What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please help when if you jave the time.

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, thank you in advanced for taking the time and effort to help.

So I turn my computer on after I let my brother use it last week, I try to open firefox and then everything starts to crash, I can't even open up task manager, so I restart the computer in safe mode and run a full virus scan, I remove all infected files and now everything works again. It just works really slowly.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:45:36 PM, on 9/14/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 5864 bytes




Again, thank you in advance for any help.
Post #2
Hello and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Please download Rootkit Unhooker and save it on your desktop.
  • Disable your security programs
  • Double click RKUnhookerLE.exe to run it
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth Code, Files, and Code Hooks
  • Uncheck the rest, then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished then go File > Save Report
  • Save the report somewhere you can find it. Click Close
  • Copy the entire contents of the report and paste it in your next reply.
Note - You may get this warning it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Please include the following in your next post:
  • DDS and Attach.txt logs
  • Rootkit Unhooker log
Post #3
Hi, I'm having trouble using "Rootkit Unhooker" I disabled "Windows Firewall" and "Windows Security Essentials" when I run "RKUnhookerLE.exe" It gives me this error: Error loading driver, NTSTATUS code 0x000036B. Here's the DDS log. DDS (Ver_10-03-17.01) - NTFSX64 NETWORK Run by [removed] at 5:49:14.99 on Fri 09/17/2010 Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_21 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3263.2306 [GMT -4:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\Angel\Desktop\dds.scr ============== Pseudo HJT Report =============== mLocal Page = c:\windows\syswow64\blank.htm uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~2\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~2\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~2\yahoo!\companion\installs\cpn\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~2\yahoo!\companion\installs\cpn\yt.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File uRun: [WMPNSCFG] c:\program files (x86)\windows media player\WMPNSCFG.exe mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe" mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe -s mRun-x64: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey ================= FIREFOX =================== FF - ProfilePath - c:\users\angel\appdata\roaming\mozilla\firefox\profiles\us12nzf8.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.animesuki.com/ FF - prefs.js: keyword.URL - hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=GAM-SRS&o=15986&locale=en_US&apn_uid=024EAA3C-0614-4A65-A81C-5608EA26E982&apn_ptnrs=X2&apn_sauid=FEDB7794-0BBA-4B70-901C-68CD9CF8393B&apn_dtid=YYYYYYS3US&q= FF - plugin: c:\program files (x86)\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npPandoWebInst.dll FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll FF - plugin: c:\users\angel\appdata\roaming\mozilla\firefox\profiles\us12nzf8.default\extensions\{38ab6a6c-cc4c-4f9e-a3dd-3c5681ef18a1}\plugins\npsoe.dll FF - plugin: c:\windows\syswow64\macromed\flash\NPSWF32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: XULRunner: {C8343A51-6091-4E39-B9A8-C37B48B91FB2} - c:\users\angel\appdata\local\{c8343a51-6091-4e39-b9a8-c37b48b91fb2}\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 173984] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe –> system32\libusbd-nt.exe [?] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] S3 Media Jukebox 14 Service;Media Jukebox 14 Service;c:\program files (x86)\j river\media jukebox 14\JRService.exe [2010-9-16 379400] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-22 19456] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-22 9216] S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\drivers\MijXfilt.sys [2010-5-14 60416] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-20 29184] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-12-2 40832] S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968] S3 StMp3Recx64;Player Recovery Device Control Driver;c:\windows\system32\drivers\StMp3Recx64.sys [2009-9-8 26112] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework64\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 1020768] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-12-3 89920] ============== File Associations =============== JSEFile=c:\windows\syswow64\WScript.exe "%1" %* =============== Created Last 30 ================ 2010-09-16 18:47:17 475683754 —-a-w- c:\windows\MEMORY.DMP 2010-09-16 07:22:46 76 —-a-w- c:\windows\syswow64\mspstpl.vxd 2010-09-16 07:22:46 621056 ——w- c:\windows\syswow64\MJ14.exe 2010-09-16 07:22:46 621056 ——w- c:\windows\system32\MJ14.exe 2010-09-16 07:22:45 0 d—–w- c:\program files (x86)\J River 2010-09-16 07:22:35 0 d—–w- c:\users\angel\appdata\roaming\J River 2010-09-16 06:51:35 317952 —-a-w- c:\windows\syswow64\MP4SDECD.DLL 2010-09-16 06:51:35 295424 —-a-w- c:\windows\system32\MP4SDECD.DLL 2010-09-16 06:51:34 273920 —-a-w- c:\windows\system32\spoolsv.exe 2010-09-16 06:51:31 975360 —-a-w- c:\windows\system32\inetcomm.dll 2010-09-16 06:51:31 739328 —-a-w- c:\windows\syswow64\inetcomm.dll 2010-09-16 06:51:30 621568 —-a-w- c:\windows\system32\usp10.dll 2010-09-16 06:51:30 502272 —-a-w- c:\windows\syswow64\usp10.dll 2010-08-22 11:02:31 0 d—–w- c:\programdata\Media Center Programs 2010-08-22 11:00:47 0 d—–w- c:\program files (x86)\Paradox Interactive 2010-08-20 08:23:09 153376 —-a-w- c:\windows\syswow64\javaws.exe 2010-08-20 08:23:09 145184 —-a-w- c:\windows\syswow64\javaw.exe 2010-08-20 08:23:09 145184 —-a-w- c:\windows\syswow64\java.exe ==================== Find3M ==================== 2010-09-17 09:29:53 70581 —-a-w- c:\programdata\nvModes.dat 2010-07-26 15:51:48 11584512 —-a-w- c:\windows\syswow64\shell32.dll 2010-07-17 09:00:04 423656 —-a-w- c:\windows\syswow64\deployJava1.dll 2010-07-14 19:42:58 51200 —-a-w- c:\windows\inf\infpub.dat 2010-07-14 19:42:58 143360 —-a-w- c:\windows\inf\infstrng.dat 2010-07-14 19:42:55 86016 —-a-w- c:\windows\inf\infstor.dat 2010-06-26 06:30:12 1147904 —-a-w- c:\windows\system32\wininet.dll 2010-06-26 06:25:54 77312 —-a-w- c:\windows\system32\iesetup.dll 2010-06-26 06:25:54 132096 —-a-w- c:\windows\system32\iesysprep.dll 2010-06-26 06:05:49 916480 —-a-w- c:\windows\syswow64\wininet.dll 2010-06-26 06:05:41 1210368 —-a-w- c:\windows\syswow64\urlmon.dll 2010-06-26 06:04:40 206848 —-a-w- c:\windows\syswow64\occache.dll 2010-06-26 06:03:22 611840 —-a-w- c:\windows\syswow64\mstime.dll 2010-06-26 06:03:04 5951488 —-a-w- c:\windows\syswow64\mshtml.dll 2010-06-26 06:03:02 599040 —-a-w- c:\windows\syswow64\msfeeds.dll 2010-06-26 06:03:02 55296 —-a-w- c:\windows\syswow64\msfeedsbs.dll 2010-06-26 06:02:31 25600 —-a-w- c:\windows\syswow64\jsproxy.dll 2010-06-26 06:02:15 71680 —-a-w- c:\windows\syswow64\iesetup.dll 2010-06-26 06:02:15 1986560 —-a-w- c:\windows\syswow64\iertutil.dll 2010-06-26 06:02:15 164352 —-a-w- c:\windows\syswow64\ieui.dll 2010-06-26 06:02:15 109056 —-a-w- c:\windows\syswow64\iesysprep.dll 2010-06-26 06:02:14 55808 —-a-w- c:\windows\syswow64\iernonce.dll 2010-06-26 06:02:14 184320 —-a-w- c:\windows\syswow64\iepeers.dll 2010-06-26 06:02:14 11077120 —-a-w- c:\windows\syswow64\ieframe.dll 2010-06-26 06:02:09 387584 —-a-w- c:\windows\syswow64\iedkcs32.dll 2010-06-26 04:47:47 162816 —-a-w- c:\windows\system32\ieUnatt.exe 2010-06-26 04:25:02 133632 —-a-w- c:\windows\syswow64\ieUnatt.exe 2010-06-26 04:24:51 173056 —-a-w- c:\windows\syswow64\ie4uinit.exe 2010-06-26 04:24:17 13312 —-a-w- c:\windows\syswow64\msfeedssync.exe 2010-06-21 14:05:22 2752000 —-a-w- c:\windows\system32\win32k.sys 2009-12-24 03:04:31 665600 —-a-w- c:\windows\inf\drvindex.dat 2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini 2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini 2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2010-04-17 02:52:39 245760 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2006-05-03 09:06:54 163328 –sh–r- c:\windows\syswow64\flvDX.dll 2007-02-21 10:47:16 31232 –sh–r- c:\windows\syswow64\msfDX.dll 2008-03-16 12:30:52 216064 –sh–r- c:\windows\syswow64\nbDX.dll 2010-05-10 03:27:16 32768 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat 2010-05-10 03:27:16 49152 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2010-05-10 03:27:16 32768 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat ============= FINISH: 5:49:20.80 ===============

