
2010-05-09 04:53 . 2010-05-09 04:53 503808 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-61a5525a-n\msvcp71.dll
2010-05-09 04:53 . 2010-05-09 04:53 499712 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-61a5525a-n\jmc.dll
2010-05-09 04:53 . 2010-05-09 04:53 348160 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-61a5525a-n\msvcr71.dll
2010-05-09 04:53 . 2010-05-09 04:53 61440 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-240881e7-n\decora-sse.dll
2010-05-09 04:53 . 2010-05-09 04:53 12800 —-a-w- c:\documents and settings\Mianz\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-240881e7-n\decora-d3d.dll
2010-05-06 10:41 . 2004-08-03 14:56 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-06 10:33 . 2007-11-20 08:27 47344 —-a-w- c:\documents and settings\Mianz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-02 05:22 . 2004-08-03 13:17 1851264 —-a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-07 718704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"WinPatrol System Monitor"="c:\program files\BillP Studios\WinPatrol\WinPatrol.exe" [2005-12-12 222784]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [12/12/2009 5:17 PM 64288]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [26/01/2008 11:47 AM 149352]
R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [23/06/2010 4:15 PM 65536]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [20/11/2007 7:02 PM 39424]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [28/05/2010 7:06 PM 102448]
S1 aiptektp;HyperPen;c:\windows\system32\DRIVERS\aiptektp.sys –> c:\windows\system32\DRIVERS\aiptektp.sys [?]
S2 gupdate1c986af4e91c1c6;Google Update Service (gupdate1c986af4e91c1c6);c:\program files\Google\Update\GoogleUpdate.exe [4/02/2009 7:59 PM 133104]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2/12/2009 11:19 PM 1181328]
S3 APL531;OVT Scanner;c:\windows\system32\Drivers\ov550i.sys –> c:\windows\system32\Drivers\ov550i.sys [?]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [13/01/2008 12:32 PM 23888]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\drivers\GUCI_AVS.sys [1/03/2010 10:22 PM 581120]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [28/05/2010 6:02 PM 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [28/05/2010 6:02 PM 8320]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc
.
Contents of the 'Scheduled Tasks' folder

2010-07-27 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:17]

2010-07-27 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:17]

2010-07-27 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:17]

2010-07-27 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:17]

2010-07-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:17]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 09:59]

2010-07-26 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Mianz.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 14:05]

2010-07-27 c:\windows\Tasks\User_Feed_Synchronization-{9E778CB5-D3CF-4D0C-B311-A0ECC96E9A68}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://au.yahoo.com
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-27 20:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1547161642-1604221776-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:18,65,40,19,e2,61,e1,b7,78,7f,be,fd,c1,49,a2,21,8c,30,b5,b3,2b,
d4,8a,8a,b4,05,e5,f6,fa,df,c2,7b,07,e6,b7,6c,75,bc,95,fc,90,bf,30,b6,31,4a,\
"rkeysecu"=hex:ca,56,33,0c,64,20,53,74,11,a8,4e,0d,eb,72,27,1c
.
Completion time: 2010-07-27 20:31:22
ComboFix-quarantined-files.txt 2010-07-27 10:31

Pre-Run: 5,703,688,192 bytes free
Post-Run: 5,681,684,480 bytes free

- - End Of File - - 35C4A80A74ED9E622D5C30240E1E84BD
=====================
End Combofix Log
=====================

mowman

Post #11July 27, 2010, 11:25 PM UTC

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Also please tell me how the computer is running now

tranquillizer

Post #12July 31, 2010, 1:49 PM UTC

sorry i was away due to an emergency, i am back and doing the above mentioned now.

SweetTech

Post #13July 31, 2010, 7:07 PM UTC

Hello, Thanks for letting us know. mowman is unavailable right now, so I will continue to assist you for right now. Cheers, SweetTech.

tranquillizer

Post #14August 2, 2010, 9:06 AM UTC

i am really sorry for the delay, but it was an emergency i have got the logs now. regarding the Eset Online Scanner you said "When the scan finishes click the Details tab." there was no details tab. it only said no threats found scanned files:164843 infected and cleaned:0 total scan time:00:50:34 Scan status finished and then it said select uninstall if you want to etc etc with only one tab on window caption finished. =============================== MalwareBytes AntiMalware Log =============================== Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4376 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1/08/2010 9:42:49 PM mbam-log-2010-08-01 (21-42-49).txt Scan type: Quick scan Objects scanned: 147217 Time elapsed: 8 minute(s), 40 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ====================================== ==================================== Eset Online Scanner Log ==================================== ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=e551ab38ae7f4d4bb038e24be6bad4e2 # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-08-01 05:46:42 # local_time=2010-08-02 03:46:42 (+1000, AUS Eastern Standard Time) # country="Australia" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=3584 16777175 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 3948 3948 0 0 # scanned=35759 # found=0 # cleaned=0 # scan_time=607 # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=e551ab38ae7f4d4bb038e24be6bad4e2 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-08-02 08:35:37 # local_time=2010-08-02 06:35:37 (+1000, AUS Eastern Standard Time) # country="Australia" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=3584 16777175 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 54857 54857 0 0 # scanned=164843 # found=0 # cleaned=0 # scan_time=3034 ==================================

SweetTech

Post #15August 2, 2010, 6:47 PM UTC

Hello,

How are things running?

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NEXT:

OTL Custom Scan

We need to run an OTL Custom Scan

Please reopen [external image: Posted Image] on your desktop.
Copy and Paste the following bolded text into the [external image: Posted Image] textbox.

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Push Quick Scan
A report will open. Copy and Paste that report in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

possible infected system. unexpected computer behaviour

✨ Ask AI

Ask AI