Spyware / Malware / Virus Removal

Unknown Infection - please help!

20 min read

Looking for the outcome? Ask AI

SweetTech

Post #16July 24, 2010, 11:04 PM UTC

Hello,

We are going to run a few more scans to ensure we've gotten everything.

Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT:

Kaspersky Online Scanner
Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, adware, dialers, and other riskware
- Archives
- E-mail databases
Click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View report… at the bottom.
Click the Save report… button.

[external image: Posted Image]
Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

NEXT:

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NEXT:

OTL Custom Scan

We need to run an OTL Custom Scan

Please reopen [external image: Posted Image] on your desktop.
Copy and Paste the following bolded text into the [external image: Posted Image] textbox.

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Push [external image: Posted Image]
A report will open. Copy and Paste that report in your next reply.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that is produced after running the updated MalwareBytes' Anti-Malware scan.
3. The log that is produced after running the Kaspersky Online Virus Scanner.
4. The log that is produced after running the SecurityCheck scan.
5. The log that is produced after running the OTL scan.
6. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Cheers,
SweetTech.

aderynmawr

Post #17July 25, 2010, 4:28 AM UTC

Wow - what a marathon! Ok, here it all is:

1. Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4345

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

25/07/2010 00:51:28
mbam-log-2010-07-25 (00-51-28).txt

Scan type: Quick scan
Objects scanned: 136184
Time elapsed: 5 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

2. ——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, July 25, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, July 24, 2010 19:47:58
Records in database: 4221532
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
M:\
N:\

Scan statistics:
Objects scanned: 150233
Threats found: 10
Infected objects found: 13
Suspicious objects found: 0
Scan duration: 02:50:38

File name / Threat / Threats count
C:\Program Files\Eset\infected\0ARIO4DA.NQF Infected: Backdoor.IRC.Zapchast.zwrc 3
C:\Program Files\Eset\infected\0ARIO4DA.NQF Infected: not-a-virus:Client-IRC.Win32.mIRC.603 1
C:\Program Files\Eset\infected\3GIMHIDA.NQF Infected: Trojan.Win32.Autoit.wh 1
C:\Program Files\Eset\infected\HG3TRGCA.NQF Infected: Trojan-Spy.Win32.Zbot.alqh 1
C:\Program Files\Eset\infected\IFXTDFCA.NQF Infected: Trojan.Win32.Agent.cdiz 1
C:\Program Files\Eset\infected\IHB3Y5DA.NQF Infected: Trojan-Dropper.Win32.Joiner.ix 1
C:\Program Files\Eset\infected\MMQNBSAA.NQF Infected: Virus.Win32.Virut.ce 1
C:\Program Files\Eset\infected\NGH5TCDA.NQF Infected: Trojan.Win32.Autoit.bg 1
C:\Program Files\Eset\infected\USMIDMAA.NQF Infected: Trojan.Win32.Agent.cdiz 1
C:\Program Files\Eset\infected\UYIZYEAA.NQF Infected: Rootkit.Win32.TDSS.ap 1
J:\Xilisoft DVD Ripper Ultimate v5.0.51.1127\Stubs\0c910c1b44c87debd2d5e83b3508d5a1fa0b666\avc.exe Infected: Trojan.Win32.Buzus.dfuc 1

Selected area has been scanned.

3. Results of screen317's Security Check version 0.99.4
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
NOD32 antivirus system
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
TuneUp Utilities 2007
Java™ 6 Update 13
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 9
Out of date Adobe Reader installed!
Mozilla Firefox (3.0.11) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe is disabled!
Spybot Teatimer.exe is disabled!
Eset nod32krn.exe
````````````````````````````````
DNS Vulnerability Check:
Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

``````````End of Log````````````

4. OTL logfile created on: 25/07/2010 05:09:39 - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 52.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 185.39 Gb Free Space | 84.66% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.32% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.33 Mb Free Space | 54.69% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe (DT Soft Ltd)
PRC - C:\Program Files\Eset\nod32krn.exe (Eset )
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\OrangeBS\BEWInternetUK\Launcher\Launcher.exe (France Telecom SA)
PRC - C:\Program Files\OrangeBS\BEWInternetUK\Systray\SystrayApp.exe (France Telecom SA)
PRC - C:\Program Files\OrangeBS\BEWInternetUK\Phonetools\TextMessaging.exe (France Telecom SA)
PRC - C:\Program Files\OrangeBS\BEWInternetUK\Deskboard\Deskboard.exe (France Telecom SA)
PRC - C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe (France Telecom SA)
PRC - C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (France Telecom SA)
PRC - C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\corecom\CoreCom.exe (France Telecom SA)
PRC - C:\Program Files\Common Files\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe (France Telecom SA)
PRC - C:\Program Files\Common Files\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe (France Telecom SA)
PRC - C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe (France Telecom SA)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
PRC - C:\WINDOWS\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\WINDOWS\System32\lxcecoms.exe ( )
PRC - C:\WINDOWS\WindowsMobile\wmdSync.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) – C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (FTRTSVC) – C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (France Telecom SA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\WINDOWS\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\WINDOWS\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (UxTuneUp) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (lxce_device) – C:\Windows\System32\lxcecoms.exe ( )
SRV - (RoxMediaDB) – C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe (Sonic Solutions)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (atksgt) – C:\WINDOWS\System32\drivers\atksgt.sys ()
DRV - (lirsgt) – C:\WINDOWS\System32\drivers\lirsgt.sys ()
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) – C:\WINDOWS\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (AMON) – C:\Windows\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\Windows\system32\drivers\nod32drv.sys ()
DRV - (UsbserFilt) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (ZTEusbnmea) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (pccsmcfd) – C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (ZTEusbnmeaext) – C:\WINDOWS\System32\drivers\ZTEusbnmeaext.sys (ZTE Incorporated)
DRV - (MODEMCSA) – C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (igfx) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) – C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (e1express) Intel® – C:\WINDOWS\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (nvlddmkm) – C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.yahoo.com/?fr=fptb-"
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.93
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.1.0
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.0
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7
FF - prefs.js..extensions.enabledItems: {43c35458-c907-439b-bcfd-07d373834689}:2.2.1
FF - prefs.js..extensions.enabledItems: [removed]:0.7.4
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.5
FF - prefs.js..extensions.enabledItems: {B9C8BE50-7105-4ec6-8FB4-4935C0671648}:0.5.995
FF - prefs.js..extensions.enabledItems: {7102aba3-045c-4ec2-b921-46d87636d84b}:1.34
FF - prefs.js..extensions.enabledItems: {A4732521-77D9-447E-A557-B279AC923F06}:0.6.7
FF - prefs.js..extensions.enabledItems: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.306
FF - prefs.js..extensions.enabledItems: {FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}:4.0.4
FF - prefs.js..extensions.enabledItems: oldAddBookmarkBehavior@alice:2.0
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.713
FF - prefs.js..extensions.enabledItems: {f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}:1.7
FF - prefs.js..extensions.enabledItems: [removed]:0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.1.2
FF - prefs.js..extensions.enabledItems: {4aebcd37-f454-4928-9233-174a026ed367}:2.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.7.4
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08}:5.1
FF - prefs.js..extensions.enabledItems: {61D0D7AF-4FF6-476a-B68F-6531F613A6D8}:0.2.2
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:1.3
FF - prefs.js..extensions.enabledItems: {d176c86a-1eac-2cce-1757-bc0dbc6c526c}:0.993
FF - prefs.js..extensions.enabledItems: [removed]:3.7.8
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}:3.2.3.3
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?ourmark=1&ei;=utf-8&fr;=chr-nectar&slv8-;&type;=61465&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/06/02 08:15:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/16 15:49:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/17 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/10 15:03:34 | 000,000,000 | —D | M]

[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions
[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/07/25 01:01:27 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions
[2010/01/16 02:23:09 | 000,000,000 | —D | M] (Toolbar Buttons) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/22 18:18:04 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/05/13 16:00:37 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2010/01/16 02:22:47 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (FlashGot) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/05/13 16:00:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/13 16:00:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2009/03/21 03:38:09 | 000,000,000 | —D | M] (Send Tab URLs) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{4aebcd37-f454-4928-9233-174a026ed367}
[2009/03/20 23:25:23 | 000,000,000 | —D | M] (Qute Classic) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}
[2009/12/23 20:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{61D0D7AF-4FF6-476a-B68F-6531F613A6D8}
[2010/05/13 16:00:36 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/09/16 04:19:25 | 000,000,000 | —D | M] (History Submenus) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{7102aba3-045c-4ec2-b921-46d87636d84b}
[2010/05/13 17:36:37 | 000,000,000 | —D | M] (Nectar Search Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}
[2010/05/13 16:00:34 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/09/16 04:19:24 | 000,000,000 | —D | M] (deskCut) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9e48e253-edbc-4b52-9ebc-50a33a8d5ac4}
[2010/01/22 18:18:06 | 000,000,000 | —D | M] (Image Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{A4732521-77D9-447E-A557-B279AC923F06}
[2010/05/13 16:00:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (XE.com Universal Currency Converter ®) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{d176c86a-1eac-2cce-1757-bc0dbc6c526c}
[2010/07/15 18:06:26 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] (Pix2Fone) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}
[2010/07/05 18:56:58 | 000,000,000 | —D | M] (New Tab King) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2010/05/13 16:00:48 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/16 08:35:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/16 02:22:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/15 18:06:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:47 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/05 18:57:10 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/10 19:01:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\oldAddBookmarkBehavior@alice
[2010/05/13 16:00:24 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2008/12/25 00:18:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/03/21 03:38:11 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/12/23 20:24:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/15 17:02:37 | 000,002,180 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\bmrk-file-host-search.xml
[2009/03/21 00:56:31 | 000,001,504 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\imdb.xml
[2009/03/21 00:59:31 | 000,001,733 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\live-search.xml
[2010/01/15 17:02:02 | 000,001,871 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\madaras-rapidsearch.xml
[2009/03/23 17:53:35 | 000,002,137 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\MyStart Search.xml
[2009/03/21 00:57:09 | 000,001,976 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rapidshare-google-arama.xml
[2010/01/15 17:10:18 | 000,002,431 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rlslognet-search.xml
[2010/01/15 16:43:02 | 000,001,853 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\searchgeek-search-engine.xml
[2009/03/21 00:57:27 | 000,001,679 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\thepiratebayorg.xml
[2010/07/25 00:47:20 | 000,001,100 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\torrent-finder.xml
[2009/03/21 00:57:36 | 000,001,281 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\twitter-search.xml
[2010/01/15 17:07:13 | 000,001,680 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\warech.xml
[2009/03/21 00:58:02 | 000,001,032 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\wikipedia-eng.xml
[2009/03/21 00:58:30 | 000,001,224 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-answers.xml
[2010/05/13 17:43:52 | 000,001,078 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-search.xml
[2009/03/21 00:58:43 | 000,004,140 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\youtube.xml
[2010/07/25 01:01:27 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPcol305.dll
[2009/04/03 08:14:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/04/03 08:14:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/04/03 08:14:28 | 000,000,759 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/04/03 08:14:28 | 000,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/07/24 23:37:28 | 000,000,027 | —- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [BEWINTERNET-UKSessionManager] C:\Program Files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe (France Telecom SA)
O4 - HKLM..\Run: [CardDetectorZTEMF636] C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe (France Telecom SA)
O4 - HKLM..\Run: [LXCECATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL ()
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\WINDOWS\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 148
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 9696
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {2D337EB0-3BFB-42A3-B314-A24BBA8C085B} http://download.yahoo.com/dl/mail/yautoiol1.cab (YAutoImport Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: UxTuneUp - C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/07/25 00:40:22 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Roaming\Malwarebytes
[2010/07/25 00:39:56 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/07/25 00:39:55 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/07/25 00:39:54 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/07/25 00:39:53 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/25 00:20:53 | 006,153,376 | —- | C] (Malwarebytes Corporation ) – C:\Users\Keith\Desktop\mbam-setup-1.46.exe
[2010/07/24 23:44:19 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/07/24 23:38:02 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/07/24 23:35:38 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Local\temp
[2010/07/24 23:04:57 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/07/24 23:04:57 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/07/24 23:04:57 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/07/24 23:04:36 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/07/24 23:02:32 | 000,000,000 | —D | C] – C:\ComboFix
[2010/07/24 22:59:50 | 000,000,000 | —D | C] – C:\Qoobox
[2010/07/24 22:59:26 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/07/24 22:53:49 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/24 21:20:55 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/06/26 03:00:39 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/06/26 03:00:39 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/06/26 03:00:38 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/06/25 12:42:59 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/06/25 12:42:59 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2008/12/03 17:23:47 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxceserv.dll
[2008/12/03 17:23:47 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxceusb1.dll
[2008/12/03 17:23:47 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxcehbn3.dll
[2008/12/03 17:23:47 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxcepmui.dll
[2008/12/03 17:23:47 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxcelmpm.dll
[2008/12/03 17:23:47 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxceinpa.dll
[2008/12/03 17:23:47 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxceiesc.dll
[2008/12/03 17:23:47 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\lxcehcp.dll
[2008/12/03 17:23:47 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxceprox.dll
[2008/12/03 17:23:47 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxcepplc.dll
[2008/12/03 17:23:46 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxcecomc.dll
[2008/12/03 17:23:46 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxcecomm.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2050/01/01 01:00:00 | 001,340,928 | —- | M] () – C:\Users\Keith\Documents\Application form-carbon.doc
[2050/01/01 01:00:00 | 001,338,368 | —- | M] () – C:\Users\Keith\Documents\2006 Service-carbon (2).doc
[2050/01/01 01:00:00 | 001,336,320 | —- | M] () – C:\Users\Keith\Documents\2006 engine inspection-carbon (2).doc
[2050/01/01 01:00:00 | 000,340,480 | —- | M] () – C:\Users\Keith\Documents\2006Breakdown assistance form-carbon (2).doc
[2010/07/25 05:10:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/25 05:09:20 | 007,077,888 | -H– | M] () – C:\Users\Keith\ntuser.dat
[2010/07/25 04:34:51 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/25 04:34:51 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/25 02:00:52 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job
[2010/07/25 00:39:37 | 000,611,664 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/25 00:39:37 | 000,109,112 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/25 00:39:36 | 000,707,392 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/25 00:38:33 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/25 00:34:54 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/25 00:34:52 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/25 00:34:41 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/07/25 00:34:30 | 2138,628,096 | -HS- | M] () – C:\hiberfil.sys
[2010/07/25 00:33:17 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/25 00:33:15 | 000,524,288 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/25 00:33:15 | 000,065,536 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/25 00:33:12 | 002,001,891 | -H– | M] () – C:\Users\Keith\AppData\Local\IconCache.db
[2010/07/25 00:24:26 | 000,867,892 | —- | M] () – C:\Users\Keith\Desktop\SecurityCheck.exe
[2010/07/25 00:21:36 | 006,153,376 | —- | M] (Malwarebytes Corporation ) – C:\Users\Keith\Desktop\mbam-setup-1.46.exe
[2010/07/24 23:37:37 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/07/24 23:37:28 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/07/24 22:50:00 | 003,743,885 | R— | M] () – C:\Users\Keith\Desktop\ComboFix.exe
[2010/07/24 21:23:08 | 000,293,376 | —- | M] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/24 21:21:02 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/24 19:08:36 | 194,971,312 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\Windows\tasks\1-Click Maintenance.job
[2010/07/15 19:06:10 | 000,061,440 | —- | M] () – C:\Users\Keith\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/05 17:45:48 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/25 00:24:15 | 000,867,892 | —- | C] () – C:\Users\Keith\Desktop\SecurityCheck.exe
[2010/07/24 23:04:57 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/07/24 23:04:57 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/07/24 23:04:57 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/07/24 23:04:57 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/07/24 23:04:57 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/07/24 22:56:12 | 2138,628,096 | -HS- | C] () – C:\hiberfil.sys
[2010/07/24 22:49:24 | 003,743,885 | R— | C] () – C:\Users\Keith\Desktop\ComboFix.exe
[2010/07/24 21:23:02 | 000,293,376 | —- | C] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/23 18:05:51 | 194,971,312 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/07/05 17:45:48 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009/08/09 03:49:58 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/07/10 11:36:22 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009/07/10 07:51:33 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/16 23:50:49 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009/06/16 23:50:32 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009/06/06 01:11:11 | 000,281,504 | —- | C] () – C:\Windows\System32\drivers\atksgt.sys
[2009/06/06 01:11:11 | 000,025,888 | —- | C] () – C:\Windows\System32\drivers\lirsgt.sys
[2009/06/05 23:34:23 | 000,721,904 | —- | C] () – C:\Windows\System32\drivers\sptd.sys
[2009/03/20 15:04:35 | 000,015,424 | —- | C] () – C:\Windows\System32\drivers\nod32drv.sys
[2009/03/16 19:04:10 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/12/03 17:23:47 | 000,274,432 | —- | C] () – C:\Windows\System32\lxceinst.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/01 04:32:19 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2007/05/09 21:35:54 | 000,057,126 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/02/22 19:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxcecoin.dll
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:21 | 000,245,760 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/08/18 07:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\lxcevs.dll
[2005/02/24 18:23:52 | 000,061,440 | —- | C] () – C:\Windows\System32\lxcecnv4.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[1999/01/27 14:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1997/06/13 08:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2010/07/24 23:44:17 | 000,018,510 | —- | M] () – C:\ComboFix.txt
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/07/25 00:34:30 | 2138,628,096 | -HS- | M] () – C:\hiberfil.sys
[2008/12/03 17:57:06 | 000,006,598 | —- | M] () – C:\Installer.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/12/03 17:56:18 | 000,000,091 | —- | M] () – C:\LogiSetup.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\NPcol305.dll
[2010/07/25 00:34:29 | 2452,443,136 | -HS- | M] () – C:\pagefile.sys
[2007/06/06 07:40:26 | 000,000,000 | —- | M] () – C:\SMINST

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/09 10:07:23 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2007/01/30 07:53:28 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\System32\spool\prtprocs\w32x86\lxcepp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/12/24 17:13:56 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/04/11 07:27:47 | 000,241,128 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\rsaenh.dll
[2009/04/11 07:28:23 | 000,228,352 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 07:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/19 08:37:09 | 000,179,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 10:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\WINDOWS\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-15 02:03:08

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:F1DEA771
< End of report >

5. As far as I can tell so far, the PC seems to be pretty much back to normal…startup looks fine to me now

So what's the verdict? Can I tell my Dad that he has his computer back?

SweetTech

Post #18July 25, 2010, 3:10 PM UTC

Hello,

We are almost done. Just a few last things to take care of and then you should receive my all clear speech in my next post as well as instructions for cleaning up our tools.

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[2010/07/25 00:20:53 | 006,153,376 | —- | C] (Malwarebytes Corporation ) – C:\Users\Keith\Desktop\mbam-setup-1.46.exe
:Reg

:Files
J:\Xilisoft DVD Ripper Ultimate v5.0.51.1127\Stubs\0c910c1b44c87debd2d5e83b3508d5a1fa0b666\avc.exe
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "JDK 6 Update 21 (JDK or JRE)".
Click the "Download JRE" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

– Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
– Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note:
The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.
To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.

NEXT

Clean Java Cache & Temporary Files

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT:

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

Go to Start > Control Panel > Add/Remove Programs
Remove ALL instances of Adobe Reader
Re-boot your computer as required.
Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader

Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

NEXT:

Update FireFox
You are currently using an outdated version of Firefox. The latest version of Firefox is 3.6.8.

You can get the latest version of Firefox by accessing the Help menu in Firefox and then selecting Check for Updates. Please make sure that you Check for Updates again after updating to the latest version to make sure that you have in fact received the latest version.

aderynmawr

Post #19July 25, 2010, 4:10 PM UTC

All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found. C:\Users\Keith\Desktop\mbam-setup-1.46.exe moved successfully. ========== REGISTRY ========== ========== FILES ========== File\Folder J:\Xilisoft DVD Ripper Ultimate v5.0.51.1127\Stubs\0c910c1b44c87debd2d5e83b3508d5a1fa0b666\avc.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Keith ->Temp folder emptied: 108280076 bytes ->Temporary Internet Files folder emptied: 20460082 bytes ->Java cache emptied: 127542 bytes ->FireFox cache emptied: 42007587 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 1348 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 90 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 163.00 mb [EMPTYFLASH] User: All Users User: Default User: Default User User: Keith ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.9.1 log created on 07252010_164309 Files\Folders moved on Reboot… Registry entries deleted on Reboot… Doing the other updates now.

SweetTech

Post #20July 25, 2010, 6:06 PM UTC

Hello,

Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

Clean-Up Time

Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

NEXT:

OTL Clean-Up
Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

NEXT:

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
- If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
  - NoScript - for blocking ads and other potential website attacks
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.

aderynmawr

Post #21July 25, 2010, 8:32 PM UTC

Thank you so much SweetTech - you're a star! Not only is the PC back to normal - my Dad claims that it's also considerably faster than it was before

I appreciate all your help and patience

Aderynmawr.

SweetTech

Post #22July 25, 2010, 8:36 PM UTC

Your more than welcome. I'm glad I was able to be of assistance to you. Take Care. Cheers, ST.

SweetTech

Post #23July 25, 2010, 8:36 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Unknown Infection - please help!

✨ Ask AI

Ask AI