Attachments:

Post #4
Skip Rootkit Unhooker for now and run this for me:

🖼Click to load external image (Posted Image) Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of OTL.txt into your next post.
Please include the following in your next post:
  • OTL.txt log
Post #5
OTL logfile created on: 9/18/2010 5:57:10 AM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Users\Angel\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 698.63 Gb Total Space | 17.44 Gb Free Space | 2.50% Space Free | Partition Type: NTFS
Drive D: | 76.43 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BOB_II
Current User Name: Angel
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Angel\Desktop\OTL.exe (OldTimer Tools)


========== Modules (SafeList) ==========

MOD - C:\Users\Angel\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\J River\Media Jukebox 14\Plugins\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (libusbd) – C:\Windows\SysNative\libusbd-nt.exe File not found
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Media Jukebox 14 Service) – C:\Program Files (x86)\J River\Media Jukebox 14\JRService.exe (J. River, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (libusbd) – C:\Windows\SysWOW64\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Driver Services (SafeList) ==========

DRV:64bit: - (NwlnkFwd) – C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) – C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (libusb0) – C:\Windows\SysNative\drivers\libusb0.sys File not found
DRV:64bit: - (IpInIp) – C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (MotioninJoyXFilter) – C:\Windows\SysNative\DRIVERS\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (sptd) – C:\Windows\SysNative\Drivers\sptd.sys ()
DRV:64bit: - (xusb21) – C:\Windows\SysNative\DRIVERS\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola)
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (irda) – C:\Windows\SysNative\DRIVERS\irda.sys (Microsoft Corporation)
DRV:64bit: - (xnacc) – C:\Windows\SysNative\DRIVERS\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (irsir) – C:\Windows\SysNative\DRIVERS\irsir.sys (Microsoft Corporation)
DRV:64bit: - (motport) – C:\Windows\SysNative\DRIVERS\motport.sys (Motorola)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola)
DRV:64bit: - (StMp3Recx64) – C:\Windows\SysNative\Drivers\StMp3Recx64.sys (Generic)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV - (Normandy) – C:\Windows\SysWow64\drivers\Normandy.sys ()
DRV - (StMp3Recx64) – C:\Windows\SysWOW64\drivers\StMp3Recx64.sys (Generic)
DRV - (speedfan) – C:\Windows\SysWOW64\speedfan.sys (Windows ® Server 2003 DDK provider)
DRV - (libusb0) – C:\Windows\SysWOW64\drivers\libusb0.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 79 F9 BF E0 10 B0 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Search-Results"
FF - prefs.js..browser.search.defaultenginename: "Search-Results"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.order.1: "Search-Results"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.animesuki.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.5.1
FF - prefs.js..extensions.enabledItems: {38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}:[removed]
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: {C8343A51-6091-4E39-B9A8-C37B48B91FB2}:1.9.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: LF@ChaosRing:0.9
FF - prefs.js..keyword.URL: "http://websearch.search-results.com/redirect?client=ff&src=kw&tb=GAM-SRS&o=15986&locale=en_US&apn_uid=024EAA3C-0614-4A65-A81C-5608EA26E982&apn_ptnrs=X2&apn_sauid=FEDB7794-0BBA-4B70-901C-68CD9CF8393B&apn_dtid=YYYYYYS3US&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{C8343A51-6091-4E39-B9A8-C37B48B91FB2}: C:\Users\Angel\AppData\Local\{C8343A51-6091-4E39-B9A8-C37B48B91FB2}\ [2010/03/05 14:09:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/09/17 17:37:01 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/09/16 14:49:48 | 000,000,000 | —D | M]

[2009/02/13 05:36:36 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Extensions
[2009/02/13 05:36:36 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/09/17 06:04:03 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions
[2010/05/12 01:18:30 | 000,000,000 | —D | M] (Mabinogi Avatar Renderer) – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\{077a24e9-0db5-435f-9010-5261c53e5925}
[2010/06/24 21:47:05 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/08/22 00:11:37 | 000,000,000 | —D | M] (Free Realms Installer) – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}
[2010/04/23 09:20:57 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/02/11 14:28:29 | 000,000,000 | —D | M] (No name found) – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/06/24 21:46:48 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\LF@ChaosRing
[2010/08/26 06:27:56 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\[removed]
[2009/07/13 14:53:51 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\[removed]
[2010/06/24 21:46:48 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\extensions\LF@ChaosRing\mozapps\extensions
[2010/04/22 20:27:40 | 000,003,359 | —- | M] () – C:\Users\Angel\AppData\Roaming\Mozilla\Firefox\Profiles\us12nzf8.default\searchplugins\search-results.xml
[2010/09/17 05:46:23 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/07/10 19:54:06 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/20 04:23:10 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/28 23:57:12 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files (x86)\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4:64bit: - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.8
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Angel\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Angel\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/11/08 05:34:14 | 000,000,081 | R— | M] () - D:\Autorun.inf – [ CDFS ]
O33 - MountPoints2\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SetupAssistant.exe – [2008/01/24 07:14:00 | 000,685,296 | R— | M] (Belkin International, Inc.)
O33 - MountPoints2\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\Shell\AutoRun\command - "" = E:\autorun.exe – File not found
O33 - MountPoints2\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\Shell\phone\command - "" = E:\autorun.exe – File not found
O33 - MountPoints2\{9685db09-2e33-11df-8b9f-001966887a68}\Shell - "" = AutoRun
O33 - MountPoints2\{9685db09-2e33-11df-8b9f-001966887a68}\Shell\AutoRun\command - "" = E:\autorun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…com [@ = comfile] – Reg Error: Key error. File not found
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

========== Files/Folders - Created Within 90 Days ==========

[2010/09/18 05:55:14 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Angel\Desktop\OTL.exe
[2010/09/16 03:22:46 | 000,621,056 | —- | C] (J. River, Inc.) – C:\Windows\SysWow64\MJ14.exe
[2010/09/16 03:22:46 | 000,621,056 | —- | C] (J. River, Inc.) – C:\Windows\SysNative\MJ14.exe
[2010/09/16 03:22:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\J River
[2010/09/16 03:22:35 | 000,000,000 | —D | C] – C:\Users\Angel\AppData\Roaming\J River
[2010/08/28 22:16:37 | 000,000,000 | —D | C] – C:\Users\Angel\Desktop\DynastyWarriors6PLUS18Trainer
[2010/08/22 07:22:28 | 000,000,000 | —D | C] – C:\Users\Angel\Documents\Elven Legacy Profiles
[2010/08/22 07:02:31 | 000,000,000 | —D | C] – C:\ProgramData\Media Center Programs
[2010/08/22 07:00:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Paradox Interactive
[2010/08/20 04:23:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2010/08/02 03:33:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\PS3 Media Server
[2010/07/30 10:01:10 | 000,092,672 | RHS- | C] (RadLight) – C:\Windows\SysWow64\RLVorbisDec.ax
[2010/07/30 10:01:10 | 000,090,112 | RHS- | C] (-) – C:\Windows\SysWow64\TTADSSplitter.ax
[2010/07/30 10:01:10 | 000,090,112 | RHS- | C] (-) – C:\Windows\SysWow64\TTADSDecoder.ax
[2010/07/30 10:01:10 | 000,067,584 | RHS- | C] (RadLight, LLC) – C:\Windows\SysWow64\RLTheoraDec.ax
[2010/07/30 10:01:09 | 000,278,528 | —- | C] (Real Networks, Inc) – C:\Windows\SysWow64\pncrt.dll
[2010/07/30 10:01:09 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) – C:\Windows\SysWow64\nbDX.dll
[2010/07/30 10:01:09 | 000,186,880 | RHS- | C] (RadLight) – C:\Windows\SysWow64\RLOgg.ax
[2010/07/30 10:01:09 | 000,169,472 | RHS- | C] (Gabest) – C:\Windows\SysWow64\MatroskaDX.ax
[2010/07/30 10:01:09 | 000,163,328 | RHS- | C] (Gabest) – C:\Windows\SysWow64\flvDX.dll
[2010/07/30 10:01:09 | 000,161,792 | RHS- | C] (Gabest) – C:\Windows\SysWow64\RealMediaDX.ax
[2010/07/30 10:01:09 | 000,031,232 | RHS- | C] (Hans Mayerl) – C:\Windows\SysWow64\msfDX.dll
[2010/07/30 10:01:08 | 000,179,200 | RHS- | C] (Gabest) – C:\Windows\SysWow64\DiracSplitter.ax
[2010/07/30 10:01:08 | 000,123,904 | RHS- | C] (CoreCodec) – C:\Windows\SysWow64\AVCDX.ax
[2010/07/30 09:38:08 | 000,000,000 | —D | C] – C:\Users\Angel\AppData\Local\Apple Computer
[2010/07/30 09:35:29 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2010/07/30 09:34:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Apple
[2010/07/30 09:34:37 | 000,000,000 | —D | C] – C:\Users\Angel\AppData\Local\Apple
[2010/07/30 09:34:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2010/07/30 09:34:34 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2010/07/30 05:13:39 | 000,000,000 | —D | C] – C:\Users\Angel\AppData\Roaming\Nexon
[2010/07/29 22:39:09 | 000,000,000 | —D | C] – C:\Users\Angel\AppData\Roaming\NVIDIA
[2010/07/29 21:48:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\GMSV55
[2010/07/14 15:40:21 | 000,000,000 | —D | C] – C:\Windows\SysWow64\WindowsPowerShell
[2010/07/14 15:39:56 | 000,000,000 | —D | C] – C:\Windows\SysNative\WindowsPowerShell
[2010/06/28 23:01:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Antimalware
[2010/06/25 23:02:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft.NET
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/18 05:57:06 | 002,621,440 | -HS- | M] () – C:\Users\Angel\NTUSER.DAT
[2010/09/18 05:55:14 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Angel\Desktop\OTL.exe
[2010/09/18 04:18:14 | 000,003,712 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/18 04:18:14 | 000,003,712 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/18 02:18:33 | 000,070,581 | —- | M] () – C:\ProgramData\nvModes.dat
[2010/09/18 02:18:33 | 000,070,581 | —- | M] () – C:\ProgramData\nvModes.001
[2010/09/18 02:18:17 | 000,524,288 | -HS- | M] () – C:\Users\Angel\NTUSER.DAT{76583c97-c2ec-11df-addf-001966887a68}.TMContainer00000000000000000002.regtrans-ms
[2010/09/18 02:18:17 | 000,524,288 | -HS- | M] () – C:\Users\Angel\NTUSER.DAT{76583c97-c2ec-11df-addf-001966887a68}.TMContainer00000000000000000001.regtrans-ms
[2010/09/18 02:18:17 | 000,065,536 | -HS- | M] () – C:\Users\Angel\NTUSER.DAT{76583c97-c2ec-11df-addf-001966887a68}.TM.blf
[2010/09/18 02:18:15 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/18 02:18:14 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/18 02:18:10 | 3421,802,496 | -HS- | M] () – C:\hiberfil.sys
[2010/09/17 15:10:33 | 000,155,136 | —- | M] () – C:\Users\Angel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/17 15:07:37 | 000,034,560 | —- | M] () – C:\Windows\SysWow64\drivers\Normandy.sys
[2010/09/17 05:57:50 | 000,524,288 | -HS- | M] () – C:\Users\Angel\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2010/09/17 05:57:50 | 000,065,536 | -HS- | M] () – C:\Users\Angel\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2010/09/17 05:51:12 | 000,133,632 | —- | M] () – C:\Users\Angel\Desktop\RKUnhookerLE.EXE
[2010/09/17 05:39:51 | 000,525,824 | —- | M] () – C:\Users\Angel\Desktop\dds.scr
[2010/09/16 14:47:17 | 475,683,754 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/09/16 03:23:24 | 000,001,900 | —- | M] () – C:\Users\Angel\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Jukebox 14.lnk
[2010/09/16 03:23:24 | 000,001,876 | —- | M] () – C:\Users\Public\Desktop\Media Jukebox 14.lnk
[2010/09/16 03:22:46 | 000,000,076 | —- | M] () – C:\Windows\SysWow64\mspstpl.vxd
[2010/09/15 06:35:49 | 019,657,194 | —- | M] () – C:\Users\Angel\Documents\vlc-1.1.4-win32.exe
[2010/09/14 14:45:28 | 000,002,519 | —- | M] () – C:\Users\Angel\Desktop\HiJackThis.lnk
[2010/09/13 19:46:26 | 000,025,926 | —- | M] () – C:\Users\Angel\Documents\cc_20100913_194623.reg
[2010/09/09 17:58:23 | 000,703,388 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/09/09 17:58:23 | 000,604,264 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/09/09 17:58:23 | 000,103,964 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/08/22 07:14:35 | 000,000,551 | —- | M] () – C:\Users\Angel\AppData\Roaming\AutoGK.ini
[2010/08/21 10:56:21 | 000,001,356 | —- | M] () – C:\Users\Angel\AppData\Local\d3d9caps.dat
[2010/08/21 04:52:37 | 000,001,877 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/08/19 09:32:15 | 000,002,312 | —- | M] () – C:\Users\Angel\Desktop\Reume.rtf
[2010/08/19 08:10:12 | 000,001,607 | —- | M] () – C:\Users\Angel\Desktop\Cover Leter.rtf
[2010/08/11 23:24:46 | 000,261,880 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/08/11 13:32:29 | 000,789,802 | —- | M] () – C:\Users\Angel\Documents\subway app.xps
[2010/08/02 03:33:20 | 000,000,831 | —- | M] () – C:\Users\Public\Desktop\PS3 Media Server.lnk
[2010/07/30 10:01:10 | 000,001,819 | —- | M] () – C:\Users\Public\Desktop\SUPER ©.lnk
[2010/07/19 06:28:42 | 000,001,972 | —- | M] () – C:\Users\Angel\Documents\cc_20100719_062839.reg
[2010/07/15 17:28:33 | 000,621,056 | —- | M] (J. River, Inc.) – C:\Windows\SysWow64\MJ14.exe
[2010/07/15 17:28:33 | 000,621,056 | —- | M] (J. River, Inc.) – C:\Windows\SysNative\MJ14.exe
[2010/07/15 05:55:14 | 000,045,367 | —- | M] () – C:\Users\Angel\Documents\127787368918.jpg
[2010/07/13 21:40:34 | 000,088,112 | —- | M] () – C:\Users\Angel\Documents\cc_20100713_214026.reg
[2010/07/13 20:43:21 | 000,000,806 | —- | M] () – C:\Users\Angel\Desktop\CCleaner.lnk
[2010/06/29 11:52:02 | 000,037,056 | —- | M] () – C:\Users\Angel\Desktop\UPSShippingLabel.aspx.gif
[2010/06/28 23:00:36 | 000,000,942 | —- | M] () – C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010/06/26 16:38:41 | 000,010,310 | —- | M] () – C:\Users\Angel\Documents\Untitled.jpg
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/18 02:18:17 | 000,524,288 | -HS- | C] () – C:\Users\Angel\NTUSER.DAT{76583c97-c2ec-11df-addf-001966887a68}.TMContainer00000000000000000002.regtrans-ms
[2010/09/18 02:18:17 | 000,524,288 | -HS- | C] () – C:\Users\Angel\NTUSER.DAT{76583c97-c2ec-11df-addf-001966887a68}.TMContainer00000000000000000001.regtrans-ms
[2010/09/18 02:18:17 | 000,065,536 | -HS- | C] () – C:\Users\Angel\NTUSER.DAT{76583c97-c2ec-11df-addf-001966887a68}.TM.blf
[2010/09/17 05:58:37 | 3421,802,496 | -HS- | C] () – C:\hiberfil.sys
[2010/09/17 05:51:37 | 000,034,560 | —- | C] () – C:\Windows\SysWow64\drivers\Normandy.sys
[2010/09/17 05:51:14 | 000,133,632 | —- | C] () – C:\Users\Angel\Desktop\RKUnhookerLE.EXE
[2010/09/17 05:39:52 | 000,525,824 | —- | C] () – C:\Users\Angel\Desktop\dds.scr
[2010/09/16 14:47:17 | 475,683,754 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/09/16 03:23:24 | 000,001,900 | —- | C] () – C:\Users\Angel\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Jukebox 14.lnk
[2010/09/16 03:23:24 | 000,001,876 | —- | C] () – C:\Users\Public\Desktop\Media Jukebox 14.lnk
[2010/09/16 03:22:46 | 000,000,076 | —- | C] () – C:\Windows\SysWow64\mspstpl.vxd
[2010/09/13 19:46:24 | 000,025,926 | —- | C] () – C:\Users\Angel\Documents\cc_20100913_194623.reg
[2010/08/29 16:15:00 | 019,657,194 | —- | C] () – C:\Users\Angel\Documents\vlc-1.1.4-win32.exe
[2010/08/19 09:17:25 | 000,002,312 | —- | C] () – C:\Users\Angel\Desktop\Reume.rtf
[2010/08/17 04:52:14 | 000,001,607 | —- | C] () – C:\Users\Angel\Desktop\Cover Leter.rtf
[2010/08/11 13:32:25 | 000,789,802 | —- | C] () – C:\Users\Angel\Documents\subway app.xps
[2010/08/02 03:33:20 | 000,000,831 | —- | C] () – C:\Users\Public\Desktop\PS3 Media Server.lnk
[2010/07/30 10:01:10 | 000,051,712 | RHS- | C] () – C:\Windows\SysWow64\RLSpeexDec.ax
[2010/07/30 10:01:10 | 000,001,819 | —- | C] () – C:\Users\Public\Desktop\SUPER ©.lnk
[2010/07/30 10:01:09 | 000,120,832 | RHS- | C] () – C:\Windows\SysWow64\MPCDx.ax
[2010/07/30 10:01:09 | 000,107,520 | RHS- | C] () – C:\Windows\SysWow64\RLMPCDec.ax
[2010/07/30 10:01:09 | 000,070,656 | RHS- | C] () – C:\Windows\SysWow64\RLAPEDec.ax
[2010/07/30 10:01:08 | 000,227,328 | RHS- | C] () – C:\Windows\SysWow64\ac3DX.ax
[2010/07/30 10:01:08 | 000,175,104 | RHS- | C] () – C:\Windows\SysWow64\CoreAAC.ax
[2010/07/30 10:01:08 | 000,097,280 | RHS- | C] () – C:\Windows\SysWow64\FLACDX.ax
[2010/07/30 10:01:08 | 000,081,920 | RHS- | C] () – C:\Windows\SysWow64\aac_parser.ax
[2010/07/19 06:28:41 | 000,001,972 | —- | C] () – C:\Users\Angel\Documents\cc_20100719_062839.reg
[2010/07/15 05:55:14 | 000,045,367 | —- | C] () – C:\Users\Angel\Documents\127787368918.jpg
[2010/07/14 15:35:39 | 000,201,184 | —- | C] () – C:\Windows\SysWow64\winrm.vbs
[2010/07/14 15:35:39 | 000,201,184 | —- | C] () – C:\Windows\SysNative\winrm.vbs
[2010/07/14 15:35:39 | 000,004,675 | —- | C] () – C:\Windows\SysWow64\wsmanconfig_schema.xml
[2010/07/14 15:35:39 | 000,004,675 | —- | C] () – C:\Windows\SysNative\wsmanconfig_schema.xml
[2010/07/14 15:35:39 | 000,002,426 | —- | C] () – C:\Windows\SysWow64\WsmTxt.xsl
[2010/07/14 15:35:39 | 000,002,426 | —- | C] () – C:\Windows\SysNative\WsmTxt.xsl
[2010/07/13 21:40:28 | 000,088,112 | —- | C] () – C:\Users\Angel\Documents\cc_20100713_214026.reg
[2010/06/26 18:59:03 | 000,037,056 | —- | C] () – C:\Users\Angel\Desktop\UPSShippingLabel.aspx.gif
[2010/06/26 16:38:41 | 000,010,310 | —- | C] () – C:\Users\Angel\Documents\Untitled.jpg
[2010/04/02 17:17:34 | 000,179,091 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2010/03/21 23:50:00 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2010/03/21 23:49:58 | 000,881,664 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2010/03/21 23:49:58 | 000,205,824 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2010/03/21 23:49:55 | 000,085,504 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2010/03/21 23:49:55 | 000,000,547 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll.manifest
[2010/03/15 06:18:44 | 000,033,792 | —- | C] () – C:\Windows\SysWow64\drivers\libusb0.sys
[2010/03/14 16:55:48 | 000,000,000 | —- | C] () – C:\Users\Angel\AppData\Local\prvlcl.dat
[2010/03/12 21:45:52 | 000,361,116 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistMSI0F93.txt
[2010/03/12 21:45:52 | 000,011,238 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistUI0F93.txt
[2010/03/12 21:42:47 | 000,361,716 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistMSI0D33.txt
[2010/03/12 21:42:46 | 000,011,222 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistUI0D33.txt
[2010/03/12 21:19:58 | 000,430,190 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistMSI7BC0.txt
[2010/03/12 21:19:58 | 000,011,398 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistUI7BC0.txt
[2010/03/05 14:09:07 | 000,000,120 | —- | C] () – C:\Users\Angel\AppData\Local\Wtileweciqus.dat
[2010/03/05 14:09:07 | 000,000,000 | —- | C] () – C:\Users\Angel\AppData\Local\Tvazusohomat.bin
[2010/02/20 21:32:40 | 000,229,802 | —- | C] () – C:\Users\Angel\AppData\Local\dd_ATL90SP1_KB973924MSI6ACC.txt
[2010/02/20 21:32:39 | 000,011,752 | —- | C] () – C:\Users\Angel\AppData\Local\dd_ATL90SP1_KB973924UI6ACC.txt
[2010/02/18 19:26:00 | 000,436,392 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistMSI6D96.txt
[2010/02/18 19:25:59 | 000,016,838 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistUI6D96.txt
[2010/02/10 23:16:10 | 000,041,872 | —- | C] () – C:\Windows\SysWow64\xfcodec.dll
[2009/12/06 16:50:26 | 000,000,023 | —- | C] () – C:\Windows\BlendSettings.ini
[2009/12/03 17:46:38 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/12/03 17:45:32 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/11/25 19:30:01 | 000,070,581 | —- | C] () – C:\ProgramData\nvModes.001
[2009/11/25 13:37:12 | 000,070,581 | —- | C] () – C:\ProgramData\nvModes.dat
[2009/11/10 22:17:51 | 000,000,079 | —- | C] () – C:\Users\Angel\AppData\Local\DVDPATH.TXT
[2009/10/12 16:30:09 | 000,000,551 | —- | C] () – C:\Users\Angel\AppData\Roaming\AutoGK.ini
[2009/07/10 14:46:20 | 000,000,422 | —- | C] () – C:\Windows\{27018D57-D152-44EF-BCE0-5E3B3445EABE}_WiseFW.ini
[2009/05/27 20:56:04 | 076,023,154 | —- | C] () – C:\Users\Angel\AppData\Roaming\speech.wav
[2009/05/20 15:02:27 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/05/16 01:35:33 | 000,027,648 | —- | C] () – C:\Windows\SysWow64\AVSredirect.dll
[2009/04/02 08:36:47 | 000,028,081 | —- | C] () – C:\Users\Angel\AppData\Local\dd_depcheckdotnetfx30.txt
[2009/04/02 08:36:41 | 000,033,790 | —- | C] () – C:\Users\Angel\AppData\Local\dd_dotnetfx3install.txt
[2009/04/02 08:36:41 | 000,003,432 | —- | C] () – C:\Users\Angel\AppData\Local\uxeventlog.txt
[2009/04/02 08:36:41 | 000,000,604 | —- | C] () – C:\Users\Angel\AppData\Local\dd_dotnetfx3error.txt
[2009/03/01 14:14:38 | 000,441,582 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistMSI7428.txt
[2009/03/01 14:14:34 | 000,011,484 | —- | C] () – C:\Users\Angel\AppData\Local\dd_vcredistUI7428.txt
[2009/02/11 15:09:57 | 000,155,136 | —- | C] () – C:\Users\Angel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/11 13:25:52 | 000,001,356 | —- | C] () – C:\Users\Angel\AppData\Local\d3d9caps.dat
[2009/02/11 13:25:51 | 000,000,552 | —- | C] () – C:\Users\Angel\AppData\Local\d3d8caps.dat
[2009/02/11 10:45:39 | 000,002,916 | —- | C] () – C:\Users\Angel\AppData\Local\d3d9caps64.dat
[2008/10/07 10:13:30 | 000,197,912 | —- | C] () – C:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 10:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[2008/01/20 22:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2006/03/18 09:16:04 | 000,540,178 | —- | C] () – C:\Windows\SysWow64\x264vfw.dll
[2002/10/15 18:54:04 | 000,165,376 | —- | C] () – C:\Windows\SysWow64\unrar.dll

