What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

IR Hijacked - won't start

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
here is the Eset scan log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=55b1d4b3dbccd7409eb54f5f3988c855 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-09-26 06:57:23 # local_time=2010-09-26 02:57:23 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=2560 16777191 100 0 0 0 0 0 # compatibility_mode=5121 16777173 100 75 0 13263935 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=50890 # found=4 # cleaned=0 # scan_time=2801 C:\Qoobox\Quarantine\C\Documents and Settings\Joanne\Application Data\Atzy\iwmo.exe.vir a variant of Win32/Kryptik.FLJ trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Documents and Settings\Joanne\Application Data\Yvce\ixom.exe.vir a variant of Win32/Kryptik.FGX trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{EA06A608-27AB-4662-8815-D6F9E601626D}\RP29\A0042792.exe a variant of Win32/Kryptik.FLJ trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{EA06A608-27AB-4662-8815-D6F9E601626D}\RP29\A0042793.exe a variant of Win32/Kryptik.FGX trojan 00000000000000000000000000000000 I
Post #17
Please open OTL


  • Click the Run Scan button.The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.



Please tell me how the computer is running now
Post #18
Here is the output of OTL.txt :

OTL logfile created on: 9/27/2010 9:28:10 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Emmet Smith\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 178.00 Mb Available Physical Memory | 35.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.72 Gb Total Space | 100.55 Gb Free Space | 90.00% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: EMMET
Current User Name: Emmet Smith
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Emmet Smith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\1285387552\ee\aolsoftware.exe (America Online, Inc.)
PRC - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe ()
PRC - C:\Program Files\Common Files\AOL\ACS\acsd.exe (America Online, Inc.)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Emmet Smith\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\615\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (Browser Defender Update Service) – C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (dlcd_device) – C:\WINDOWS\System32\dlcdcoms.exe ( )
SRV - (AdobeActiveFileMonitor) – C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe ()
SRV - (PhotoshopElementsDeviceConnect) – C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe ()
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\acsd.exe (America Online, Inc.)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)
SRV - (NMSSvc) Intel® – C:\WINDOWS\system32\NMSSvc.Exe (Intel Corporation)


========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (pctplsg) – C:\WINDOWS\system32\drivers\pctplsg.sys (PC Tools)
DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (pctgntdi) – C:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (P16X) Creative SB Live! Series (WDM) – C:\WINDOWS\system32\drivers\P16X.sys (Creative Technology Ltd.)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMSM.sys (Broadcom Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (NMSCFG) – C:\WINDOWS\system32\drivers\NMSCFG.SYS (Intel Corporation)
DRV - (OMCI) – C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.pctools.com/mrc/fix_homepage/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\Spyware Doctor\BDT\FireFox\ [2010/07/21 08:47:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/09/25 23:00:32 | 000,000,000 | —D | M]


O1 HOSTS File: ([2010/09/26 13:49:47 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20100925144348.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Avery Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (Avery Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Avery Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1285387552\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe (America Online, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A…01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1254091013500 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8BBDC81D-81B3-49EE-87E8-47B7A707FAE8} https://www1.gotomeeting.com/default/applets/g2mdlax.cab (GoToMeeting Web Starter)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\615\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/14 01:01:20 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/09/26 14:06:43 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/09/26 13:58:50 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/09/25 15:33:18 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/09/25 15:32:33 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/09/25 14:43:01 | 000,000,000 | —D | C] – C:\Program Files\McAfee.com
[2010/09/25 12:04:25 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/09/25 12:01:22 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/09/25 12:01:22 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/09/25 12:01:22 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/09/25 12:01:22 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/09/25 12:00:44 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/09/25 11:59:10 | 000,000,000 | —D | C] – C:\Qoobox
[2010/09/25 00:06:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\AOL
[2010/09/25 00:05:47 | 000,000,000 | —D | C] – C:\Program Files\AOL
[2010/09/25 00:05:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AOL Downloads
[2010/09/24 18:23:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\WinZip
[2010/09/24 10:49:47 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Emmet Smith\Desktop\OTL.exe
[2010/09/24 10:06:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\Desktop\backups
[2010/09/23 15:51:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\Primax
[2010/09/23 12:51:27 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Emmet Smith\Desktop\HiJackThis.exe
[2010/09/23 11:54:47 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\AdobeUM
[2010/09/22 11:01:47 | 000,447,792 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Emmet Smith\Desktop\FixitCenter_Run.exe
[2010/09/20 09:39:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\Sapphire
[2010/09/20 08:32:39 | 000,084,264 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdet.sys
[2010/09/17 16:50:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\CRManager - Engage-IT
[2010/09/16 13:55:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\IntraLinks
[2010/09/13 17:41:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\Citi
[2010/09/13 13:22:06 | 000,000,000 | —D | C] – C:\Program Files\SiteAdvisor
[2010/09/13 13:20:50 | 000,009,344 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeclnk.sys
[2010/09/13 13:20:43 | 000,088,544 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfendisk.sys
[2010/09/13 13:20:43 | 000,084,072 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfetdi2k.sys
[2010/09/13 13:20:42 | 000,312,904 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfefirek.sys
[2010/09/13 13:20:42 | 000,152,992 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeavfk.sys
[2010/09/13 13:20:42 | 000,055,840 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\cfwids.sys
[2010/09/13 13:20:42 | 000,052,104 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfebopk.sys
[2010/09/13 13:20:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Mcafee
[2010/09/13 13:20:11 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2010/09/13 11:44:14 | 003,059,184 | —- | C] (McAfee, Inc.) – C:\Documents and Settings\Emmet Smith\Desktop\DMSetup.exe
[2010/09/11 12:03:19 | 000,000,000 | —D | C] – C:\Program Files\Windows Live Safety Center
[2010/09/11 01:36:52 | 001,508,048 | —- | C] (Citrix Online, a division of Citrix Systems, Inc.) – C:\Documents and Settings\Emmet Smith\Desktop\GoToAssist.exe
[2010/09/11 01:12:46 | 000,000,000 | —D | C] – C:\WINDOWS\McAfee.com
[2010/09/10 15:58:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\Constant Contact
[2010/09/10 15:50:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\Aspen
[2010/09/07 17:51:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\LMI Sept
[2010/09/06 14:56:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\Autos
[2010/09/06 07:56:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\PICASA
[2010/09/02 14:48:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Emmet Smith\My Documents\TBAR Vignettes
[2009/09/27 21:31:12 | 000,638,976 | —- | C] ( ) – C:\WINDOWS\System32\dlcdpmui.dll
[2009/09/27 21:31:09 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\dlcdcomm.dll
[2009/09/27 21:31:09 | 000,114,688 | —- | C] ( ) – C:\WINDOWS\System32\dlcdpplc.dll
[2009/09/27 21:31:08 | 001,134,592 | —- | C] ( ) – C:\WINDOWS\System32\dlcdusb1.dll
[2009/09/27 21:31:08 | 000,774,144 | —- | C] ( ) – C:\WINDOWS\System32\dlcdhbn3.dll
[2009/09/27 21:31:08 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\dlcdlmpm.dll
[2009/09/27 21:31:07 | 000,704,512 | —- | C] ( ) – C:\WINDOWS\System32\dlcdcomc.dll
[2009/09/27 21:31:07 | 000,155,648 | —- | C] ( ) – C:\WINDOWS\System32\dlcdprox.dll
[2009/09/27 21:31:06 | 001,183,744 | —- | C] ( ) – C:\WINDOWS\System32\dlcdserv.dll
[2002/04/11 00:41:00 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\A3d.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[3 C:\Documents and Settings\Emmet Smith\My Documents\*.tmp files -> C:\Documents and Settings\Emmet Smith\My Documents\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/27 09:08:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/27 09:01:17 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/09/27 09:01:15 | 000,000,246 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/09/27 09:01:02 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/27 09:00:53 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/27 09:00:04 | 003,407,872 | -H– | M] () – C:\Documents and Settings\Emmet Smith\NTUSER.DAT
[2010/09/27 09:00:04 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Emmet Smith\ntuser.ini
[2010/09/26 13:51:39 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/09/26 13:49:47 | 000,001,595 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Center.lnk
[2010/09/26 13:49:47 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/09/26 13:49:28 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/26 13:49:24 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/26 13:49:23 | 535,871,488 | -HS- | M] () – C:\hiberfil.sys
[2010/09/26 13:47:56 | 000,001,409 | —- | M] () – C:\WINDOWS\QTFont.for
[2010/09/26 13:34:02 | 003,854,198 | R— | M] () – C:\Documents and Settings\Emmet Smith\Desktop\ComboFix.exe
[2010/09/26 03:11:51 | 000,289,296 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/26 03:08:00 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/09/25 17:04:24 | 000,000,687 | —- | M] () – C:\WINDOWS\win.ini
[2010/09/25 12:04:34 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2010/09/25 07:22:29 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/09/24 18:17:54 | 000,284,915 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\gmer.zip
[2010/09/24 17:50:30 | 000,525,824 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\dds.pif
[2010/09/24 14:41:20 | 000,525,824 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\dds.scr
[2010/09/24 11:14:23 | 000,080,608 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\OTL scan.GIF
[2010/09/24 10:53:07 | 000,002,483 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\Microsoft Word.lnk
[2010/09/24 10:49:48 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Emmet Smith\Desktop\OTL.exe
[2010/09/23 12:52:30 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Emmet Smith\Desktop\HiJackThis.exe
[2010/09/22 11:01:49 | 000,447,792 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Emmet Smith\Desktop\FixitCenter_Run.exe
[2010/09/13 11:44:17 | 003,059,184 | —- | M] (McAfee, Inc.) – C:\Documents and Settings\Emmet Smith\Desktop\DMSetup.exe
[2010/09/13 11:11:51 | 001,508,048 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) – C:\Documents and Settings\Emmet Smith\Desktop\GoToAssist.exe
[2010/09/11 09:45:09 | 000,212,111 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\result.cab
[2010/09/11 09:15:54 | 000,077,808 | —- | M] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/09/11 01:21:57 | 003,048,960 | —- | M] () – C:\Documents and Settings\Emmet Smith\My Documents\mvt_en-us.msi
[2010/09/01 11:04:26 | 000,001,349 | —- | M] () – C:\Documents and Settings\Emmet Smith\Desktop\webinar.ics
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[3 C:\Documents and Settings\Emmet Smith\My Documents\*.tmp files -> C:\Documents and Settings\Emmet Smith\My Documents\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/25 14:45:53 | 000,001,595 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Center.lnk
[2010/09/25 12:04:33 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/09/25 12:04:27 | 000,260,272 | RHS- | C] () – C:\cmldr
[2010/09/25 12:01:22 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/09/25 12:01:22 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/09/25 12:01:22 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/09/25 12:01:22 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/09/25 12:01:22 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/09/25 11:56:08 | 003,854,198 | R— | C] () – C:\Documents and Settings\Emmet Smith\Desktop\ComboFix.exe
[2010/09/24 18:17:52 | 000,284,915 | —- | C] () – C:\Documents and Settings\Emmet Smith\Desktop\gmer.zip
[2010/09/24 17:50:29 | 000,525,824 | —- | C] () – C:\Documents and Settings\Emmet Smith\Desktop\dds.pif
[2010/09/24 14:41:19 | 000,525,824 | —- | C] () – C:\Documents and Settings\Emmet Smith\Desktop\dds.scr
[2010/09/24 11:14:19 | 000,080,608 | —- | C] () – C:\Documents and Settings\Emmet Smith\Desktop\OTL scan.GIF
[2010/09/21 16:39:25 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/09/14 13:21:37 | 000,054,156 | -H– | C] () – C:\WINDOWS\QTFont.qfn
[2010/09/14 13:21:37 | 000,001,409 | —- | C] () – C:\WINDOWS\QTFont.for
[2010/09/11 09:45:42 | 000,212,111 | —- | C] () – C:\Documents and Settings\Emmet Smith\Desktop\result.cab
[2010/09/11 01:18:13 | 003,048,960 | —- | C] () – C:\Documents and Settings\Emmet Smith\My Documents\mvt_en-us.msi
[2010/04/18 19:09:09 | 000,003,584 | —- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/18 12:25:20 | 000,008,274 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\121721152
[2010/04/18 12:25:20 | 000,008,274 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\121721152
[2010/04/17 20:26:09 | 000,008,286 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\7YPkO6RH
[2010/04/17 20:26:09 | 000,008,286 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\7YPkO6RH
[2010/04/14 21:20:55 | 000,010,848 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\2999075897
[2010/04/14 21:20:55 | 000,010,848 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\2999075897
[2010/04/14 21:13:42 | 000,010,852 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\id7F4Wr0UP77
[2010/04/14 21:13:42 | 000,010,852 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\id7F4Wr0UP77
[2010/04/14 19:37:25 | 000,017,228 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\i202
[2010/04/14 19:37:25 | 000,017,228 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\i202
[2010/04/14 15:46:34 | 000,767,928 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2010/04/14 15:46:34 | 000,763,832 | —- | C] () – C:\WINDOWS\BDTSupport.dll.old
[2010/04/14 15:07:23 | 000,014,728 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\400143593
[2010/04/14 15:07:23 | 000,014,728 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\400143593
[2010/04/14 13:28:17 | 000,014,732 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\arH24Khir
[2010/04/14 13:28:17 | 000,014,732 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\arH24Khir
[2010/03/06 17:53:04 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/09/27 21:31:59 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\dlcdcfg.dll
[2009/09/27 21:31:11 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\dlcdins.dll
[2009/09/27 21:31:11 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\dlcdinsr.dll
[2009/09/27 21:31:10 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\dlcdvs.dll
[2009/09/27 21:31:05 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\dlcdcur.dll
[2009/09/27 21:31:04 | 000,430,080 | —- | C] () – C:\WINDOWS\System32\dlcdutil.dll
[2009/09/27 21:31:04 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\dlcdcu.dll
[2009/09/27 21:31:01 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\dlcdinsb.dll
[2009/09/27 21:31:01 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\dlcdcub.dll
[2009/09/27 21:30:59 | 000,131,072 | —- | C] () – C:\WINDOWS\System32\dlcdjswr.dll
[2009/09/25 13:30:49 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2003/10/06 14:16:00 | 000,027,136 | —- | C] () – C:\WINDOWS\System32\nvcod.dll
[2003/07/08 13:41:48 | 000,047,616 | —- | C] () – C:\WINDOWS\System32\P16X.dll
[2002/02/06 09:04:14 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\NMSInst.dll
[2002/01/21 14:17:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PROInst.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 203 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
< End of report >
Post #19
Mowman,

System is running faster since yesterday.

Here is the extras.txt log file:

OTL Extras logfile created on: 9/27/2010 9:28:10 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Emmet Smith\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 178.00 Mb Available Physical Memory | 35.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.72 Gb Total Space | 100.55 Gb Free Space | 90.00% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: EMMET
Current User Name: Emmet Smith
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 – (America Online, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 – (America Online, Inc.)
"C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host – (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01A4AEDE-F219-49A2-B855-16A016EAF9A4}" = Intel® PROSet II
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.1
"{851C67EF-068A-4060-9EF5-2E3DDCD68382}" = Adobe Photoshop Elements 3.0
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F1A20DC-251D-47B0-91B7-DCA2523EE6C9}" = McAfee Virtual Technician
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90300409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{91130409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Small Business
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B88DD94-1AAE-41C4-BD95-2D8737D5E9E2}" = Watson
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4E96960-5F6B-48B9-A5BD-6A5A9BB4F027}" = Avery Wizard 3.1
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"America Online us" = America Online (Choose which version to remove)
"AolCoach" = AOL Coach Version 1.0(Build:20030807.3)
"BCM V.92 56K Modem" = BCM V.92 56K Modem
"Browser Defender_is1" = Browser Defender [removed]
"Dell Photo AIO Printer 944" = Dell Photo AIO Printer 944
"ESET Online Scanner" = ESET Online Scanner v3
"GoToAssist" = GoToAssist Corporate
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MSC" = McAfee SecurityCenter
"NVIDIA Display Driver" = NVIDIA Display Driver
"PROSet" = Intel® PRO Ethernet Adapter and Software
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer Basic
"Spyware Doctor" = Spyware Doctor 7.0
"StreetPlugin" = Learn2 Player (Uninstall Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows XP Service Pack" = Windows XP Service Pack 3

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.5.0.457

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/13/2010 9:47:10 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:13 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:19 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:22 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:24 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:27 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:29 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:32 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:34 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

Error - 9/13/2010 9:47:35 AM | Computer Name = EMMET | Source = McLogEvent | ID = 5046
Description = The McShield scanning service cannot find any configuration in the
registry

[ System Events ]
Error - 9/25/2010 5:35:31 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 9/25/2010 5:35:31 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NVSvc service.

Error - 9/25/2010 5:36:04 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 9/25/2010 5:36:05 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 9/26/2010 1:33:01 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7034
Description = The McAfee SiteAdvisor Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 9/26/2010 1:37:03 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7034
Description = The Photoshop Elements Device Connect service terminated unexpectedly.
It has done this 1 time(s).

Error - 9/26/2010 1:37:03 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7034
Description = The Adobe Active File Monitor service terminated unexpectedly. It
has done this 1 time(s).

Error - 9/26/2010 1:50:36 PM | Computer Name = EMMET | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NVSvc service.

Error - 9/26/2010 1:52:53 PM | Computer Name = EMMET | Source = DCOM | ID = 10010
Description = The server {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A} did not register
with DCOM within the required timeout.

Error - 9/27/2010 9:03:12 AM | Computer Name = EMMET | Source = DCOM | ID = 10010
Description = The server {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A} did not register
with DCOM within the required timeout.


< End of report >
Post #20
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Otl
[2010/04/18 12:25:20 | 000,008,274 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\121721152
[2010/04/18 12:25:20 | 000,008,274 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\121721152
[2010/04/17 20:26:09 | 000,008,286 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\7YPkO6RH
[2010/04/17 20:26:09 | 000,008,286 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\7YPkO6RH
[2010/04/14 21:20:55 | 000,010,848 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\2999075897
[2010/04/14 21:20:55 | 000,010,848 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\2999075897
[2010/04/14 21:13:42 | 000,010,852 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\id7F4Wr0UP77
[2010/04/14 21:13:42 | 000,010,852 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\id7F4Wr0UP77
[2010/04/14 15:07:23 | 000,014,728 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\400143593
[2010/04/14 15:07:23 | 000,014,728 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\400143593
[2010/04/14 13:28:17 | 000,014,732 | -HS- | C] () – C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\arH24Khir
[2010/04/14 13:28:17 | 000,014,732 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\arH24Khir



:Commands
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Post #21
Here iis the log: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\121721152 moved successfully. C:\Documents and Settings\All Users\Application Data\121721152 moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\7YPkO6RH moved successfully. C:\Documents and Settings\All Users\Application Data\7YPkO6RH moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\2999075897 moved successfully. C:\Documents and Settings\All Users\Application Data\2999075897 moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\id7F4Wr0UP77 moved successfully. C:\Documents and Settings\All Users\Application Data\id7F4Wr0UP77 moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\400143593 moved successfully. C:\Documents and Settings\All Users\Application Data\400143593 moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Application Data\arH24Khir moved successfully. C:\Documents and Settings\All Users\Application Data\arH24Khir moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 41620 bytes User: Emmet Smith ->Temp folder emptied: 176673 bytes ->Temporary Internet Files folder emptied: 19359828 bytes ->Flash cache emptied: 570 bytes User: Joanne ->Temp folder emptied: 2045 bytes ->Temporary Internet Files folder emptied: 7214130 bytes ->Flash cache emptied: 745 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 1003201 bytes ->Flash cache emptied: 31969 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 139940 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1145933 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 460552 bytes Windows Temp folder emptied: 1639 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 28.00 mb OTL by OldTimer - Version 3.2.14.1 log created on 09272010_103707 Files\Folders moved on Reboot… C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DF5EEA.tmp moved successfully. File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DF7B78.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DF7F2A.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DFBAF9.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DFBDB1.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DFBF15.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DFC170.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DFC3C7.tmp not found! File\Folder C:\Documents and Settings\Emmet Smith\Local Settings\Temp\~DFC470.tmp not found! C:\Documents and Settings\Emmet Smith\Local Settings\Temporary Internet Files\Content.IE5\RL0NBE0Y\like[2].htm moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Temporary Internet Files\Content.IE5\O1DMNBIM\iframe[2].htm moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Temporary Internet Files\Content.IE5\3J7DQ0NU\index[4].htm moved successfully. C:\Documents and Settings\Emmet Smith\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. Registry entries deleted on Reboot…
Post #22
You appear clean of infections,please do the following.



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)






Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.






Your Adobe reader is out of date,it can be updated here






Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI