What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

not responding

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hi there I'm having trouble lately fire fox and explorer when I log on to the internet.They are either very slow or stop responding at all.I have to shut down the computer with the power switch on some occasions because nothing would work for me. I have run a scan for viruses but it has just come up with warnings rather than an actual virus.Would much appreciate some expert help,Thanks :pullhair:
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post
•Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
•This may cause a delay in response time, but I will do my best to keep it as short as possible.
•I will reply back shortly with instructions.
Post #3
Please do the following.

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs


  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.




[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.



In your next reply please post the following.
  • Both OTL logs
  • GMER log
Post #4
hi mowman,
thanks for replying,the scans are as follows
OTL Extras logfile created on: 04/08/2010 10:46:18 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

382.00 Mb Total Physical Memory | 194.00 Mb Available Physical Memory | 51.00% Memory free
920.00 Mb Paging File | 561.00 Mb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 28.96 Gb Free Space | 51.82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 8.00 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARTIN-BCC9A03E
Current User Name: martin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\PROGRA~1\MICROS~3\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\PROGRA~1\MICROS~3\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Files and Settings Transfer Wizard – (Microsoft Corporation)
"C:\Program Files\O2\O2 Broadband USB Modem\O2 Broadband.exe" = C:\Program Files\O2\O2 Broadband USB Modem\O2 Broadband.exe:*:Enabled:O2 Broadband – (Huawei Technologies Co., Ltd.)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02E22217-0E96-4C3F-B831-83AA942B7715}" = UserGuides
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3819891A-030B-4a4e-98ED-B28A649E48AB}" = HP Deskjet 3900 series
"{3EAAC5FD-E209-4856-8C49-D4EA40F85032}" = O2 Broadband USB Modem
"{42F6BED9-41DD-40F1-85A8-8E0350493626}" = HPDeskjet3900Series
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 1.01 A3
"{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}" = Microsoft SQL Server Native Client
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E0352EE-6F0D-4FBC-B1B8-4FF032C78BE0}" = PC Connectivity Solution
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_SMALLBUSINESSR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{96C0E73B-8813-4F4A-9EA1-D407C27AA1A1}" = TIxx21
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}" = Microsoft SQL Server VSS Writer
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C50EF365-2898-489A-B6C7-30DAA466E9A2}" = Nokia Connectivity Cable Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 5.10 B3
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows Driver Package - Nokia Modem (10/05/2009 4.2)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"CNXT_MODEM_PCI_VEN_1002&DEV_4378&SUBSYS_3085103C" = Data Fax SoftModem with SmartCP
"Conexant PCI Audio" = Conexant AC-Link Audio
"HP Imaging Device Functions" = HP Imaging Device Functions 5.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.0
"ie8" = Windows Internet Explorer 8
"InstallShield_{96C0E73B-8813-4F4A-9EA1-D407C27AA1A1}" = Texas Instruments PCIxx21/x515 drivers.
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Nokia PC Suite" = Nokia PC Suite
"QuickTime" = QuickTime
"RealPlayer 12.0" = RealPlayer
"SMALLBUSINESSR" = Microsoft Office Small Business 2007
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 03/08/2010 03:31:45 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

Error - 03/08/2010 03:46:10 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

Error - 03/08/2010 10:33:50 | Computer Name = MARTIN-BCC9A03E | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3855, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/08/2010 10:38:43 | Computer Name = MARTIN-BCC9A03E | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03/08/2010 10:38:43 | Computer Name = MARTIN-BCC9A03E | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 04/08/2010 03:14:27 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

Error - 04/08/2010 03:22:06 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

Error - 04/08/2010 03:45:07 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

Error - 04/08/2010 03:55:17 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

Error - 04/08/2010 05:18:01 | Computer Name = MARTIN-BCC9A03E | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 16/07/2010 13:56:27 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the iPod Service service
to connect.

Error - 28/07/2010 08:44:40 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 28/07/2010 08:44:40 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 28/07/2010 09:32:51 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Netman service.

Error - 28/07/2010 09:33:21 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 03/08/2010 03:37:51 | Computer Name = MARTIN-BCC9A03E | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service ServiceLayer
with arguments "" in order to run the server: {ACF50018-41F8-476D-85FD-CD953DAE4A49}

Error - 03/08/2010 03:38:04 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the ServiceLayer service
to connect.

Error - 03/08/2010 03:38:05 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7000
Description = The ServiceLayer service failed to start due to the following error:
%%1053

Error - 04/08/2010 03:17:05 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 04/08/2010 03:17:05 | Computer Name = MARTIN-BCC9A03E | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053


< End of report >
OTL logfile created on: 04/08/2010 10:46:18 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

382.00 Mb Total Physical Memory | 194.00 Mb Available Physical Memory | 51.00% Memory free
920.00 Mb Paging File | 561.00 Mb Available in Paging File | 61.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 28.96 Gb Free Space | 51.82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 8.00 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARTIN-BCC9A03E
Current User Name: martin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\O2\O2 Broadband USB Modem\O2 Broadband.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe (Hewlett-Packard )


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll ()
MOD - C:\WINDOWS\system32\msvcp71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (UsbserFilt) – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (pccsmcfd) – C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) – C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Company)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/07/16 11:10:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/27 16:14:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/27 16:14:36 | 000,000,000 | —D | M]