========== LOP Check ==========

[2009/05/16 01:07:13 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\4Media Software Studio
[2009/09/16 01:02:29 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Azureus
[2009/07/30 22:05:44 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Bioshock
[2009/05/12 00:56:44 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Braid
[2010/03/12 20:18:18 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\DAEMON Tools Lite
[2009/05/16 01:23:40 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\GetRightToGo
[2010/04/04 16:35:40 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\gtk-2.0
[2010/04/22 03:39:20 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Guitar Pro 6
[2010/09/16 03:22:35 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\J River
[2010/08/30 08:31:39 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\LimeWire
[2009/11/17 19:23:11 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\mjusbsp
[2010/05/14 05:53:27 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\MotioninJoy
[2009/06/20 17:37:05 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\NCH Swift Sound
[2009/10/18 07:19:49 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\NeopleLauncherDFO
[2010/07/30 05:13:39 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Nexon
[2009/05/27 21:58:50 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\OpenOffice.org
[2009/02/16 00:47:38 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Red Alert 3
[2009/05/28 07:33:51 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\Stardock
[2009/10/23 11:16:24 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\SystemRequirementsLab
[2009/05/05 13:14:54 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\TeamViewer
[2010/02/18 19:32:32 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\TS3Client
[2010/09/18 05:53:37 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\uTorrent
[2010/04/09 02:08:51 | 000,000,000 | —D | M] – C:\Users\Angel\AppData\Roaming\’O‰ºŒ“¬‹äŠy•”
[2010/09/16 16:58:03 | 000,032,564 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 487 bytes -> C:\ProgramData\TEMP:05EE1EEF
< End of report >
Post #6
Angels_Smite:

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (uTorrent & Limewire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Please see this post for more information. I recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

🖼Click to load external image (Posted Image) Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
DRV:64bit: - (NwlnkFwd) – C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) – C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (IpInIp) – C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O33 - MountPoints2\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SetupAssistant.exe – [2008/01/24 07:14:00 | 000,685,296 | R— | M] (Belkin International, Inc.)
O33 - MountPoints2\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\Shell\AutoRun\command - "" = E:\autorun.exe – File not found
O33 - MountPoints2\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\Shell\phone\command - "" = E:\autorun.exe – File not found
O33 - MountPoints2\{9685db09-2e33-11df-8b9f-001966887a68}\Shell - "" = AutoRun
O33 - MountPoints2\{9685db09-2e33-11df-8b9f-001966887a68}\Shell\AutoRun\command - "" = E:\autorun.exe – File not found
@Alternate Data Stream - 487 bytes -> C:\ProgramData\TEMP:05EE1EEF
:Commands
[ClearAllRestorePoints]
[EmptyFlash]
[EmptyTemp]
[Purity]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, it will reboot when it is done and produce a log
🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:
  • OTL Fix log
  • MBAM log
Post #7
Sorry to bother, but I'm having trouble with Windows booting properly. When I start/restart the computer it tells me to: Reboot the computer with the correct drive installed or insert a proper boot device. (Or something really similar to that.) Just wondering if that might be my hard drive going bad or if I should just install a "clean" copy of Windows. ================================================================================ ================================================================================ All processes killed ========== OTL ========== Service NwlnkFwd stopped successfully! Service NwlnkFwd deleted successfully! File C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found not found. Service NwlnkFlt stopped successfully! Service NwlnkFlt deleted successfully! File C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found not found. Service IpInIp stopped successfully! Service IpInIp deleted successfully! File C:\Windows\SysNative\DRIVERS\ipinip.sys File not found not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3da15a3e-fb1b-11dd-b395-806e6f6e6963}\ not found. File move failed. D:\SetupAssistant.exe scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\ not found. File E:\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3da15a6c-fb1b-11dd-b395-b482e44ad047}\ not found. File E:\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9685db09-2e33-11df-8b9f-001966887a68}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9685db09-2e33-11df-8b9f-001966887a68}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9685db09-2e33-11df-8b9f-001966887a68}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9685db09-2e33-11df-8b9f-001966887a68}\ not found. File E:\autorun.exe not found. ADS C:\ProgramData\TEMP:05EE1EEF deleted successfully. ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYFLASH] User: All Users User: Angel ->Flash cache emptied: 6671 bytes User: Bob User: Default User: Default User User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Angel ->Temp folder emptied: 34242 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 82928790 bytes ->Flash cache emptied: 0 bytes User: Bob User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 316640 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 14348 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 341140 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 326 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 80.00 mb OTL by OldTimer - Version 3.2.12.1 log created on 09192010_081432 Files\Folders moved on Reboot… File move failed. D:\SetupAssistant.exe scheduled to be moved on reboot. Registry entries deleted on Reboot… Files\Folders moved on Reboot… File move failed. D:\SetupAssistant.exe scheduled to be moved on reboot. Registry entries deleted on Reboot… Files\Folders moved on Reboot… File\Folder D:\SetupAssistant.exe not found! Registry entries deleted on Reboot… ================================================================================ ================================================================================ Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4650 Windows 6.0.6002 Service Pack 2 (Safe Mode) Internet Explorer 8.0.6001.18943 9/19/2010 10:08:05 AM mbam-log-2010-09-19 (10-08-05).txt Scan type: Full scan (C:\|) Objects scanned: 335920 Time elapsed: 58 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Users\Angel\Desktop\DynastyWarriors6PLUS18Trainer\Trainer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Users\Angel\Desktop\My Stuff\Animation\Hinamori\Naruto\028.jpg (Extension.Mismatch) -> Quarantined and deleted successfully. C:\Users\Angel\Desktop\My Stuff\Animation\Hinamori\Naruto\1086392899049.jpg (Extension.Mismatch) -> Quarantined and deleted successfully. C:\Users\Angel\Desktop\My Stuff\Animation\Hinamori\Naruto\cf18defbf652bd2b55a4fc05decf3cc4.jpg (Extension.Mismatch) -> Quarantined and deleted successfully. ================================================================================ ================================================================================ If it helps to know I ran MBAM.exe in safe mode.
Post #8
I'm really sorry about this being so late and all, but is it really okay for me to be seeking help here when my computer is a x64 based version of windows? Also if is still okay, I will consent to uninstalling "Limewire" and "uTorrent" immediately. I just reread the rules, after two-three years of inactivity. Again, I'm really sorry if I caused you any trouble. Thank you for all help provided thus far.
Post #9
Angels_Smite:

Your 64bit OS is no trouble at all. Once we finish up with the malware we can look into your boot issues. Please do this next:

🖼Click to load external image (Posted Image) Uninstall the following old and insecure Java version. Instructions for uninstalling a program in Vista are HERE.
Java™ 6 Update 16

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.
  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • Kaspersly log
  • Is your computer running better now?
Post #10
Right now my computer is so unstable that out of the six times I have tried to do the scan, the furthest that I have gotten is to 75% then just like all the other times before that it freezes and then crashes into a blue screen. I'm trying it again right now for a seventh time. I will add another reply if it produces a log file.
Post #11
Angels_Smite:

Are you having new trouble (besides that boot message)? Try this scan instead - it's less resource intensive than Kaspersky:

🖼Click to load external image (Posted Image) Please run ESET Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Please include the following in your next post:
  • ESET log
Post #12
Ever since I did the OTL fix you suggested my computer has been really unstable, crashing freezing and the like. ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=52e26a6f3ca0d042a9250b2e85a2b2ed # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-09-21 09:47:53 # local_time=2010-09-21 05:47:53 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 50632054 50632054 0 0 # compatibility_mode=1024 16777215 100 0 16592321 16592321 0 0 # compatibility_mode=5891 16776893 100 83 0 14613988 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=209393 # found=1 # cleaned=0 # scan_time=3062 C:\Users\Angel\Desktop\My Stuff\GAMES\PSPBackup\PSPBackup\Install to PSP root.exe INF/Autorun.gen trojan 00000000000000000000000000000000 I
Post #13
Angels_Smite:

🖼Click to load external image (Posted Image) Please follow these instructions to run System File Checker:
  • Click the Windows button>> All Programs>> Accessories.
  • Right click the Command Prompt option and then select "Run as administrator" from the resulting menu.
  • With the Command Prompt window showing, type in: sfc /scannow and press (See the quote box below for the location of the spaces which are very important)
  • You will now receive a message that states the scan will now begin. If SFC should find any rogue files that need to be replaced, you may be asked to insert your Windows CD. If the SFC scans without finding any problems, you will receive the following message: "Windows resource protection did not find any integrity violations".
  • Close the command prompt window.

sfc/scannow


Let me know how this turns out.
Post #14
Microsoft Windows [Version 6.0.6002] Copyright © 2006 Microsoft Corporation. All rights reserved. C:\Users\Angel>sfc /scannow Beginning system scan. This process will take some time. Beginning verification phase of system scan. Verification 100% complete. Windows Resource Protection did not find any integrity violations.
Post #15
Angels_Smite:

Sorry for the delay. That ESET detection looks like a false positive, (assuming that is a program that you use). I don't see any outstanding malware problems, so I think the most efficient course of action at this point is to take care of some cleanup and have you start a new thread in our Microsoft Windows Forum for help with your system instability. All that was removed by the OTL fix were a proxy server setting that the malware added and some orphaned stuff - nothing that should have made your system unstable. Be sure to let your helper there know that we have taken care of the malware issues.

🖼Click to load external image (Posted Image) Run JavaRa to completely remove your old, unsecure Java applications:

Please download JavaRa (Copyright © 2008 RaProducts.org) and unzip it to your desktop.
  • Double-click on JavaRa.exe to start the program.
  • From the drop-down menu, choose English or the appropriate language…and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. I don't need to see it unless you have a problem or question.
🖼Click to load external image (Posted Image) Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
  • Manually delete any remaining logs or tools.
🖼Click to load external image (Posted Image) Install an anti-virus program. I don't see any anti-virus software running on your computer. Choose one, (but no more) reputable AV program. If you need help chosing one, this site has good information. Avast, AVG, Avira and Microsoft all offer free AV products.

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application and MBAM current and updated. Scan with them at least weekly.
  • Avoid using P2P programs. Refer back to my earlier post for more information.
  • Please carefully review the information in the Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI