Spyware / Malware / Virus Removal

possibly infected - GoldG exe amongst others

11 min read

Looking for the outcome? Ask AI

obeeone Topic Starter

Post #1October 3, 2010, 7:37 PM UTC

Hi

Recently noticed a couple of odd processes have appeared - Wg2.exe, Wybyb.exe. Have tried to stop/delete only to be told that they are being used by GoldG? Laptop seems slow and lots of faded icons have started appearing (for example I have 2 desktop.ini files on my desktop now).

Any help appreciated as ever… OTL scan results below…. Thanx!

OTL logfile created on: 03/10/2010 22:23:11 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Home\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.99 Gb Total Space | 205.08 Gb Free Space | 72.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-PC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Windows\SysWow64\atibtmon.exe File not found
PRC - C:\Users\Home\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\Wzybyb.exe (Simon Tatham)
PRC - C:\Users\Home\AppData\Local\Temp\Wg2.exe (Simon Tatham)
PRC - C:\Users\Home\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Home\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (clr_optimization_v4.0.30319_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NTI IScheduleSvc) – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (DsiWMIService) – C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (AntiVirSchedulerService) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (MWLService) – C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (GREGService) – C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (NTISchedulerSvc) – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (Microsoft Office Groove Audit Service) – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (MDM) – C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (avipbb) – C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) – C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (NTIDrvr) – C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) – C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080

O1 HOSTS File: ([2009/06/11 00:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKCU..\Run: [JCFSE7V7Z1] C:\Users\Home\AppData\Local\Temp\Wg2.exe (Simon Tatham)
O4 - Startup: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/10/03 21:47:56 | 000,193,536 | —- | C] (Simon Tatham) – C:\Windows\Wzybyb.exe
[2010/10/02 10:44:23 | 000,000,000 | —D | C] – C:\Users\Home\Desktop\New folder
[2010/09/28 21:13:47 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/09/13 20:27:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
[2010/09/09 23:48:48 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/09/09 23:48:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2010/09/09 23:48:48 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/09 23:47:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/09/05 19:32:57 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\ElevatedDiagnostics

========== Files - Modified Within 30 Days ==========

[2010/10/03 22:25:42 | 001,310,720 | -HS- | M] () – C:\Users\Home\NTUSER.DAT
[2010/10/03 22:25:17 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/03 22:25:17 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/03 22:18:19 | 000,000,244 | -H– | M] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/10/03 22:18:17 | 000,000,282 | -H– | M] () – C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/03 22:17:44 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/10/03 22:17:39 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/03 22:17:34 | 2210,578,432 | -HS- | M] () – C:\hiberfil.sys
[2010/10/03 21:59:24 | 001,651,658 | -H– | M] () – C:\Users\Home\AppData\Local\IconCache.db
[2010/10/03 21:57:00 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2225911312-2903998542-2569692443-1001UA.job
[2010/10/03 21:57:00 | 000,000,850 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2225911312-2903998542-2569692443-1001Core.job
[2010/10/03 21:45:23 | 000,000,112 | —- | M] () – C:\Windows\wininit.ini
[2010/10/03 21:43:30 | 000,193,536 | —- | M] (Simon Tatham) – C:\Windows\Wzybyb.exe
[2010/10/02 10:44:42 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/10/02 10:44:42 | 000,628,460 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/10/02 10:44:42 | 000,110,612 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/09/13 20:19:58 | 000,000,478 | —- | M] () – C:\Windows\win.ini

========== Files Created - No Company Name ==========

[2010/10/03 21:47:49 | 000,000,244 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/10/03 21:45:22 | 000,000,112 | —- | C] () – C:\Windows\wininit.ini
[2010/10/03 21:43:22 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/05/18 08:10:33 | 000,632,056 | —- | C] () – C:\Windows\Image.dll
[2010/05/18 08:10:33 | 000,000,637 | —- | C] () – C:\Windows\AutoSetFrequency.ini
[2010/05/18 08:10:33 | 000,000,378 | —- | C] () – C:\Windows\PidList.ini
[2010/04/12 06:17:04 | 000,131,472 | —- | C] () – C:\ProgramData\FullRemove.exe
[2009/07/14 02:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/14 00:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/07/29 16:49:48 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Auslogics
[2010/10/03 22:18:36 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Dropbox
[2010/08/09 22:11:28 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\eSobi
[2010/08/29 23:52:31 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\StreamTorrent
[2010/09/09 18:33:45 | 000,032,622 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/10/03 22:18:17 | 000,000,282 | -H– | M] () – C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/03 22:18:19 | 000,000,244 | -H– | M] () – C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/04/12 06:59:24 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/10/03 22:17:34 | 2210,578,432 | -HS- | M] () – C:\hiberfil.sys
[2010/10/03 22:17:36 | 2947,440,640 | -HS- | M] () – C:\pagefile.sys
[2010/04/12 06:16:11 | 000,003,274 | —- | M] () – C:\RHDSetup.log

< %systemroot%\Fonts\*.com >
[2009/07/14 08:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 08:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 08:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 08:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 23:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 14:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 07:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/07/27 21:07:12 | 000,000,221 | -HS- | M] () – C:\Users\Home\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:93EB7685
< End of report >

OTL Extras logfile created on: 03/10/2010 22:23:11 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Home\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.99 Gb Total Space | 205.08 Gb Free Space | 72.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-PC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – C:\Users\Home\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support
"{3B20226B-63ED-B863-B224-FE40401B21CA}" = ATI Catalyst Install Manager
"{5F02C14D-A630-4771-8409-0BA89FCCA8D6}" = iTunes
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}" = Bonjour
"{EEB06ECB-38F0-68CD-B215-94D50914C0F8}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01868E82-DA4F-BFF8-45CF-9B1CAE8810D9}" = Catalyst Control Center Core Implementation
"{01CC7DB7-909B-E630-A44A-8118036CAF3C}" = CCC Help Korean
"{07367450-E3E6-B4A1-E19C-A07429026680}" = CCC Help Swedish
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1C42AA63-B354-56AF-69CA-FA73285368BE}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FFDACFC-898C-FC99-0140-AE2FC18B710E}" = Catalyst Control Center Graphics Full New
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{268E2A87-470B-118B-B3AD-6F2615B86623}" = CCC Help Greek
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3601754A-C72B-E4B3-CE39-78CCD0B58DC9}" = CCC Help Russian
"{3A69B28B-6E44-E512-C395-EEDCB5BCB485}" = CCC Help Danish
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3BA616F8-F969-4DE7-0C85-35BE954DDB8A}" = CCC Help Hungarian
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3EED6569-D845-F8D1-9648-84729711590E}" = CCC Help Italian
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A41156A-0669-F7B5-B24C-5E25C69F1E68}" = CCC Help Turkish
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{63ADFC07-D92A-670C-3826-BB0C9CC41D8A}" = CCC Help Polish
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6488561D-83C8-6987-6163-744E60680139}" = CCC Help Japanese
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{69CA5A5F-7541-5216-6433-DE69E4245116}" = Catalyst Control Center Graphics Light
"{69F214C9-507D-7EB5-FF08-926CFD0D5EC6}" = Catalyst Control Center Localization All
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{762CB899-DF14-EB84-78F5-888C83AA7DC3}" = Catalyst Control Center Graphics Previews Common
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{83E4C065-91B9-20DD-74DA-90A71242CE18}" = CCC Help Norwegian
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AEAE107-B186-4EA8-5F84-3AAA3158FEB1}" = CCC Help Chinese Standard
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{E45272C9-B230-442E-B83E-9C246FD3BCC8}" =
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{E45272C9-B230-442E-B83E-9C246FD3BCC8}" =
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{E45272C9-B230-442E-B83E-9C246FD3BCC8}" =
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{E45272C9-B230-442E-B83E-9C246FD3BCC8}" =
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{E45272C9-B230-442E-B83E-9C246FD3BCC8}" =
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{E45272C9-B230-442E-B83E-9C246FD3BCC8}" =
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{975B24AC-8CB7-B4E1-E666-37964657576E}" = CCC Help Chinese Traditional
"{987B04C4-B5AC-4AD6-A7E9-8D681085B850}" = AMD USB Filter Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A45B7A40-694C-BAB8-EE69-4240ADFEA1FF}" = CCC Help Finnish
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.3.4 MUI
"{AD768FF7-E329-886C-D88E-585F26BB8738}" = CCC Help Dutch
"{B8F5BACE-194E-0203-023E-2FFEF68EE290}" = CCC Help English
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C450D07C-3914-5481-A068-29975DA5C596}" = CCC Help French
"{C9165CF3-A14D-A281-B62E-37312AA9E63D}" = CCC Help Spanish
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D4E16961-E6FA-4689-AD09-3DB7E5770167}" = Catalyst Control Center InstallProxy
"{D6B1E149-790E-3B60-07F9-07A40ECAFBA0}" = Catalyst Control Center Graphics Full Existing
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBF91CC3-41F6-0D99-3D2D-686C59865652}" = ccc-core-static
"{DD49AC0F-E08A-F77D-AB38-2EE9CD5D8F0B}" = CCC Help Thai
"{DECEFADB-0486-6252-C312-49DDAC71DF33}" = CCC Help Portuguese
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7425F93-2071-A946-008A-6ACA60B43FB2}" = CCC Help Czech
"{FC635D8E-FFBA-4B2C-BE68-A37D56BDFB74}" = Catalyst Control Center - Branding
"7-Zip" = 7-Zip 4.65
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"LManager" = Launch Manager
"Veetle TV" = Veetle TV 0.9.17
"VLC media player" = VLC media player 1.1.2
"WinLiveSuite_Wave3" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15/09/2010 12:53:33 | Computer Name = Home-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 15/09/2010 12:55:26 | Computer Name = Home-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "c:\program files (x86)\windows
live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program
files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity
found in manifest does not match the identity of the component requested. Reference
is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition
is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use
sxstrace.exe for detailed diagnosis.

Error - 15/09/2010 12:55:44 | Computer Name = Home-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/09/2010 12:55:44 | Computer Name = Home-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/09/2010 12:55:44 | Computer Name = Home-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/09/2010 12:55:44 | Computer Name = Home-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 16/09/2010 09:27:43 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program PowerDVD9.exe version 9.0.2719.0 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: ea8 Start
Time: 01cb55a2306e23cf Termination Time: 37 Application Path: C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9.exe

Report
Id: 2b770be5-c196-11df-b2a9-705ab6f5f64f

Error - 16/09/2010 12:51:31 | Computer Name = Home-PC | Source = Google Update | ID = 20
Description =

Error - 16/09/2010 14:04:28 | Computer Name = Home-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 19/09/2010 11:57:06 | Computer Name = Home-PC | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = DCOM | ID = 10005
Description =

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = DCOM | ID = 10005
Description =

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 28/09/2010 14:15:10 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 30/09/2010 15:40:14 | Computer Name = Home-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 30/09/2010 15:59:58 | Computer Name = Home-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

< End of report >

Blottedisk

Post #2October 4, 2010, 5:19 AM UTC

Hi obeeone

My name is Blottedisk, I'll be happy to assist you with all your malware problems you have on your computer. Before we start fixing your computer, there are a few points you need to know:

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.
Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.. Please don't start a new topic, but reply on this one.
Malware Logs can sometimes take a lot of time to research and interpret. Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
If you don't understand something, please ask! If you find any new problems and/or details, please post them!
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. Please do not delete anything unless instructed to. Do not use the comptuer exept for downloading tools and checking this topic
Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice. This may cause a delay in response time, but I will do my best to keep it as short as possible.

Reply to this topic until I say your computer is clean. Please bear with me, I will post back to you as soon as I can.

Thanks

obeeone

Post #3October 4, 2010, 5:29 AM UTC

Hi Blottedisk Ready and willing when you are! Cheers, Obeeone

Blottedisk

Post #4October 4, 2010, 8:32 AM UTC

Hi again obee,

These two new processes are very strange indeed. Do you have any idea how could they end up in your machine? Have you installed any software yesterday?

Ok, please follow these steps:

Step 1 | Please go to the following site to scan the files: Virus Total

Click on Browse, and upload the following files for analysis:
- C:\Windows\Wzybyb.exe
  C:\Users\Home\AppData\Local\Temp\Wg2.exe
Then click Submit. Allow each file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

Step 2 | Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

——————————————————————–

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:dir
C:\Windows\pss /s
:file
C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

obeeone

Post #5October 4, 2010, 9:09 AM UTC

Hi again OK, I will get the scans done this evening and post results up. Yes, I was given an exe file that was supposed to contain a presentation made on Captivate (screen video capture utlity). I was immediately concerned as when I double clicked it the file disappeared but the laptop was clearly trying to run something. The exe file never reappeared and that was when I checked the processes and spotted some unusual things. As ever I scanned the file with Avira before running and it found nothing. Will post the scans this evening when I get back from work. Thanks again, Obeeone

obeeone

Post #6October 4, 2010, 3:50 PM UTC

Hi As requested. although strangely I cant find Wg2.exe or Wg3.exe on my PC anywhere? Virus Total for wzybyb. exe Antivirus Version Last update Result AhnLab-V3 2010.10.04.01 2010.10.04 - AntiVir 7.10.12.117 2010.10.04 TR/FraudPack.kva.43 Antiy-AVL 2.0.3.7 2010.10.04 - Authentium 5.2.0.5 2010.10.04 W32/Renos.A!Generic Avast 4.8.1351.0 2010.10.04 - Avast5 5.0.594.0 2010.10.04 - AVG 9.0.0.851 2010.10.04 Generic19.AKEL BitDefender 7.2 2010.10.04 Gen:Variant.Kazy.1181 CAT-QuickHeal 11.00 2010.10.04 - ClamAV 0.96.2.0-git 2010.10.04 - Comodo 6277 2010.10.04 - DrWeb 5.0.2.03300 2010.10.04 Trojan.Packed.221 Emsisoft 5.0.0.50 2010.10.04 Gen.Variant!IK eSafe 7.0.17.0 2010.10.03 - eTrust-Vet 36.1.7891 2010.10.04 Win32/Renos.D!generic F-Prot 4.6.2.117 2010.10.04 W32/Renos.A!Generic F-Secure 9.0.15370.0 2010.10.04 Gen:Variant.Kazy.1181 Fortinet 4.1.143.0 2010.10.04 - GData 21 2010.10.04 Gen:Variant.Kazy.1181 Ikarus T3.1.1.90.0 2010.10.04 Gen.Variant Jiangmin 13.0.900 2010.10.03 - K7AntiVirus 9.63.2662 2010.10.02 Virus Kaspersky 7.0.0.125 2010.10.04 - McAfee 5.400.0.1158 2010.10.04 - McAfee-GW-Edition 2010.1C 2010.10.04 Heuristic.BehavesLike.Win32.Suspicious.H Microsoft 1.6201 2010.10.04 TrojanDownloader:Win32/Renos.LX NOD32 5502 2010.10.04 a variant of Win32/Kryptik.HCL Norman 6.06.07 2010.10.04 W32/Obfuscated.M nProtect 2010-10-04.04 2010.10.04 Gen:Variant.Kazy.1181 Panda 10.0.2.7 2010.10.04 Suspicious file PCTools 7.0.3.5 2010.10.02 - Prevx 3.0 2010.10.04 - Rising 22.67.02.07 2010.09.30 - Sophos 4.58.0 2010.10.04 Mal/FakeAV-CX Sunbelt 6978 2010.10.04 VirTool.Win32.Obfuscator.hg!b1 (v) SUPERAntiSpyware 4.40.0.1006 2010.10.04 - Symantec 20101.2.0.161 2010.10.04 Trojan.FakeAV!gen29 TheHacker 6.7.0.1.048 2010.10.04 Trojan/FraudPack.brdx TrendMicro 9.120.0.1004 2010.10.04 TROJ_FAKEAV.SMA7 TrendMicro-HouseCall 9.120.0.1004 2010.10.04 TROJ_FAKEAV.SMA7 VBA32 3.12.14.1 2010.10.04 Malware-Cryptor.Grygoryi.3 ViRobot 2010.10.4.4074 2010.10.04 - VirusBuster 12.67.2.0 2010.10.04 - MD5: 782dc4ebd4cb7c464be7564773cabadb SHA1: 1af45ddc05ce5c588fa1d3c3d44d8b3a9289416d SHA256: 7235f1775908a4f0b0934b374fa8fbc1c6e4a9c6718c62cd11e12e212a6edede File size: 193536 bytes Scan date: 2010-10-04 15:22:30 (UTC) SystemLook file SystemLook 04.09.10 by jpshortstuff Log created at 18:47 on 04/10/2010 by Home Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== dir ========== C:\Windows\pss - Parameters: "/s" —Files— boot.backup –a—- 24576 bytes [18:13 28/09/2010] [18:13 28/09/2010] boot.backup.LOG –ahs– 21504 bytes [18:13 28/09/2010] [18:13 28/09/2010] boot.backup.LOG1 –ahs– 0 bytes [18:13 28/09/2010] [18:13 28/09/2010] boot.backup.LOG2 –ahs– 0 bytes [18:13 28/09/2010] [18:13 28/09/2010] No folders found. ========== file ========== C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job - File found and opened. MD5: 0A722200E39BE264754CD43206E9AF63 Created at 18:43 on 03/10/2010 Modified at 15:44 on 04/10/2010 Size: 282 bytes Attributes: –ah— No version information available. C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job - File found and opened. MD5: C33E75CAC18D025D6A5A61EAC915128F Created at 18:47 on 03/10/2010 Modified at 15:36 on 04/10/2010 Size: 244 bytes Attributes: –ah— No version information available. -= EOF =- Thanks again! Obeeone

Blottedisk

Post #7October 5, 2010, 1:02 AM UTC

Hi obee,

Thanks for the logs and the info; these files are malware related. That .exe file that it was supposed to be a presentation was a malicious one. Please follow these steps:

Step 1 | Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\Windows\Wzybyb.exe (Simon Tatham)
PRC - C:\Users\Home\AppData\Local\Temp\Wg2.exe (Simon Tatham)
O4 - HKCU..\Run: [JCFSE7V7Z1] C:\Users\Home\AppData\Local\Temp\Wg2.exe (Simon Tatham)
[2010/10/03 21:47:56 | 000,193,536 | —- | C] (Simon Tatham) – C:\Windows\Wzybyb.exe
[2010/10/03 21:43:22 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/03 21:47:49 | 000,000,244 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

:Files
C:\Users\Home\AppData\Local\Temp\Wg2.exe

:Commands
[CREATERESTOREPOINT]
[purity]
[EmptyFlash]
[emptytemp]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
It will produce a log for you on reboot, please post that log in your next reply.

Step 2 | Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Step 3 | Please go to Kaspersky website and perform an online antivirus scan. Note: Internet Explorer should be used.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
Click on My Computer under Scan and then put the kettle on!
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place like your Desktop. Change the Files of type to Text file (.txt) before clicking on the Save button.
Copy and paste the report into your next.

[external image: Posted Image]

obeeone

Post #8October 6, 2010, 7:08 PM UTC

Hi again Thank for the help so far. No evidence of the odd processes as described before, although the laptop feels quite 'laggy'… delays when typing, blank screens for a few seconds when launching applications etc. Fairly quiet on the scans front however: OTL scan All processes killed Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret <[2010/10/03 21:47:56 | 000,193,536 | —- | C] (Simon Tatham) – C:\Windows\Wzybyb.exe> in the current context! Error: Unable to interpret <[2010/10/03 21:43:22 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job> in the current context! Error: Unable to interpret <[2010/10/03 21:47:49 | 000,000,244 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job> in the current context! ========== FILES ========== File\Folder C:\Users\Home\AppData\Local\Temp\Wg2.exe not found. ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYFLASH] User: All Users User: Aslihan ->Flash cache emptied: 0 bytes User: Default User: Default User User: Home ->Flash cache emptied: 343 bytes User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] Malware scan Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4748 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 05/10/2010 22:53:27 mbam-log-2010-10-05 (22-53-27).txt Scan type: Quick scan Objects scanned: 152088 Time elapsed: 6 minute(s), 32 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\JCFSE7V7Z1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Kaspersky ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, October 6, 2010 Operating system: Microsoft (build 7600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, October 06, 2010 11:54:00 Records in database: 4280474 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 125010 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 02:23:29 No threats found. Scanned area is clean. Selected area has been scanned.

Blottedisk

Post #9October 7, 2010, 1:17 AM UTC

Hi obee,

Thanks for the logs. The OTL fix was not executed properly. Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
PRC - C:\Windows\Wzybyb.exe (Simon Tatham)
PRC - C:\Users\Home\AppData\Local\Temp\Wg2.exe (Simon Tatham)
O4 - HKCU..\Run: [JCFSE7V7Z1] C:\Users\Home\AppData\Local\Temp\Wg2.exe (Simon Tatham)
[2010/10/03 21:47:56 | 000,193,536 | —- | C] (Simon Tatham) – C:\Windows\Wzybyb.exe
[2010/10/03 21:43:22 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/03 21:47:49 | 000,000,244 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

:Commands
[CREATERESTOREPOINT]
[purity]
[EmptyFlash]
[emptytemp]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
It will produce a log for you on reboot, please post that log in your next reply.

obeeone

Post #10October 7, 2010, 5:02 PM UTC

Hey again Results of OTL scan: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== No active process named Wzybyb.exe was found! No active process named Wg2.exe was found! Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\JCFSE7V7Z1 not found. File C:\Users\Home\AppData\Local\Temp\Wg2.exe not found. File C:\Windows\Wzybyb.exe not found. File C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job not found. File C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job not found. ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYFLASH] User: All Users User: Aslihan ->Flash cache emptied: 0 bytes User: Default User: Default User User: Home ->Flash cache emptied: 343 bytes User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP]

obeeone

Post #11October 8, 2010, 11:48 AM UTC

Hi again Im going to be away from my pc for a couple of days, should be back sunday evening. Please keep me alive on here! Cheers Obeeone

Blottedisk

Post #12October 8, 2010, 4:06 PM UTC

Allright, thanks for letting us know

When you come back, please double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Quick Scan button without changing any settings. The scan wont take long.
- When the scan completes, it will open a notepad window: OTL.Txt. It is saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of OTL.Txt, and post it in your next reply.
Note: there will only be an OTL.txt this time

obeeone

Post #13October 10, 2010, 11:06 AM UTC

Hi, back again!

OTL scan as follows:

OTL logfile created on: 10/10/2010 13:57:16 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Home\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 59.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.99 Gb Total Space | 205.06 Gb Free Space | 72.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-PC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - File not found – C:\Windows\SysWow64\atibtmon.exe
PRC - [2010/10/10 13:56:19 | 000,576,512 | —- | M] (OldTimer Tools) – C:\Users\Home\Downloads\OTL.exe
PRC - [2010/08/13 12:58:56 | 000,144,672 | —- | M] (Apple Inc.) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/04/01 13:33:19 | 000,267,432 | —- | M] (Avira GmbH) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/03/09 02:58:24 | 000,250,368 | —- | M] (NewTech Infosystems, Inc.) – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010/03/09 02:56:38 | 000,260,608 | —- | M] (NewTech Infosystems, Inc.) – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2010/03/03 16:21:16 | 001,300,560 | —- | M] (Dritek System Inc.) – C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010/03/03 16:21:16 | 000,325,200 | —- | M] (Dritek System Inc.) – C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010/03/03 16:21:16 | 000,297,040 | —- | M] (Dritek System Inc.) – C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010/03/02 11:28:31 | 000,282,792 | —- | M] (Avira GmbH) – C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/02/26 08:10:20 | 021,979,992 | —- | M] () – C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2010/02/24 10:28:09 | 000,135,336 | —- | M] (Avira GmbH) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010/02/01 21:05:02 | 000,349,552 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
PRC - [2010/01/29 02:27:36 | 000,243,232 | —- | M] (Acer Group) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2010/01/08 16:21:22 | 000,023,584 | —- | M] (Acer Incorporated) – C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009/12/25 04:45:16 | 000,401,192 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
PRC - [2009/12/25 04:44:48 | 000,201,512 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
PRC - [2009/11/06 03:51:20 | 000,144,640 | —- | M] (NewTech Infosystems, Inc.) – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
PRC - [2006/10/26 13:40:34 | 000,335,872 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe

========== Modules (SafeList) ==========

MOD - [2010/10/10 13:56:19 | 000,576,512 | —- | M] (OldTimer Tools) – C:\Users\Home\Downloads\OTL.exe
MOD - [2009/07/14 04:14:10 | 000,095,232 | —- | M] (Microsoft Corporation) – C:\Windows\SysWOW64\msscript.ocx
MOD - [2009/07/14 04:03:50 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/03/29 03:41:36 | 000,202,752 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2010/02/05 22:23:06 | 000,865,824 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe – (ePowerSvc)
SRV:64bit: - [2010/01/29 02:27:36 | 000,243,232 | —- | M] (Acer Group) [Auto | Running] – C:\Program Files\Acer\Acer Updater\UpdaterService.exe – (Updater Service)
SRV:64bit: - [2009/07/14 04:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2010/08/13 12:58:56 | 000,144,672 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/04/01 13:33:19 | 000,267,432 | —- | M] (Avira GmbH) [Auto | Running] – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe – (AntiVirService)
SRV - [2010/03/18 14:27:14 | 000,138,576 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_64)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/03/09 02:58:24 | 000,250,368 | —- | M] (NewTech Infosystems, Inc.) [Auto | Running] – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe – (NTI IScheduleSvc)
SRV - [2010/03/03 16:21:16 | 000,325,200 | —- | M] (Dritek System Inc.) [Auto | Running] – C:\Program Files (x86)\Launch Manager\dsiwmis.exe – (DsiWMIService)
SRV - [2010/02/24 10:28:09 | 000,135,336 | —- | M] (Avira GmbH) [Auto | Running] – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe – (AntiVirSchedulerService)
SRV - [2010/02/01 21:04:40 | 000,305,520 | —- | M] (Egis Technology Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe – (MWLService)
SRV - [2010/01/08 16:21:22 | 000,023,584 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files (x86)\Acer\Registration\GREGsvc.exe – (GREGService)
SRV - [2009/11/06 03:51:20 | 000,144,640 | —- | M] (NewTech Infosystems, Inc.) [Auto | Running] – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe – (NTISchedulerSvc)
SRV - [2009/11/06 03:50:50 | 000,050,432 | —- | M] (NewTech InfoSystems, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe – (NTIBackupSvc)
SRV - [2008/10/25 11:44:08 | 000,065,888 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe – (Microsoft Office Groove Audit Service)
SRV - [2006/10/26 13:40:34 | 000,335,872 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe – (MDM)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/04/19 20:47:42 | 000,050,688 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2010/04/01 11:18:30 | 003,060,800 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\BCMWL664.SYS – (BCM43XX)
DRV:64bit: - [2010/03/29 03:51:38 | 006,405,632 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atipmdag.sys – (amdkmdag)
DRV:64bit: - [2010/03/29 02:46:28 | 000,188,928 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmpag.sys – (amdkmdap)
DRV:64bit: - [2010/03/20 21:59:08 | 000,321,064 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\k57nd60a.sys – (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2010/03/02 13:35:01 | 000,116,568 | —- | M] (Avira GmbH) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avipbb.sys – (avipbb)
DRV:64bit: - [2010/02/16 14:24:00 | 000,081,072 | —- | M] (Avira GmbH) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\avgntflt.sys – (avgntflt)
DRV:64bit: - [2010/02/08 16:57:22 | 000,239,136 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV:64bit: - [2009/12/22 04:26:36 | 000,038,456 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\usbfilter.sys – (usbfilter)
DRV:64bit: - [2009/12/10 14:25:10 | 000,301,104 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2009/12/02 10:01:24 | 000,213,280 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RtHDMIVX.sys – (RTHDMIAzAudService)
DRV:64bit: - [2009/08/23 12:55:32 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009/07/14 04:52:21 | 000,106,576 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2009/07/14 04:52:21 | 000,028,752 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2009/07/14 04:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 04:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 04:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/14 04:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/20 05:09:57 | 001,394,688 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2009/06/10 23:38:56 | 000,000,308 | —- | M] () [File_System | On_Demand | Running] – C:\Windows\SysNative\wbem\ntfs.mof – (Ntfs)
DRV:64bit: - [2009/06/10 23:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 23:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 23:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 23:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/03 05:15:30 | 000,060,464 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys – (mwlPSDVDisk)
DRV:64bit: - [2009/06/03 05:15:30 | 000,022,576 | —- | M] (Egis Technology Inc.) [File_System | System | Running] – C:\Windows\SysNative\drivers\mwlPSDFilter.sys – (mwlPSDFilter)
DRV:64bit: - [2009/06/03 05:15:30 | 000,020,016 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDNserv.sys – (mwlPSDNServ)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2009/05/05 11:46:08 | 000,018,432 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NTIDrvr.sys – (NTIDrvr)
DRV:64bit: - [2009/05/05 11:46:08 | 000,016,896 | —- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\UBHelper.sys – (UBHelper)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…g4z195t56k2n228
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:2.22.1

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/10/04 22:08:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/10/04 22:08:32 | 000,000,000 | —D | M]

[2010/10/04 22:08:45 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\mozilla\Extensions
[2010/10/06 18:57:53 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\mozilla\Firefox\Profiles\x8r8c4xf.default\extensions
[2010/10/04 22:09:58 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\mozilla\Firefox\Profiles\x8r8c4xf.default\extensions\[removed]
[2010/10/04 22:08:32 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/09/15 00:09:10 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/09/15 00:09:10 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/09/15 00:09:10 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/09/15 00:09:10 | 000,001,135 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/06/11 00:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - Startup: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/10/07 20:28:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Morphyre
[2010/10/06 19:38:15 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Adobe
[2010/10/05 22:45:18 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Malwarebytes
[2010/10/05 22:45:09 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/10/05 22:45:07 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/10/05 22:45:06 | 000,024,664 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/10/05 22:45:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/10/04 22:08:38 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Mozilla
[2010/10/04 22:08:38 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Mozilla
[2010/10/04 22:08:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2010/10/02 10:44:23 | 000,000,000 | —D | C] – C:\Users\Home\Desktop\New folder
[2010/09/28 21:13:47 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/09/13 20:27:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
[2010/09/09 23:48:48 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/09/09 23:48:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2010/09/09 23:48:48 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/09 23:47:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/09/05 19:32:57 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\ElevatedDiagnostics
[2010/09/02 20:15:47 | 000,000,000 | R–D | C] – C:\Users\Home\Documents\My Dropbox
[2010/09/02 20:14:08 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Dropbox
[2010/08/29 23:56:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Veetle
[2010/08/29 23:52:31 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\StreamTorrent
[2010/08/27 21:24:10 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/08/21 20:46:23 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Apple Computer
[2010/08/21 20:45:47 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2010/08/21 20:44:55 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2010/08/21 20:44:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2010/08/21 20:44:31 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/08/21 20:44:20 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/08/21 20:44:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2010/08/21 20:44:13 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2010/08/21 20:44:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Apple
[2010/08/19 21:51:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio
[2010/08/19 21:51:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2010/08/19 21:51:12 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/08/19 21:49:25 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2010/08/19 21:49:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio 8
[2010/08/19 21:48:31 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Microsoft Help
[2010/08/19 21:46:49 | 000,000,000 | RH-D | C] – C:\MSOCache
[2010/08/16 22:46:06 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/08/16 22:46:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2010/08/16 22:45:58 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/08/16 22:45:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2010/08/16 21:50:40 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\vlc
[2010/08/16 21:33:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft.NET
[2010/08/16 21:26:24 | 000,000,000 | —D | C] – C:\Users\Home\security
[2010/08/16 21:25:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\VideoLAN
[2010/08/09 22:08:47 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\eSobi
[2010/08/09 21:52:15 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Deployment
[2010/08/06 22:10:06 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Apps
[2010/08/03 17:14:16 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2010/08/03 17:00:32 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Microsoft Games
[2010/08/03 10:10:49 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Cyberlink
[2010/08/03 10:10:43 | 000,000,000 | —D | C] – C:\Users\Home\Documents\CyberLink
[2010/08/03 10:10:43 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\CyberLink
[2010/08/03 10:10:43 | 000,000,000 | —D | C] – C:\ProgramData\CyberLink
[2010/07/31 10:36:38 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Skype
[2010/07/31 10:36:31 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2010/07/31 10:36:27 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2010/07/29 16:49:48 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Auslogics
[2010/07/29 10:27:14 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Wat
[2010/07/29 10:27:14 | 000,000,000 | —D | C] – C:\Windows\SysNative\Wat
[2010/07/27 22:46:06 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Avira
[2010/07/27 22:40:58 | 000,116,568 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avipbb.sys
[2010/07/27 22:40:58 | 000,081,072 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avgntflt.sys
[2010/07/27 22:40:58 | 000,051,992 | —- | C] (AVIRA GmbH) – C:\Windows\SysWow64\drivers\avgntdd.sys
[2010/07/27 22:40:58 | 000,017,016 | —- | C] (AVIRA GmbH) – C:\Windows\SysWow64\drivers\avgntmgr.sys
[2010/07/27 22:40:57 | 000,000,000 | —D | C] – C:\ProgramData\Avira
[2010/07/27 22:40:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Avira
[2010/07/27 22:17:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Auslogics
[2010/07/27 22:16:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\7-Zip
[2010/07/27 22:15:10 | 000,000,000 | —D | C] – C:\ProgramData\Comodo Downloader
[2010/07/27 21:40:09 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Chromium
[2010/07/27 21:29:34 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Adobe
[2010/07/27 21:10:56 | 000,000,000 | —D | C] – C:\ProgramData\Arcade Lab
[2010/07/27 21:07:20 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Google
[2010/07/27 21:07:19 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Google
[2010/07/27 20:45:16 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Diagnostics
[2010/07/26 09:42:56 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\ATI
[2010/07/26 09:42:56 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\ATI
[2010/07/25 19:00:51 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\EgisTec IPS
[2010/07/25 19:00:49 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Macromedia
[2010/07/25 19:00:34 | 000,000,000 | R–D | C] – C:\Users\Home\Searches
[2010/07/25 19:00:34 | 000,000,000 | -H-D | C] – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2010/07/25 19:00:23 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Identities
[2010/07/25 19:00:21 | 000,000,000 | R–D | C] – C:\Users\Home\Contacts
[2010/07/25 19:00:19 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\VirtualStore
[2010/07/25 18:59:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\OEM
[2010/07/25 18:59:29 | 000,000,000 | —D | C] – C:\Program Files\Acer Accessory Store
[2010/07/25 18:56:46 | 000,000,000 | –SD | C] – C:\Users\Home\AppData\Roaming\Microsoft
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Videos
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Saved Games
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Pictures
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Music
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Links
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Favorites
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Downloads
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Documents
[2010/07/25 18:56:46 | 000,000,000 | R–D | C] – C:\Users\Home\Desktop
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\AppData\Local\Temporary Internet Files
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Templates
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Start Menu
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\SendTo
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Recent
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\PrintHood
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\NetHood
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Documents\My Videos
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Documents\My Pictures
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Documents\My Music
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\My Documents
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Local Settings
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\AppData\Local\History
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Cookies
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\Application Data
[2010/07/25 18:56:46 | 000,000,000 | -HSD | C] – C:\Users\Home\AppData\Local\Application Data
[2010/07/25 18:56:46 | 000,000,000 | -H-D | C] – C:\Users\Home\AppData
[2010/07/25 18:56:46 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Temp
[2010/07/25 18:56:46 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Microsoft
[2010/07/25 18:56:46 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Media Center Programs
[2010/07/25 18:56:27 | 000,000,000 | -HSD | C] – C:\Recovery

========== Files - Modified Within 90 Days ==========

[2010/10/10 13:57:02 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2225911312-2903998542-2569692443-1001UA.job
[2010/10/10 13:52:43 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/10/10 13:52:37 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/10 13:52:31 | 2210,578,432 | -HS- | M] () – C:\hiberfil.sys
[2010/10/07 20:35:11 | 001,310,720 | -HS- | M] () – C:\Users\Home\NTUSER.DAT
[2010/10/07 20:35:09 | 002,191,654 | -H– | M] () – C:\Users\Home\AppData\Local\IconCache.db
[2010/10/07 20:16:36 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/07 20:16:36 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/06 21:57:00 | 000,000,850 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2225911312-2903998542-2569692443-1001Core.job
[2010/10/05 22:45:12 | 000,001,017 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/04 22:08:41 | 000,000,000 | —- | M] () – C:\Windows\nsreg.dat
[2010/10/04 22:08:35 | 000,001,971 | —- | M] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/10/03 21:45:23 | 000,000,112 | —- | M] () – C:\Windows\wininit.ini
[2010/10/02 10:44:42 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/10/02 10:44:42 | 000,628,460 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/10/02 10:44:42 | 000,110,612 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/09/13 20:19:58 | 000,000,478 | —- | M] () – C:\Windows\win.ini
[2010/09/02 20:15:47 | 000,001,021 | —- | M] () – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2010/08/21 21:09:02 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2010/08/20 10:29:39 | 000,425,488 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/08/19 22:10:59 | 000,110,832 | —- | M] () – C:\Users\Home\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/08/12 16:06:15 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/07/27 21:07:12 | 000,001,445 | —- | M] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/26 01:49:02 | 000,039,252 | —- | M] () – C:\Windows\SysWow64\license.rtf
[2010/07/26 01:49:02 | 000,039,252 | —- | M] () – C:\Windows\SysNative\license.rtf
[2010/07/25 19:01:51 | 000,524,288 | -HS- | M] () – C:\Users\Home\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010/07/25 19:01:51 | 000,524,288 | -HS- | M] () – C:\Users\Home\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010/07/25 19:01:51 | 000,065,536 | -HS- | M] () – C:\Users\Home\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010/07/25 18:56:46 | 000,000,020 | -HS- | M] () – C:\Users\Home\ntuser.ini

========== Files Created - No Company Name ==========

[2010/10/05 22:45:12 | 000,001,017 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/04 22:08:41 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/10/04 22:08:35 | 000,001,971 | —- | C] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/10/03 21:45:22 | 000,000,112 | —- | C] () – C:\Windows\wininit.ini
[2010/09/02 20:15:47 | 000,001,021 | —- | C] () – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2010/08/21 21:09:02 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2010/08/12 16:06:15 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/08/09 21:52:44 | 000,000,902 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2225911312-2903998542-2569692443-1001UA.job
[2010/08/09 21:52:43 | 000,000,850 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2225911312-2903998542-2569692443-1001Core.job
[2010/07/27 21:07:12 | 000,001,445 | —- | C] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/25 18:56:46 | 001,310,720 | -HS- | C] () – C:\Users\Home\NTUSER.DAT
[2010/07/25 18:56:46 | 000,524,288 | -HS- | C] () – C:\Users\Home\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010/07/25 18:56:46 | 000,524,288 | -HS- | C] () – C:\Users\Home\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010/07/25 18:56:46 | 000,262,144 | -HS- | C] () – C:\Users\Home\ntuser.dat.LOG1
[2010/07/25 18:56:46 | 000,065,536 | -HS- | C] () – C:\Users\Home\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010/07/25 18:56:46 | 000,000,290 | —- | C] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2010/07/25 18:56:46 | 000,000,272 | —- | C] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2010/07/25 18:56:46 | 000,000,020 | -HS- | C] () – C:\Users\Home\ntuser.ini
[2010/07/25 18:56:46 | 000,000,000 | -HS- | C] () – C:\Users\Home\ntuser.dat.LOG2
[2010/05/18 08:10:33 | 000,632,056 | —- | C] () – C:\Windows\Image.dll
[2010/05/18 08:10:33 | 000,000,637 | —- | C] () – C:\Windows\AutoSetFrequency.ini
[2010/05/18 08:10:33 | 000,000,378 | —- | C] () – C:\Windows\PidList.ini
[2010/04/12 06:17:04 | 000,131,472 | —- | C] () – C:\ProgramData\FullRemove.exe
[2009/07/14 02:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/14 00:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/07/29 16:49:48 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Auslogics
[2010/10/10 13:58:08 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Dropbox
[2010/08/09 22:11:28 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\eSobi
[2010/08/29 23:52:31 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\StreamTorrent
[2010/09/09 18:33:45 | 000,032,622 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:93EB7685
< End of report >

Blottedisk

Post #14October 10, 2010, 11:35 PM UTC

Hi again obee

Congratulations, the machine seems clean now, we've got rid of those malicious files. Please follow these last steps:

Step 1 | Clean up with OTL

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Now, from the desktop, delete any logs that you have left over.

Step 2 | Let's reset system restore.

Right-click on My Computer and go to Properties.
Click on the System Protection link
The System Properties dialog screen will open up. Click on Create
Type in a description for the restore point which will help you remember the point at which is was created
Wait while it creates the restore point
When finished, press the close button

Next:
Click Start, type Cleanmgr.exe and press ENTER
Select the C drive from the list and click OK
Click Clean up system files
This restarts Disk Cleanup to run in elevated mode.
Select the C drive from the list and click OK
Click the More Options tab
Click the Clean up… button under System Restore and Shadow Copies.
Click OK

Last Step | Now, in order to avoid future infections, please take time to read the following articles:

Simple and easy ways to keep your computer safe and secure on the Internet
Preventing Malware - Tools and Practices for Safe Computing
So how did I get infected in the first place?
How to prevent malware

Read those articles and your potential for being infected again will reduce dramatically.

Thank you for your patience, and performing all of the procedures requested. I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.

obeeone

Post #15October 11, 2010, 2:57 PM UTC

Hi again Thanks for all your help, will get on with the clean up. all the best obeeone

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

possibly infected - GoldG exe amongst others

✨ Ask AI

Ask AI