somesh
Topic Starter
PROBLEM :
As I switch on the wireless adapter, two warnings pop out
1) service and controller app has stopped working
2) your computer will restart in 1 min.
After going through malware removal guide I downloaded OLT , and followed the steps as mentioned.
I am attaching the two reports generated by it, OLT.txt and Extras.txt. [see attatchments]
Please help me further.
OTL logfile created on: 31-08-2010 04:49:19 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\dell\Desktop
Windows Vista Ultimate Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16386)
Locale: 00004009 | Country: India | Language: ENN | Date Format: dd-MM-yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48.83 Gb Total Space | 9.76 Gb Free Space | 19.98% Space Free | Partition Type: NTFS
Drive D: | 78.13 Gb Total Space | 54.28 Gb Free Space | 69.47% Space Free | Partition Type: NTFS
Drive E: | 78.13 Gb Total Space | 38.63 Gb Free Space | 49.44% Space Free | Partition Type: NTFS
Drive F: | 93.00 Gb Total Space | 24.16 Gb Free Space | 25.97% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 960.25 Mb Total Space | 153.91 Mb Free Space | 16.03% Space Free | Partition Type: FAT32
I: Drive not present or media not loaded
Computer Name: SOMESH
Current User Name: dell
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ==========
PRC - C:\Users\dell\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files\WordWeb\wweb32.exe (WordWeb Software)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
========== Modules (SafeList) ==========
MOD - C:\Users\dell\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\BtMmHook.dll (Broadcom Corporation.)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (GoogleDesktopManager-051210-111108) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (SolidWorks Licensing Service) – C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (osppsvc) – C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (zteusbser) – C:\Windows\System32\DRIVERS\ztemtusbser.sys File not found
DRV - (pccsmcfd) – C:\Windows\System32\DRIVERS\pccsmcfd.sys File not found
DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (mferkdk) – C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (hwusbdev) – C:\Windows\System32\DRIVERS\ewusbdev.sys File not found
DRV - (hwdatacard) – C:\Windows\System32\DRIVERS\ewusbmdm.sys File not found
DRV - (DFUBTUSB) – C:\Windows\System32\Drivers\frmupgr.sys File not found
DRV - (catchme) – C:\Users\dell\AppData\Local\Temp\catchme.sys File not found
DRV - (BTWUSB) – C:\Windows\System32\Drivers\btwusb.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (Haspnt) – C:\Windows\System32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (sptd) – C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (epfwtdir) – C:\Windows\System32\drivers\epfwtdir.sys (ESET)
DRV - (ehdrv) – C:\Windows\System32\drivers\ehdrv.sys (ESET)
DRV - (eamon) – C:\Windows\System32\drivers\eamon.sys (ESET)
DRV - (RTSTOR) – C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (OA009Vid) – C:\Windows\System32\drivers\OA009Vid.sys (Creative Technology Ltd.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (yukonwlh) – C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (OA009Ufd) – C:\Windows\System32\drivers\OA009Ufd.sys (Creative Technology Ltd.)
DRV - (btwaudio) – C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwavdt) – C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwrchid) – C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (btwl2cap) – C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV - (RLDesignVirtualAudioCableWdm) – C:\Windows\System32\drivers\livecamv.sys ()
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (Hardlock) – C:\Windows\System32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 144.*;;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 144.0.1.235:80
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-08-20 18:40:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-07-29 23:14:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-08-28 21:45:22 | 000,000,000 | —D | M]
[2010-04-12 20:15:32 | 000,000,000 | —D | M] – C:\Users\dell\AppData\Roaming\mozilla\Extensions
[2010-04-12 20:15:32 | 000,000,000 | —D | M] – C:\Users\dell\AppData\Roaming\mozilla\Firefox\Profiles\qzwlvl51.default\extensions
[2010-04-12 20:14:46 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009-08-07 10:38:10 | 000,044,544 | —- | M] (BitDefender S.R.L.) – C:\Program Files\Mozilla Firefox\components\FFComm.dll
[2009-12-09 04:58:24 | 000,274,432 | —- | M] (Dassault Systèmes SolidWorks Corp.) – C:\Program Files\Mozilla Firefox\plugins\npEModelPlugin.dll
O1 HOSTS File: ([2006-09-19 03:11:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (QUICKfind BHO Object) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files\IDM\QUICKfind\PlugIns\IEHelp.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [WordWeb] C:\Program Files\WordWeb\wweb32.exe (WordWeb Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} http://144.0.5.123:8080/dwa7W.cab (Domino Web Access 7 Control)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\textwareilluminatorbase {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\Windows\System32\textwareilluminatorbaseProtocol.dll ()
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\dell\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\dell\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-09-19 03:13:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010-05-02 13:37:47 | 000,000,000 | —D | M] - C:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2010-05-02 13:37:47 | 000,000,000 | —D | M] - D:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2010-08-30 22:12:03 | 000,000,000 | -H-D | M] - E:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2010-05-02 13:37:47 | 000,000,000 | —D | M] - F:\AUTORUN.INF – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk /r \??\J:) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.divxa32 - C:\Windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2010-08-31 16:46:09 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\dell\Desktop\OTL.exe
[2010-08-30 21:49:45 | 000,000,000 | —D | C] – C:\Windows\temp
[2010-08-30 21:49:12 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010-08-30 20:20:36 | 000,000,000 | —D | C] – C:\Users\dell\AppData\Local\temp
[2010-08-30 20:08:49 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010-08-30 20:08:49 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010-08-30 20:08:49 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010-08-30 20:08:49 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010-08-30 20:08:41 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010-08-30 20:06:44 | 000,000,000 | —D | C] – C:\Qoobox
[2010-08-29 18:36:15 | 000,000,000 | —D | C] – C:\Users\dell\AppData\Local\ESET
[2010-08-28 21:45:20 | 000,000,000 | —D | C] – C:\ProgramData\ESET
[2010-08-28 21:45:20 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010-08-25 19:50:28 | 000,000,000 | —D | C] – C:\Users\dell\Pictures
[2010-08-25 15:42:53 | 000,000,000 | —D | C] – C:\Program Files\SolidWorks
[2010-08-22 05:47:29 | 000,000,000 | —D | C] – C:\ProgramData\WordWeb
[2010-08-22 05:46:40 | 001,524,936 | —- | C] (WordWeb Software) – C:\Windows\wweb32.dll
[2010-08-22 05:46:37 | 000,000,000 | —D | C] – C:\Program Files\WordWeb
[2010-08-19 15:37:48 | 000,000,000 | —D | C] – C:\ProgramData\Zbshareware Lab
[2010-08-17 01:06:26 | 000,000,000 | —D | C] – C:\Users\dell\Documents\My Google Gadgets
[2010-08-14 16:40:30 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2010-08-07 00:54:14 | 000,000,000 | —D | C] – C:\Users\dell\Desktop\1 month
[2010-08-05 19:42:48 | 000,000,000 | —D | C] – C:\Program Files\gAlwaysIdle
========== Files - Modified Within 30 Days ==========
[2010-08-31 16:51:12 | 000,784,896 | —- | M] () – C:\Windows\System32\drivers\ddmtoxz.sys
[2010-08-31 16:48:19 | 004,718,592 | -HS- | M] () – C:\Users\dell\ntuser.dat
[2010-08-31 16:42:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\dell\Desktop\OTL.exe
[2010-08-31 16:40:05 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3833408539-2285171306-2665556084-1000UA.job
[2010-08-31 16:27:06 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010-08-31 16:27:06 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010-08-31 14:56:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010-08-31 13:42:22 | 000,626,246 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010-08-31 13:42:22 | 000,109,370 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010-08-31 13:42:21 | 000,720,952 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010-08-31 13:27:06 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010-08-31 13:26:58 | 3181,760,512 | -HS- | M] () – C:\hiberfil.sys
[2010-08-30 22:45:47 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010-08-30 22:45:43 | 001,674,540 | -H– | M] () – C:\Users\dell\AppData\Local\IconCache.db
[2010-08-30 21:48:05 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010-08-28 21:37:39 | 000,000,155 | —- | M] () – C:\Windows\winamp.ini
[2010-08-28 21:29:55 | 000,000,069 | —- | M] () – C:\Windows\NeroDigital.ini
[2010-08-27 15:01:21 | 000,057,344 | —- | M] () – C:\Users\dell\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-08-26 18:34:32 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3833408539-2285171306-2665556084-1000Core.job
[2010-08-26 07:35:54 | 000,389,144 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010-08-25 16:40:09 | 000,000,038 | —- | M] () – C:\Windows\avisplitter.INI
[2010-08-25 16:06:14 | 000,107,760 | —- | M] () – C:\Users\dell\AppData\Local\GDIPFONTCACHEV1.DAT
[2010-08-25 15:52:50 | 000,001,900 | —- | M] () – C:\Users\dell\Application Data\Microsoft\Internet Explorer\Quick Launch\eDrawings 2004.lnk
[2010-08-25 15:52:50 | 000,001,876 | —- | M] () – C:\Users\Public\Desktop\eDrawings 2004.lnk
[2010-08-25 15:49:17 | 000,000,023 | -H– | M] () – C:\Windows\yacht.xws
[2010-08-20 18:40:41 | 000,001,043 | —- | M] () – C:\Users\Public\Desktop\Google Desktop.lnk
========== Files Created - No Company Name ==========
[2010-08-30 20:08:49 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010-08-30 20:08:49 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010-08-30 20:08:49 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010-08-30 20:08:49 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010-08-30 20:08:49 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010-08-28 15:25:35 | 000,784,896 | —- | C] () – C:\Windows\System32\drivers\ddmtoxz.sys
[2010-08-25 15:52:50 | 000,001,900 | —- | C] () – C:\Users\dell\Application Data\Microsoft\Internet Explorer\Quick Launch\eDrawings 2004.lnk
[2010-08-25 15:52:50 | 000,001,876 | —- | C] () – C:\Users\Public\Desktop\eDrawings 2004.lnk
[2010-08-20 18:40:41 | 000,001,043 | —- | C] () – C:\Users\Public\Desktop\Google Desktop.lnk
[2010-07-17 13:44:07 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.INI
[2010-06-18 09:40:53 | 000,000,383 | —- | C] () – C:\Windows\System32\haspdos.sys
[2010-06-17 18:11:44 | 000,000,662 | —- | C] () – C:\Program Files\SolidWorksswxJRNL.BAK
[2010-06-17 18:06:51 | 000,639,052 | —- | C] () – C:\Windows\System32\BBPDFPortMon.dll
[2010-05-05 19:03:57 | 000,000,600 | —- | C] () – C:\Users\dell\AppData\Local\PUTTY.RND
[2010-04-06 22:12:24 | 000,000,000 | —- | C] () – C:\Windows\eDrawingOfficeAutomator.INI
[2009-10-22 21:07:17 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009-10-12 16:24:52 | 000,000,063 | —- | C] () – C:\Windows\TEXTware.ini
[2009-10-12 16:24:50 | 000,321,024 | —- | C] () – C:\Windows\System32\textwareilluminatorbaseProtocol.dll
[2009-10-12 16:24:49 | 000,147,456 | —- | C] () – C:\Windows\System32\Twavbx32.dll
[2009-10-12 16:24:49 | 000,113,288 | —- | C] () – C:\Windows\System32\bass.dll
[2009-10-12 16:24:49 | 000,018,432 | —- | C] () – C:\Windows\System32\TWAIED02.DLL
[2009-10-12 16:24:47 | 000,143,360 | —- | C] () – C:\Windows\System32\ILXTBS.DLL
[2009-10-12 00:59:11 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009-09-27 14:33:53 | 000,000,518 | —- | C] () – C:\Users\dell\AppData\Roaming\alarms.ini
[2009-09-27 14:33:52 | 000,000,747 | —- | C] () – C:\Users\dell\AppData\Roaming\AtomicAlarmClock.ini
[2009-07-16 00:52:18 | 000,031,616 | —- | C] () – C:\Windows\System32\drivers\livecamv.sys
[2009-06-30 11:51:45 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2009-06-30 11:51:42 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009-06-30 11:51:41 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2009-06-30 11:51:41 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009-06-30 11:51:40 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009-06-30 11:51:40 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2009-06-30 10:12:40 | 000,024,206 | —- | C] () – C:\Users\dell\AppData\Roaming\UserTile.png
[2009-06-10 18:24:52 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009-06-10 18:11:54 | 000,000,155 | —- | C] () – C:\Windows\winamp.ini
[2009-06-10 18:09:54 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009-06-10 18:09:50 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009-06-10 17:54:31 | 000,057,344 | —- | C] () – C:\Users\dell\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-06-10 16:03:00 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1576.dll
[2009-06-10 16:02:26 | 000,006,656 | —- | C] () – C:\Windows\System32\bcmwlrc.dll
[2009-06-10 16:02:23 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2009-06-10 15:41:53 | 000,001,356 | —- | C] () – C:\Users\dell\AppData\Local\d3d9caps.dat
[2006-11-02 18:04:23 | 000,080,010 | —- | C] () – C:\Windows\System32\manage-bde.ini.en
[2006-11-02 18:04:20 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006-11-02 13:10:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006-06-13 16:35:32 | 000,053,760 | —- | C] () – C:\Windows\System32\zlib.dll
[2004-09-10 19:06:12 | 000,327,680 | —- | C] () – C:\Windows\System32\QFClient2.dll
[2003-01-30 06:04:00 | 000,618,496 | —- | C] () – C:\Windows\System32\stlpmt45.dll
[2001-11-14 13:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll
========== LOP Check ==========
[2010-08-30 22:45:47 | 000,032,594 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2010-05-07 21:53:58 | 000,002,006 | —- | M] () – C:\aqua_bitmap.cpp
[2006-09-19 03:13:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2006-11-02 15:23:57 | 000,438,840 | RHS- | M] () – C:\bootmgr
[2009-06-11 05:03:52 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2010-08-30 21:49:44 | 000,016,456 | —- | M] () – C:\ComboFix.txt
[2006-09-19 03:13:37 | 000,000,010 | —- | M] () – C:\config.sys
[2007-03-17 17:11:22 | 000,171,136 | RHS- | M] () – C:\grldr
[2010-08-31 13:26:58 | 3181,760,512 | -HS- | M] () – C:\hiberfil.sys
[2009-06-10 18:10:32 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009-06-10 18:10:32 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010-08-31 13:26:57 | 3495,686,144 | -HS- | M] () – C:\pagefile.sys
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pcconf.ini
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pcwords.dat
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pcwords2.dat
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pc_sign.slf
[2009-07-16 00:52:52 | 000,000,159 | —- | M] () – C:\SetupLCV.log
< %systemroot%\Fonts\*.com >
[2006-11-02 18:05:26 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006-11-02 18:05:26 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006-11-02 18:05:26 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006-11-02 18:05:26 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2006-09-19 03:07:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006-11-02 18:04:09 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2003-06-18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006-10-26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2006-11-02 18:19:43 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2010-06-17 18:22:01 | 000,000,662 | —- | M] () – C:\Program Files\SolidWorksswxJRNL.BAK
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2006-11-02 16:04:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006-11-02 16:04:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006-11-02 16:04:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006-11-02 16:04:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006-11-02 16:04:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009-06-27 07:48:40 | 000,000,286 | -HS- | M] () – C:\Users\dell\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2007-12-20 16:32:06 | 000,152,064 | —- | M] (Kevin Solway Software) – C:\Users\dell\Desktop\deletedr.exe
[2010-08-31 16:42:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\dell\Desktop\OTL.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
========== Alternate Data Streams ==========
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:1C322B97
< End of report >
As I switch on the wireless adapter, two warnings pop out
1) service and controller app has stopped working
2) your computer will restart in 1 min.
After going through malware removal guide I downloaded OLT , and followed the steps as mentioned.
I am attaching the two reports generated by it, OLT.txt and Extras.txt. [see attatchments]
Please help me further.
OTL logfile created on: 31-08-2010 04:49:19 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\dell\Desktop
Windows Vista Ultimate Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16386)
Locale: 00004009 | Country: India | Language: ENN | Date Format: dd-MM-yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48.83 Gb Total Space | 9.76 Gb Free Space | 19.98% Space Free | Partition Type: NTFS
Drive D: | 78.13 Gb Total Space | 54.28 Gb Free Space | 69.47% Space Free | Partition Type: NTFS
Drive E: | 78.13 Gb Total Space | 38.63 Gb Free Space | 49.44% Space Free | Partition Type: NTFS
Drive F: | 93.00 Gb Total Space | 24.16 Gb Free Space | 25.97% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 960.25 Mb Total Space | 153.91 Mb Free Space | 16.03% Space Free | Partition Type: FAT32
I: Drive not present or media not loaded
Computer Name: SOMESH
Current User Name: dell
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ==========
PRC - C:\Users\dell\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files\WordWeb\wweb32.exe (WordWeb Software)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
========== Modules (SafeList) ==========
MOD - C:\Users\dell\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\BtMmHook.dll (Broadcom Corporation.)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (GoogleDesktopManager-051210-111108) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (SolidWorks Licensing Service) – C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (osppsvc) – C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (zteusbser) – C:\Windows\System32\DRIVERS\ztemtusbser.sys File not found
DRV - (pccsmcfd) – C:\Windows\System32\DRIVERS\pccsmcfd.sys File not found
DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (mferkdk) – C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (hwusbdev) – C:\Windows\System32\DRIVERS\ewusbdev.sys File not found
DRV - (hwdatacard) – C:\Windows\System32\DRIVERS\ewusbmdm.sys File not found
DRV - (DFUBTUSB) – C:\Windows\System32\Drivers\frmupgr.sys File not found
DRV - (catchme) – C:\Users\dell\AppData\Local\Temp\catchme.sys File not found
DRV - (BTWUSB) – C:\Windows\System32\Drivers\btwusb.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (Haspnt) – C:\Windows\System32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (sptd) – C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (epfwtdir) – C:\Windows\System32\drivers\epfwtdir.sys (ESET)
DRV - (ehdrv) – C:\Windows\System32\drivers\ehdrv.sys (ESET)
DRV - (eamon) – C:\Windows\System32\drivers\eamon.sys (ESET)
DRV - (RTSTOR) – C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (BCM43XX) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (BCM42RLY) – C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (OA009Vid) – C:\Windows\System32\drivers\OA009Vid.sys (Creative Technology Ltd.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (yukonwlh) – C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (OA009Ufd) – C:\Windows\System32\drivers\OA009Ufd.sys (Creative Technology Ltd.)
DRV - (btwaudio) – C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwavdt) – C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwrchid) – C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (btwl2cap) – C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV - (RLDesignVirtualAudioCableWdm) – C:\Windows\System32\drivers\livecamv.sys ()
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (Hardlock) – C:\Windows\System32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 144.*;;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 144.0.1.235:80
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-08-20 18:40:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-07-29 23:14:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-08-28 21:45:22 | 000,000,000 | —D | M]
[2010-04-12 20:15:32 | 000,000,000 | —D | M] – C:\Users\dell\AppData\Roaming\mozilla\Extensions
[2010-04-12 20:15:32 | 000,000,000 | —D | M] – C:\Users\dell\AppData\Roaming\mozilla\Firefox\Profiles\qzwlvl51.default\extensions
[2010-04-12 20:14:46 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009-08-07 10:38:10 | 000,044,544 | —- | M] (BitDefender S.R.L.) – C:\Program Files\Mozilla Firefox\components\FFComm.dll
[2009-12-09 04:58:24 | 000,274,432 | —- | M] (Dassault Systèmes SolidWorks Corp.) – C:\Program Files\Mozilla Firefox\plugins\npEModelPlugin.dll
O1 HOSTS File: ([2006-09-19 03:11:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (QUICKfind BHO Object) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files\IDM\QUICKfind\PlugIns\IEHelp.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [WordWeb] C:\Program Files\WordWeb\wweb32.exe (WordWeb Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} http://144.0.5.123:8080/dwa7W.cab (Domino Web Access 7 Control)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\textwareilluminatorbase {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\Windows\System32\textwareilluminatorbaseProtocol.dll ()
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\dell\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\dell\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-09-19 03:13:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010-05-02 13:37:47 | 000,000,000 | —D | M] - C:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2010-05-02 13:37:47 | 000,000,000 | —D | M] - D:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2010-08-30 22:12:03 | 000,000,000 | -H-D | M] - E:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2010-05-02 13:37:47 | 000,000,000 | —D | M] - F:\AUTORUN.INF – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk /r \??\J:) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.divxa32 - C:\Windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2010-08-31 16:46:09 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\dell\Desktop\OTL.exe
[2010-08-30 21:49:45 | 000,000,000 | —D | C] – C:\Windows\temp
[2010-08-30 21:49:12 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010-08-30 20:20:36 | 000,000,000 | —D | C] – C:\Users\dell\AppData\Local\temp
[2010-08-30 20:08:49 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010-08-30 20:08:49 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010-08-30 20:08:49 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010-08-30 20:08:49 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010-08-30 20:08:41 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010-08-30 20:06:44 | 000,000,000 | —D | C] – C:\Qoobox
[2010-08-29 18:36:15 | 000,000,000 | —D | C] – C:\Users\dell\AppData\Local\ESET
[2010-08-28 21:45:20 | 000,000,000 | —D | C] – C:\ProgramData\ESET
[2010-08-28 21:45:20 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010-08-25 19:50:28 | 000,000,000 | —D | C] – C:\Users\dell\Pictures
[2010-08-25 15:42:53 | 000,000,000 | —D | C] – C:\Program Files\SolidWorks
[2010-08-22 05:47:29 | 000,000,000 | —D | C] – C:\ProgramData\WordWeb
[2010-08-22 05:46:40 | 001,524,936 | —- | C] (WordWeb Software) – C:\Windows\wweb32.dll
[2010-08-22 05:46:37 | 000,000,000 | —D | C] – C:\Program Files\WordWeb
[2010-08-19 15:37:48 | 000,000,000 | —D | C] – C:\ProgramData\Zbshareware Lab
[2010-08-17 01:06:26 | 000,000,000 | —D | C] – C:\Users\dell\Documents\My Google Gadgets
[2010-08-14 16:40:30 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2010-08-07 00:54:14 | 000,000,000 | —D | C] – C:\Users\dell\Desktop\1 month
[2010-08-05 19:42:48 | 000,000,000 | —D | C] – C:\Program Files\gAlwaysIdle
========== Files - Modified Within 30 Days ==========
[2010-08-31 16:51:12 | 000,784,896 | —- | M] () – C:\Windows\System32\drivers\ddmtoxz.sys
[2010-08-31 16:48:19 | 004,718,592 | -HS- | M] () – C:\Users\dell\ntuser.dat
[2010-08-31 16:42:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\dell\Desktop\OTL.exe
[2010-08-31 16:40:05 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3833408539-2285171306-2665556084-1000UA.job
[2010-08-31 16:27:06 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010-08-31 16:27:06 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010-08-31 14:56:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010-08-31 13:42:22 | 000,626,246 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010-08-31 13:42:22 | 000,109,370 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010-08-31 13:42:21 | 000,720,952 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010-08-31 13:27:06 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010-08-31 13:26:58 | 3181,760,512 | -HS- | M] () – C:\hiberfil.sys
[2010-08-30 22:45:47 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010-08-30 22:45:43 | 001,674,540 | -H– | M] () – C:\Users\dell\AppData\Local\IconCache.db
[2010-08-30 21:48:05 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010-08-28 21:37:39 | 000,000,155 | —- | M] () – C:\Windows\winamp.ini
[2010-08-28 21:29:55 | 000,000,069 | —- | M] () – C:\Windows\NeroDigital.ini
[2010-08-27 15:01:21 | 000,057,344 | —- | M] () – C:\Users\dell\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-08-26 18:34:32 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3833408539-2285171306-2665556084-1000Core.job
[2010-08-26 07:35:54 | 000,389,144 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010-08-25 16:40:09 | 000,000,038 | —- | M] () – C:\Windows\avisplitter.INI
[2010-08-25 16:06:14 | 000,107,760 | —- | M] () – C:\Users\dell\AppData\Local\GDIPFONTCACHEV1.DAT
[2010-08-25 15:52:50 | 000,001,900 | —- | M] () – C:\Users\dell\Application Data\Microsoft\Internet Explorer\Quick Launch\eDrawings 2004.lnk
[2010-08-25 15:52:50 | 000,001,876 | —- | M] () – C:\Users\Public\Desktop\eDrawings 2004.lnk
[2010-08-25 15:49:17 | 000,000,023 | -H– | M] () – C:\Windows\yacht.xws
[2010-08-20 18:40:41 | 000,001,043 | —- | M] () – C:\Users\Public\Desktop\Google Desktop.lnk
========== Files Created - No Company Name ==========
[2010-08-30 20:08:49 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010-08-30 20:08:49 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010-08-30 20:08:49 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010-08-30 20:08:49 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010-08-30 20:08:49 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010-08-28 15:25:35 | 000,784,896 | —- | C] () – C:\Windows\System32\drivers\ddmtoxz.sys
[2010-08-25 15:52:50 | 000,001,900 | —- | C] () – C:\Users\dell\Application Data\Microsoft\Internet Explorer\Quick Launch\eDrawings 2004.lnk
[2010-08-25 15:52:50 | 000,001,876 | —- | C] () – C:\Users\Public\Desktop\eDrawings 2004.lnk
[2010-08-20 18:40:41 | 000,001,043 | —- | C] () – C:\Users\Public\Desktop\Google Desktop.lnk
[2010-07-17 13:44:07 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.INI
[2010-06-18 09:40:53 | 000,000,383 | —- | C] () – C:\Windows\System32\haspdos.sys
[2010-06-17 18:11:44 | 000,000,662 | —- | C] () – C:\Program Files\SolidWorksswxJRNL.BAK
[2010-06-17 18:06:51 | 000,639,052 | —- | C] () – C:\Windows\System32\BBPDFPortMon.dll
[2010-05-05 19:03:57 | 000,000,600 | —- | C] () – C:\Users\dell\AppData\Local\PUTTY.RND
[2010-04-06 22:12:24 | 000,000,000 | —- | C] () – C:\Windows\eDrawingOfficeAutomator.INI
[2009-10-22 21:07:17 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009-10-12 16:24:52 | 000,000,063 | —- | C] () – C:\Windows\TEXTware.ini
[2009-10-12 16:24:50 | 000,321,024 | —- | C] () – C:\Windows\System32\textwareilluminatorbaseProtocol.dll
[2009-10-12 16:24:49 | 000,147,456 | —- | C] () – C:\Windows\System32\Twavbx32.dll
[2009-10-12 16:24:49 | 000,113,288 | —- | C] () – C:\Windows\System32\bass.dll
[2009-10-12 16:24:49 | 000,018,432 | —- | C] () – C:\Windows\System32\TWAIED02.DLL
[2009-10-12 16:24:47 | 000,143,360 | —- | C] () – C:\Windows\System32\ILXTBS.DLL
[2009-10-12 00:59:11 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009-09-27 14:33:53 | 000,000,518 | —- | C] () – C:\Users\dell\AppData\Roaming\alarms.ini
[2009-09-27 14:33:52 | 000,000,747 | —- | C] () – C:\Users\dell\AppData\Roaming\AtomicAlarmClock.ini
[2009-07-16 00:52:18 | 000,031,616 | —- | C] () – C:\Windows\System32\drivers\livecamv.sys
[2009-06-30 11:51:45 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2009-06-30 11:51:42 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009-06-30 11:51:41 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2009-06-30 11:51:41 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009-06-30 11:51:40 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009-06-30 11:51:40 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2009-06-30 10:12:40 | 000,024,206 | —- | C] () – C:\Users\dell\AppData\Roaming\UserTile.png
[2009-06-10 18:24:52 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009-06-10 18:11:54 | 000,000,155 | —- | C] () – C:\Windows\winamp.ini
[2009-06-10 18:09:54 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009-06-10 18:09:50 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009-06-10 17:54:31 | 000,057,344 | —- | C] () – C:\Users\dell\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-06-10 16:03:00 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1576.dll
[2009-06-10 16:02:26 | 000,006,656 | —- | C] () – C:\Windows\System32\bcmwlrc.dll
[2009-06-10 16:02:23 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2009-06-10 15:41:53 | 000,001,356 | —- | C] () – C:\Users\dell\AppData\Local\d3d9caps.dat
[2006-11-02 18:04:23 | 000,080,010 | —- | C] () – C:\Windows\System32\manage-bde.ini.en
[2006-11-02 18:04:20 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006-11-02 13:10:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006-06-13 16:35:32 | 000,053,760 | —- | C] () – C:\Windows\System32\zlib.dll
[2004-09-10 19:06:12 | 000,327,680 | —- | C] () – C:\Windows\System32\QFClient2.dll
[2003-01-30 06:04:00 | 000,618,496 | —- | C] () – C:\Windows\System32\stlpmt45.dll
[2001-11-14 13:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll
========== LOP Check ==========
[2010-08-30 22:45:47 | 000,032,594 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2010-05-07 21:53:58 | 000,002,006 | —- | M] () – C:\aqua_bitmap.cpp
[2006-09-19 03:13:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2006-11-02 15:23:57 | 000,438,840 | RHS- | M] () – C:\bootmgr
[2009-06-11 05:03:52 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2010-08-30 21:49:44 | 000,016,456 | —- | M] () – C:\ComboFix.txt
[2006-09-19 03:13:37 | 000,000,010 | —- | M] () – C:\config.sys
[2007-03-17 17:11:22 | 000,171,136 | RHS- | M] () – C:\grldr
[2010-08-31 13:26:58 | 3181,760,512 | -HS- | M] () – C:\hiberfil.sys
[2009-06-10 18:10:32 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009-06-10 18:10:32 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010-08-31 13:26:57 | 3495,686,144 | -HS- | M] () – C:\pagefile.sys
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pcconf.ini
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pcwords.dat
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pcwords2.dat
[2009-09-09 19:45:47 | 000,000,000 | —- | M] () – C:\pc_sign.slf
[2009-07-16 00:52:52 | 000,000,159 | —- | M] () – C:\SetupLCV.log
< %systemroot%\Fonts\*.com >
[2006-11-02 18:05:26 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006-11-02 18:05:26 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006-11-02 18:05:26 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006-11-02 18:05:26 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2006-09-19 03:07:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006-11-02 18:04:09 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2003-06-18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006-10-26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2006-11-02 18:19:43 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2010-06-17 18:22:01 | 000,000,662 | —- | M] () – C:\Program Files\SolidWorksswxJRNL.BAK
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2006-11-02 16:04:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006-11-02 16:04:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006-11-02 16:04:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006-11-02 16:04:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006-11-02 16:04:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009-06-27 07:48:40 | 000,000,286 | -HS- | M] () – C:\Users\dell\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2007-12-20 16:32:06 | 000,152,064 | —- | M] (Kevin Solway Software) – C:\Users\dell\Desktop\deletedr.exe
[2010-08-31 16:42:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\dell\Desktop\OTL.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
========== Alternate Data Streams ==========
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:1C322B97
< End of report >
![[external image: Posted Image]](http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_screen2-1.gif){kind=link}