[2010/05/17 13:47:22 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\Mozilla\Extensions
[2010/08/04 10:33:09 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\Mozilla\Firefox\Profiles\lrqvny52.default\extensions
[2010/05/22 12:14:52 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\Mozilla\Firefox\Profiles\lrqvny52.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/17 13:46:08 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2007/07/27 13:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\NPJPI150_02.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Blue Sonic.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Blue Sonic.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/09 06:46:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.) - E:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2007/02/09 16:48:24 | 000,000,046 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{10398706-8b28-11df-b175-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{10398706-8b28-11df-b175-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{10398706-8b28-11df-b175-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{4086ca60-69a5-11df-b149-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{4086ca60-69a5-11df-b149-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4086ca60-69a5-11df-b149-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{4086ca62-69a5-11df-b149-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{4086ca62-69a5-11df-b149-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4086ca62-69a5-11df-b149-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{50f26536-1a71-11df-b0b7-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{50f26536-1a71-11df-b0b7-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{50f26536-1a71-11df-b0b7-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{50f26537-1a71-11df-b0b7-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{50f26537-1a71-11df-b0b7-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{50f26537-1a71-11df-b0b7-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{609bef7c-e56f-11de-b054-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{609bef7c-e56f-11de-b054-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{609bef7c-e56f-11de-b054-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6d512dfa-1a5f-11df-b0b5-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{6d512dfa-1a5f-11df-b0b5-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6d512dfa-1a5f-11df-b0b5-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{7905a9ee-1d7c-11df-b0be-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{7905a9ee-1d7c-11df-b0be-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7905a9ee-1d7c-11df-b0be-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{7905a9ef-1d7c-11df-b0be-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{7905a9ef-1d7c-11df-b0be-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7905a9ef-1d7c-11df-b0be-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{aa8e8970-e561-11de-b1ba-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{aa8e8970-e561-11de-b1ba-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{aa8e8970-e561-11de-b1ba-806d6172696f}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{b941048e-7715-11df-b15a-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{b941048e-7715-11df-b15a-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b941048e-7715-11df-b15a-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{c2d60b0e-e014-11de-8a5d-000fb0ba7399}\Shell - "" = AutoRun
O33 - MountPoints2\{c2d60b0e-e014-11de-8a5d-000fb0ba7399}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c2d60b0e-e014-11de-8a5d-000fb0ba7399}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{d5113316-5dd2-11df-b139-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{d5113316-5dd2-11df-b139-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d5113316-5dd2-11df-b139-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{d5113318-5dd2-11df-b139-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{d5113318-5dd2-11df-b139-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d5113318-5dd2-11df-b139-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{feff0948-6311-11df-b13f-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{feff0948-6311-11df-b13f-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{feff0948-6311-11df-b13f-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{feff094a-6311-11df-b13f-0014a5252f19}\Shell - "" = AutoRun
O33 - MountPoints2\{feff094a-6311-11df-b13f-0014a5252f19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{feff094a-6311-11df-b13f-0014a5252f19}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2007/03/03 19:19:40 | 000,077,824 | R— | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/16 11:09:55 | 000,185,920 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2010/07/16 11:09:38 | 000,006,656 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2010/07/16 11:09:38 | 000,005,632 | —- | C] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2010/07/16 11:09:18 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2010/07/16 11:08:32 | 000,278,528 | —- | C] (Real Networks, Inc) – C:\WINDOWS\System32\pncrt.dll
[2010/07/16 09:07:41 | 000,018,816 | —- | C] (Nokia) – C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2010/07/15 10:36:20 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/04 10:52:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/04 10:43:02 | 000,000,280 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1715567821-436374069-682003330-1003.job
[2010/08/04 10:42:52 | 000,000,288 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1715567821-436374069-682003330-1003.job
[2010/08/04 10:18:46 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/08/04 10:18:15 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/04 08:44:50 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/08/04 08:44:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/08/04 08:44:18 | 401,133,568 | -HS- | M] () – C:\hiberfil.sys
[2010/08/04 08:42:30 | 004,980,736 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\ntuser.dat
[2010/08/04 08:42:30 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\ntuser.ini
[2010/08/03 16:51:30 | 003,760,978 | -H– | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Local Settings\Application Data\IconCache.db
[2010/08/03 10:52:50 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\NIA Dawson Street LAS no 3.xls
[2010/07/28 14:22:35 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/07/27 07:30:35 | 008,462,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shell32.dll
[2010/07/26 15:25:04 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Labour Allocation Sheets darius BOI no 4.xls
[2010/07/26 15:20:25 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\jflanagan no19.xls
[2010/07/26 15:17:18 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\NIA Dawson Street LAS no 2.xls
[2010/07/21 13:01:00 | 000,037,888 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\RFI_No _003 dawson street.doc
[2010/07/19 14:49:33 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\NIA Dawson Street LAS no 1.xls
[2010/07/19 14:48:52 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Labour Allocation Sheets darius BOI no 3.xls
[2010/07/19 14:46:52 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of Copy of jflanagan no18.xls
[2010/07/16 11:28:24 | 013,359,403 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Nirvana - Lithium (Live Loud).flv
[2010/07/16 11:10:23 | 000,000,929 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\RealPlayer SP.lnk
[2010/07/16 11:09:55 | 000,185,920 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2010/07/16 11:09:38 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2010/07/16 11:09:38 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2010/07/16 11:08:33 | 000,499,712 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcp71.dll
[2010/07/16 11:08:33 | 000,348,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr71.dll
[2010/07/16 11:08:32 | 000,278,528 | —- | M] (Real Networks, Inc) – C:\WINDOWS\System32\pncrt.dll
[2010/07/16 09:08:12 | 000,001,763 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Nokia PC Suite.lnk
[2010/07/15 22:41:47 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/07/13 14:07:14 | 000,037,888 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\RFI_No _002 dawson street.doc
[2010/07/13 14:07:14 | 000,000,162 | -H– | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\~$I_No _002 dawson street.doc
[2010/07/13 09:34:01 | 000,038,400 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\RFI_No _001 dawson street.doc
[2010/07/12 14:32:04 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of jflanagan no17.xls
[2010/07/12 14:31:17 | 000,043,520 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of Labour Allocation Sheets darius BOI no 2.xls
[2010/07/12 14:09:57 | 000,044,032 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of boi LAS no 18.xls
[2010/07/09 08:58:31 | 000,040,448 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\BOI Ballyfermot - Snag List WESLIN).doc
[2010/07/09 08:03:23 | 000,042,496 | —- | M] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\BOI Ballyfermot - Snag List PAINTER.doc
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/03 10:52:49 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\NIA Dawson Street LAS no 3.xls
[2010/07/26 15:25:04 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Labour Allocation Sheets darius BOI no 4.xls
[2010/07/26 15:20:25 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\jflanagan no19.xls
[2010/07/26 15:17:07 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\NIA Dawson Street LAS no 2.xls
[2010/07/26 09:36:47 | 000,000,280 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1715567821-436374069-682003330-1003.job
[2010/07/21 13:00:57 | 000,037,888 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\RFI_No _003 dawson street.doc
[2010/07/19 14:45:33 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of Copy of jflanagan no18.xls
[2010/07/19 14:41:55 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Labour Allocation Sheets darius BOI no 3.xls
[2010/07/19 14:38:31 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\NIA Dawson Street LAS no 1.xls
[2010/07/16 18:47:16 | 013,359,403 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Nirvana - Lithium (Live Loud).flv
[2010/07/16 11:10:23 | 000,000,929 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\RealPlayer SP.lnk
[2010/07/13 14:07:14 | 000,000,162 | -H– | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\~$I_No _002 dawson street.doc
[2010/07/13 14:07:13 | 000,037,888 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\RFI_No _002 dawson street.doc
[2010/07/13 09:34:00 | 000,038,400 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\RFI_No _001 dawson street.doc
[2010/07/12 14:31:17 | 000,043,520 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of Labour Allocation Sheets darius BOI no 2.xls
[2010/07/12 14:17:09 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of jflanagan no17.xls
[2010/07/12 14:09:56 | 000,044,032 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\Copy of boi LAS no 18.xls
[2010/07/09 08:58:31 | 000,040,448 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\BOI Ballyfermot - Snag List WESLIN).doc
[2010/07/09 08:03:21 | 000,042,496 | —- | C] () – C:\Documents and Settings\martin.MARTIN-BCC9A03E\My Documents\BOI Ballyfermot - Snag List PAINTER.doc
[2010/05/26 16:13:25 | 000,000,010 | —- | C] () – C:\WINDOWS\WININIT.INI
[2010/04/11 21:43:01 | 000,000,605 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2010/04/02 12:41:36 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2010/04/02 12:41:36 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2010/04/02 12:41:35 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2010/04/02 12:41:35 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2010/04/02 12:41:35 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2010/04/02 12:41:35 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2010/01/25 11:49:21 | 000,372,736 | —- | C] () – C:\WINDOWS\System32\hpzidi01.dll
[2010/01/25 11:49:21 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2006/02/09 15:29:54 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\VSHP1020.DLL

========== LOP Check ==========

[2010/01/16 11:54:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2010/01/16 11:54:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9
[2010/02/02 19:15:50 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\CanonBJ
[2010/05/03 12:24:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
[2010/05/03 12:17:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\OviInstallerCache
[2010/05/03 13:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
[2010/03/15 13:46:57 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/01/09 14:19:59 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\GetRightToGo
[2010/06/11 23:49:58 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\InterVideo
[2010/05/03 14:13:14 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\Nokia
[2010/07/16 17:02:37 | 000,000,000 | —D | M] – C:\Documents and Settings\martin.MARTIN-BCC9A03E\Application Data\PC Suite

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/09/09 06:46:09 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/12/10 09:34:54 | 000,000,414 | -HS- | M] () – C:\boot.ini
[2009/09/09 06:46:09 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/04/02 12:38:15 | 000,031,641 | —- | M] () – C:\DNSP1.LOG
[2007/07/15 12:52:48 | 000,000,000 | —- | M] () – C:\hfcrgrt.ini
[2010/08/04 08:44:18 | 401,133,568 | -HS- | M] () – C:\hiberfil.sys
[2010/04/02 13:04:53 | 000,000,171 | —- | M] () – C:\HSC.log
[2006/05/04 10:52:14 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/09/24 08:34:06 | 000,000,081 | —- | M] () – C:\lxcr.log
[2010/04/02 13:10:29 | 000,000,161 | —- | M] () – C:\mscuxp.log
[2006/05/04 10:52:14 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/07/27 13:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/09/17 07:49:51 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/08/04 08:44:16 | 603,979,776 | -HS- | M] () – C:\pagefile.sys
[2007/07/15 12:52:48 | 000,000,014 | —- | M] () – C:\Portprcr.dvr
[2010/04/02 13:12:29 | 000,000,200 | —- | M] () – C:\sedinst2.log
[2010/04/02 13:23:23 | 000,000,171 | —- | M] () – C:\setup.log
[2008/11/16 06:04:17 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2008/11/30 03:49:15 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2008/12/11 17:34:25 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2009/01/14 19:50:13 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2009/02/25 15:29:45 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2009/02/25 16:27:01 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2008/11/16 06:04:17 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/11/30 03:49:15 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/12/11 17:34:25 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2009/01/14 19:50:13 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2009/02/25 15:29:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2009/02/25 16:27:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2010/04/02 13:22:46 | 000,020,978 | —- | M] () – C:\sunjava.log
[2010/04/02 13:07:55 | 000,000,191 | —- | M] () – C:\syntp.log
[2010/04/02 12:28:31 | 000,000,032 | —- | M] () – C:\ticrdbus.log
[2007/07/15 12:52:48 | 000,000,014 | —- | M] () – C:\Winvdrvr.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/12/10 09:56:11 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/03/10 21:00:00 | 000,027,136 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD9M.DLL
[2008/03/10 21:00:00 | 000,069,632 | —- | M] (CANON INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP9M.DLL
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/04/08 20:43:36 | 000,067,072 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll
[2006/02/09 15:29:52 | 000,049,152 | —- | M] (Zenographics, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\IMFPRINT.DLL
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/12/10 09:19:02 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/12/10 09:19:02 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/12/10 09:19:02 | 000,897,024 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 01:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 01:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 01:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-04 07:27:42
< End of report >
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-04 12:19:20
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\MARTIN~1.MAR\LOCALS~1\Temp\kgtiyfob.sys


—- System - GMER 1.0.15 —-

SSDT F7C1FEEE ZwCreateKey
SSDT F7C1FEE4 ZwCreateThread
SSDT F7C1FEF3 ZwDeleteKey
SSDT F7C1FEFD ZwDeleteValueKey
SSDT F7C1FF02 ZwLoadKey
SSDT F7C1FED0 ZwOpenProcess
SSDT F7C1FED5 ZwOpenThread
SSDT F7C1FF0C ZwReplaceKey
SSDT F7C1FF07 ZwRestoreKey
SSDT F7C1FEF8 ZwSetValueKey
SSDT F7C1FEDF ZwTerminateProcess

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[3592] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)

—- EOF - GMER 1.0.15 —-
Post #5
Please do the following.

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #6
mowman,
combofix log
ComboFix 10-08-04.05 - martin 05/08/2010 8:57.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.382.194 [GMT 1:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2010-07-05 to 2010-08-05 )))))))))))))))))))))))))))))))
.

2010-08-04 14:18 . 2007-05-31 19:36 88960 —-a-w- c:\windows\system32\drivers\ewusbmdm.sys
2010-08-04 14:18 . 2007-05-31 19:36 24448 —-a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-07-16 10:09 . 2010-07-16 10:09 ——– d—–w- c:\program files\Common Files\xing shared
2010-07-16 08:07 . 2008-08-26 08:26 18816 —-a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-07-15 09:36 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 16:02 . 2010-05-03 12:18 ——– d—–w- c:\documents and settings\martin.MARTIN-BCC9A03E\Application Data\PC Suite
2010-07-16 10:10 . 2010-07-16 10:10 45056 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-16 10:10 . 2010-07-16 10:10 45056 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-16 10:10 . 2010-07-16 10:10 45056 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-16 10:10 . 2010-07-16 10:10 45056 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-16 10:10 . 2010-07-16 10:10 49152 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-16 10:10 . 2010-07-16 10:10 308808 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-16 10:10 . 2010-07-16 10:10 14848 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-16 10:10 . 2010-07-16 10:10 40960 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-07-16 10:10 . 2010-07-16 10:10 341600 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-16 10:09 . 2009-09-21 15:27 ——– d—–w- c:\program files\Real
2010-07-16 10:08 . 2010-01-22 09:50 348160 —-a-w- c:\windows\system32\msvcr71.dll
2010-07-16 10:08 . 2010-01-22 09:50 499712 —-a-w- c:\windows\system32\msvcp71.dll
2010-07-16 10:08 . 2009-09-21 15:27 ——– d—–w- c:\program files\Common Files\Real
2010-07-16 09:50 . 2009-12-16 13:08 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2010-07-16 08:06 . 2009-09-22 12:56 ——– d—–w- c:\program files\PC Connectivity Solution
2010-07-15 21:37 . 2009-12-10 13:05 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2010-06-14 14:31 . 2009-12-10 08:51 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-11 22:49 . 2010-06-11 22:49 ——– d—–w- c:\documents and settings\martin.MARTIN-BCC9A03E\Application Data\InterVideo
2010-05-26 16:12 . 2010-05-26 16:12 86016 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\arh.exe
2010-05-26 15:17 . 2010-05-26 15:17 0 —-a-w- c:\windows\system32\atiicdxx.dat
2010-05-26 15:02 . 2009-12-10 08:55 89251 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-05-17 12:47 . 2010-05-17 12:47 0 —-a-w- c:\windows\nsreg.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-16 39408]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-04-02 98304]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_02\bin\jusched.exe" [2005-03-04 36975]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 794624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-16 202256]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\O2\\O2 Broadband USB Modem\\O2 Broadband.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [18/01/2010 15:34 108289]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [15/12/2009 09:10 30104]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [02/04/2010 12:29 200192]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2010 11:32 135664]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [15/12/2009 09:10 30104]
.
Contents of the 'Scheduled Tasks' folder

2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 10:32]

2010-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 10:32]

2010-08-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1715567821-436374069-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 02:02]

2010-08-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1715567821-436374069-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 02:02]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q305&bd=pavilion&pf=laptop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\martin.MARTIN-BCC9A03E\Application Data\Mozilla\Firefox\Profiles\lrqvny52.default\
FF - component: c:\documents and settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-05 09:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????????n??|?????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1104)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1628)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-08-05 09:13:31
ComboFix-quarantined-files.txt 2010-08-05 08:13

Pre-Run: 31,011,344,384 bytes free
Post-Run: 32,352,346,112 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional" /fastdetect

- - End Of File - - AF50CE389215168DDFFC49F089F647C6
Post #7
Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please




I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #8
Mowman, scan results for malwarebytes and eset scanner Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4397 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 06/08/2010 12:16:34 mbam-log-2010-08-06 (12-16-34).txt Scan type: Quick scan Objects scanned: 193969 Time elapsed: 17 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Mowman, eset scanner didnt give a log it just said no threats detected
Post #9
Hello,there are no signs of malware in any of your logs,i would suggest that the problem is related to your o2 mobile broadband.I have had similar problems with my 3mobile version of it.
The best thing for you to do would be to contact o2 customer support and see what they can do for you.

Please do the following to clean up the tools we have used and update a couple of programs.


ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)




Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.


[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 21 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 21 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u21 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI