Spyware / Malware / Virus Removal

HTTP Nukesploit Request

7 min read

Looking for the outcome? Ask AI

o0xen0o Topic Starter

Post #1October 11, 2010, 12:10 AM UTC

I have recently received a message from my 'Norton Internet Security' program which has indicated to me I have the virus listed below. I have already done several scans with my anti-virus program and I also have tried a free version of 'ad-Aware' spyware removal program to locate and remove the virus but both programs have been unsuccessful in finding the virus at all let alone removing it; the report I received is listed below along with an OTL report which I hoped would further help anyone interested in helping me further,
thank-you in advance;

————————————————————————————————————————————————————————————

Severity High

Activity An Intrusion Attempt By 192.168.1.5 (my computer) was blocked

Status: Blocked

Recommended Action: No action required

Risk Name: HTTP Nukesploit Request

Attacking Computer: 192.168.1.5 (my computer), 52979

Attacker URL: spigot.cablecom.info:8080/jquery.jxx?v=5.3.4

Destination Address: 188.165.192.106, 8080

Source Address: 192.168.1.5 (my computer)

Traffic Destination: TCP , port 52979

Network traffic from 192.168.1.5 matches the signature of a know attack. The attack was resulted from \DEVICE\HARDDISKVOLUME3\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE. To stop being notfied for this type of traffic, in the actions panel click stop notifying me. Network traffic from spigot.cablecom.info:8080/jquery.jxx?v=5.3.4 matches the signature of a know attack. The attack was resulted from \DEVICE\HARDDISKVOLUME3\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE. To stop being notfied for this type of traffic, in the actions panel click stop notifying me.

————————————————————————————————————————————————————————————

I have gone ahead and scanned my computer with 'OTL' as per request in the 'are you infected' topic:

'OTL.txt' Report

OTL logfile created on: 11/10/2010 1:06:58 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Brent\Desktop
64bit- An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

6.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 68.00% Memory free
12.00 Gb Paging File | 8.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.46 Gb Total Space | 88.72 Gb Free Space | 31.75% Space Free | Partition Type: NTFS
Drive D: | 298.09 Gb Total Space | 297.99 Gb Free Space | 99.97% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 66.56 Gb Free Space | 28.58% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 931.51 Gb Total Space | 696.88 Gb Free Space | 74.81% Space Free | Partition Type: NTFS
Drive I: | 465.76 Gb Total Space | 226.19 Gb Free Space | 48.56% Space Free | Partition Type: NTFS

Computer Name: TUARA
Current User Name: Brent
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Brent\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\WD\WD Anywhere Backup\MemeoBackup.exe (Memeo Inc.)
PRC - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
PRC - C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\CyberLink\Shared Files\brs.exe (cyberlink)
PRC - C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe ()
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe ()

========== Modules (SafeList) ==========

MOD - C:\Users\Brent\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp.dll (SlySoft, Inc.)
MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (PnkBstrA) – C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (FLEXnet Licensing Service 64) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Macrovision Europe Ltd.)
SRV:64bit: - (UmRdpService) – C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (StorSvc) – C:\Windows\SysNative\StorSvc.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) – C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (CscService) – C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (mi-raysat_3dsmax2010_64) – C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe ()
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (clr_optimization_v4.0.30319_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe (Symantec Corporation)
SRV - (MemeoBackgroundService) – C:\Program Files (x86)\WD\WD Anywhere Backup\MemeoBackgroundService.exe (Memeo)
SRV - (Nero BackItUp Scheduler 4.0) – C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)

========== Driver Services (SafeList) ==========

DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (Lbd) – C:\Windows\SysNative\drivers\Lbd.sys (Lavasoft AB)
DRV:64bit: - (CXSONORA64) – C:\Windows\SysNative\drivers\VMTVE88x64.sys (Compro Technology., Inc.)
DRV:64bit: - (SYMTDIv) – C:\Windows\SysNative\drivers\NISx64\1108000.005\symtdiv.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1108000.005\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1108000.005\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1108000.005\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\NISx64\1108000.005\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (ccHP) – C:\Windows\SysNative\drivers\NISx64\1108000.005\cchpx64.sys (Symantec Corporation)
DRV:64bit: - (AnyDVD) – C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1108000.005\symds64.sys (Symantec Corporation)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (yukonw7) – C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (ElbyCDIO) – C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vmbus) – C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (storflt) – C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) – C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (s3cap) – C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) – C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (CSC) – C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Lycosa) – C:\Windows\SysNative\drivers\Lycosa.sys (Razer USA Ltd.)
DRV:64bit: - (VaneFltr) – C:\Windows\SysNative\drivers\Lachesis.sys (Razer (Asia-Pacific) Pte Ltd)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20101009.002\EX64.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20101009.002\ENG64.SYS (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\IPSDefs\20101008.002\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\BASHDefs\20101001.001\BHDrvx64.sys (Symantec Corporation)
DRV - (Lavasoft Kernexplorer) – C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys ()
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (AnyDVD) – C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) – C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl (CyberLink Corp.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gametrailers.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ninemsn.com.au/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 90 97 F4 1C 18 C4 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\IPSFFPlgn\ [2010/05/27 01:41:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\coFFPlgn\ [2010/03/15 20:11:06 | 000,000,000 | —D | M]

O1 HOSTS File: ([2009/06/11 08:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ATICustomerCare] c:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [StartCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WD Anywhere Backup] C:\Program Files (x86)\WD\WD Anywhere Backup\MemeoLauncher2.exe (Memeo Inc.)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()
O4 - HKCU..\Run: [Steam] c:\program files (x86)\steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} http://192.168.1.100/EDVR.CAB (DVR4204 Client Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/10/11 00:58:48 | 000,576,512 | —- | C] (OldTimer Tools) – C:\Users\Brent\Desktop\OTL.exe
[2010/10/09 23:55:26 | 000,069,152 | —- | C] (Lavasoft AB) – C:\Windows\SysNative\drivers\Lbd.sys
[2010/10/09 23:53:49 | 000,000,000 | —D | C] – C:\Users\Brent\AppData\Local\Sunbelt Software
[2010/10/09 23:53:18 | 000,000,000 | -H-D | C] – C:\ProgramData\{ECC164E0-3133-4C70-A831-F08DB2940F70}
[2010/10/09 23:53:15 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2010/10/09 23:53:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lavasoft
[2010/10/09 23:51:40 | 133,582,520 | —- | C] (Lavasoft ) – C:\Users\Brent\Desktop\Ad-AwareInstall.exe
[2010/10/08 22:32:14 | 000,000,000 | —D | C] – C:\Users\Brent\AppData\Local\TechSmith
[2010/10/08 20:38:41 | 000,000,000 | —D | C] – C:\Users\Brent\Documents\Camtasia Studio
[2010/10/08 20:38:25 | 000,000,000 | —D | C] – C:\Windows\SysWow64\QuickTime
[2010/10/08 20:38:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\TechSmith Shared
[2010/10/08 20:38:16 | 000,000,000 | —D | C] – C:\ProgramData\TechSmith
[2010/10/08 20:38:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\TechSmith
[2010/10/04 14:51:55 | 000,000,000 | —D | C] – C:\Users\Brent\Documents\Amnesia
[2010/09/30 02:02:08 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\ks.sys
[2010/09/30 00:27:40 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Monolith Productions
[2010/09/30 00:27:34 | 000,000,000 | —D | C] – C:\Users\Public\Documents\TimeGate Studios
[2010/09/27 21:19:12 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2010/09/27 21:17:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ATI Technologies
[2010/09/27 21:17:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\ATI Technologies
[2010/09/27 21:17:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\ATI
[2010/09/27 18:55:45 | 015,830,016 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysWow64\atioglxx.dll
[2010/09/27 18:55:45 | 003,914,240 | —- | C] (ATI Technologies Inc. ) – C:\Windows\SysWow64\atidxx32.dll
[2010/09/27 18:55:45 | 000,116,240 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysNative\drivers\AtihdW76.sys
[2010/09/27 18:55:45 | 000,030,208 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiuxpag.dll
[2010/09/27 18:55:42 | 004,032,512 | —- | C] (ATI Technologies Inc. ) – C:\Windows\SysWow64\atiumdag.dll
[2010/09/27 18:55:40 | 000,028,160 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiu9pag.dll
[2010/09/27 18:55:39 | 000,052,736 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atimpc32.dll
[2010/09/27 18:55:39 | 000,052,736 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\amdpcom32.dll
[2010/09/27 18:55:38 | 000,037,376 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiu9p64.dll
[2010/09/27 18:55:37 | 000,241,664 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysWow64\atiadlxy.dll
[2010/09/27 18:55:36 | 000,059,392 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysNative\atiedu64.dll
[2010/09/27 18:55:36 | 000,044,544 | —- | C] (Advanced Micro Devices Inc.) – C:\Windows\SysNative\aticalcl64.dll
[2010/09/27 18:55:34 | 000,279,040 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\drivers\atikmpag.sys
[2010/09/27 18:55:34 | 000,053,248 | —- | C] (ATI Technologies Inc.) – C:\Windows\SysNative\drivers\ati2erec.dll
[2010/09/27 18:55:26 | 000,356,352 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysWow64\atipdlxx.dll
[2010/09/27 18:55:24 | 000,120,320 | —- | C] (AMD) – C:\Windows\SysNative\atitmm64.dll
[2010/09/27 18:55:19 | 000,450,560 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\ATIDEMGX.dll
[2010/09/27 18:55:18 | 000,039,424 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiuxp64.dll
[2010/09/27 18:55:16 | 000,019,968 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atigktxx.dll
[2010/09/27 18:55:16 | 000,012,288 | —- | C] (AMD) – C:\Windows\SysNative\atimuixx.dll
[2010/09/27 18:55:15 | 020,736,000 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\atio6axx.dll
[2010/09/27 18:55:14 | 000,043,520 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysWow64\ati2edxx.dll
[2010/09/27 18:55:13 | 000,012,800 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiglpxx.dll
[2010/09/27 18:55:13 | 000,012,800 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiglpxx.dll
[2010/09/27 18:55:12 | 000,421,376 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysNative\atipdl64.dll
[2010/09/27 18:55:11 | 000,057,344 | —- | C] (AMD) – C:\Windows\SysNative\coinst.dll
[2010/09/27 18:55:10 | 000,051,200 | —- | C] (Advanced Micro Devices Inc.) – C:\Windows\SysNative\aticalrt64.dll
[2010/09/27 18:55:09 | 000,528,384 | —- | C] (ATI Technologies Inc. ) – C:\Windows\SysWow64\aticfx32.dll
[2010/09/27 18:55:07 | 000,143,360 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\atiapfxx.exe
[2010/09/27 18:55:06 | 000,278,528 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysWow64\Oemdspif.dll
[2010/09/27 18:55:05 | 000,462,336 | —- | C] (AMD) – C:\Windows\SysNative\atieclxx.exe
[2010/09/27 18:55:04 | 007,767,040 | —- | C] (ATI Technologies Inc.) – C:\Windows\SysNative\drivers\atikmdag.sys
[2010/09/27 18:55:02 | 003,392,000 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiumdva.dll
[2010/09/27 18:55:00 | 000,014,848 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atig6pxx.dll
[2010/09/27 18:54:59 | 000,053,760 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atimpc64.dll
[2010/09/27 18:54:59 | 000,053,760 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\amdpcom64.dll
[2010/09/27 18:54:58 | 004,375,552 | —- | C] (Advanced Micro Devices Inc.) – C:\Windows\SysWow64\aticaldd.dll
[2010/09/27 18:54:58 | 000,046,080 | —- | C] (Advanced Micro Devices Inc.) – C:\Windows\SysWow64\aticalrt.dll
[2010/09/27 18:54:57 | 005,425,664 | —- | C] (Advanced Micro Devices Inc.) – C:\Windows\SysNative\aticaldd64.dll
[2010/09/27 18:54:57 | 000,616,960 | —- | C] (ATI Technologies Inc. ) – C:\Windows\SysNative\aticfx64.dll
[2010/09/27 18:54:57 | 000,338,432 | —- | C] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\atiadlxx.dll
[2010/09/27 18:54:55 | 000,203,264 | —- | C] (AMD) – C:\Windows\SysNative\atiesrxx.exe
[2010/09/27 18:54:55 | 000,044,032 | —- | C] (Advanced Micro Devices Inc.) – C:\Windows\SysWow64\aticalcl.dll
[2010/09/27 18:54:55 | 000,021,504 | —- | C] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atig6txx.dll
[2010/09/27 16:02:50 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/09/27 16:02:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2010/09/27 16:02:50 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/27 16:01:48 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/09/27 16:01:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2010/09/20 22:11:19 | 000,000,000 | —D | C] – C:\ProgramData\WebClient2
[2010/09/20 15:57:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/09/16 01:48:06 | 002,441,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iertutil.dll
[2010/09/15 13:08:41 | 000,527,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_7.dll
[2010/09/15 13:08:41 | 000,518,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_7.dll
[2010/09/15 13:08:41 | 000,239,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_7.dll
[2010/09/15 13:08:41 | 000,176,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_7.dll
[2010/09/15 13:08:41 | 000,077,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_5.dll
[2010/09/15 13:08:41 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_5.dll
[2010/09/15 13:08:40 | 002,526,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_43.dll
[2010/09/15 13:08:40 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_43.dll
[2010/09/15 13:08:40 | 001,907,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dcsx_43.dll
[2010/09/15 13:08:40 | 001,868,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dcsx_43.dll
[2010/09/15 13:08:40 | 000,511,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_43.dll
[2010/09/15 13:08:40 | 000,470,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_43.dll
[2010/09/15 13:08:40 | 000,276,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx11_43.dll
[2010/09/15 13:08:40 | 000,248,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx11_43.dll
[2010/09/15 13:08:39 | 002,401,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_43.dll
[2010/09/15 13:08:39 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_43.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/11 01:08:57 | 003,932,160 | -HS- | M] () – C:\Users\Brent\NTUSER.DAT
[2010/10/11 01:07:34 | 001,164,728 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1108000.005\Cat.DB
[2010/10/11 00:58:52 | 000,576,512 | —- | M] (OldTimer Tools) – C:\Users\Brent\Desktop\OTL.exe
[2010/10/10 19:57:47 | 000,000,125 | -HS- | M] () – C:\ProgramData\.zreglib
[2010/10/10 18:06:39 | 000,739,790 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/10/10 18:06:39 | 000,636,792 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/10/10 18:06:39 | 000,114,234 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/10/10 18:03:57 | 464,332,808 | —- | M] () – C:\Users\Brent\Desktop\Untitled3.zip
[2010/10/10 18:02:15 | 000,005,120 | —- | M] () – C:\Users\Brent\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/10 17:15:42 | 000,000,004 | -H– | M] () – C:\aaw7boot.cmd
[2010/10/10 00:04:30 | 000,014,864 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/10 00:04:30 | 000,014,864 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/09 23:57:17 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/10/09 23:57:13 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/09 23:56:49 | 536,170,495 | -HS- | M] () – C:\hiberfil.sys
[2010/10/09 23:55:30 | 001,558,299 | -H– | M] () – C:\Users\Brent\AppData\Local\IconCache.db
[2010/10/09 23:53:17 | 000,001,179 | —- | M] () – C:\Users\Brent\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/10/09 23:51:40 | 133,582,520 | —- | M] (Lavasoft ) – C:\Users\Brent\Desktop\Ad-AwareInstall.exe
[2010/10/09 22:12:19 | 422,081,800 | —- | M] () – C:\Users\Brent\Desktop\Untitled2.zip
[2010/10/08 23:19:43 | 000,007,653 | —- | M] () – C:\Users\Brent\AppData\Local\Resmon.ResmonCfg
[2010/09/27 18:55:52 | 015,830,016 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysWow64\atioglxx.dll
[2010/09/27 18:55:48 | 004,032,512 | —- | M] (ATI Technologies Inc. ) – C:\Windows\SysWow64\atiumdag.dll
[2010/09/27 18:55:47 | 003,914,240 | —- | M] (ATI Technologies Inc. ) – C:\Windows\SysWow64\atidxx32.dll
[2010/09/27 18:55:45 | 020,736,000 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\atio6axx.dll
[2010/09/27 18:55:45 | 000,116,240 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysNative\drivers\AtihdW76.sys
[2010/09/27 18:55:45 | 000,030,208 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiuxpag.dll
[2010/09/27 18:55:43 | 000,583,888 | —- | M] () – C:\Windows\SysNative\atiumd6a.cap
[2010/09/27 18:55:41 | 000,052,736 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atimpc32.dll
[2010/09/27 18:55:41 | 000,052,736 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\amdpcom32.dll
[2010/09/27 18:55:41 | 000,028,160 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiu9pag.dll
[2010/09/27 18:55:39 | 000,241,664 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysWow64\atiadlxy.dll
[2010/09/27 18:55:38 | 000,037,376 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiu9p64.dll
[2010/09/27 18:55:37 | 003,147,264 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiumd6a.dll
[2010/09/27 18:55:37 | 000,059,392 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysNative\atiedu64.dll
[2010/09/27 18:55:37 | 000,044,544 | —- | M] (Advanced Micro Devices Inc.) – C:\Windows\SysNative\aticalcl64.dll
[2010/09/27 18:55:36 | 000,021,866 | —- | M] () – C:\Windows\atiogl.xml
[2010/09/27 18:55:35 | 000,279,040 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\drivers\atikmpag.sys
[2010/09/27 18:55:35 | 000,053,248 | —- | M] (ATI Technologies Inc.) – C:\Windows\SysNative\drivers\ati2erec.dll
[2010/09/27 18:55:31 | 000,076,216 | —- | M] () – C:\Windows\SysNative\atiapfxx.blb
[2010/09/27 18:55:28 | 000,583,888 | —- | M] () – C:\Windows\SysWow64\atiumdva.cap
[2010/09/27 18:55:28 | 000,356,352 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysWow64\atipdlxx.dll
[2010/09/27 18:55:26 | 000,120,320 | —- | M] (AMD) – C:\Windows\SysNative\atitmm64.dll
[2010/09/27 18:55:21 | 000,450,560 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\ATIDEMGX.dll
[2010/09/27 18:55:19 | 000,039,424 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiuxp64.dll
[2010/09/27 18:55:18 | 000,019,968 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atigktxx.dll
[2010/09/27 18:55:17 | 000,012,288 | —- | M] (AMD) – C:\Windows\SysNative\atimuixx.dll
[2010/09/27 18:55:15 | 000,043,520 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysWow64\ati2edxx.dll
[2010/09/27 18:55:13 | 000,219,348 | —- | M] () – C:\Windows\SysNative\atiicdxx.dat
[2010/09/27 18:55:13 | 000,012,800 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiglpxx.dll
[2010/09/27 18:55:13 | 000,012,800 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atiglpxx.dll
[2010/09/27 18:55:12 | 004,602,880 | —- | M] (ATI Technologies Inc. ) – C:\Windows\SysNative\atidxx64.dll
[2010/09/27 18:55:12 | 000,421,376 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysNative\atipdl64.dll
[2010/09/27 18:55:12 | 000,057,344 | —- | M] (AMD) – C:\Windows\SysNative\coinst.dll
[2010/09/27 18:55:11 | 000,528,384 | —- | M] (ATI Technologies Inc. ) – C:\Windows\SysWow64\aticfx32.dll
[2010/09/27 18:55:11 | 000,051,200 | —- | M] (Advanced Micro Devices Inc.) – C:\Windows\SysNative\aticalrt64.dll
[2010/09/27 18:55:10 | 007,767,040 | —- | M] (ATI Technologies Inc.) – C:\Windows\SysNative\drivers\atikmdag.sys
[2010/09/27 18:55:09 | 005,425,664 | —- | M] (Advanced Micro Devices Inc.) – C:\Windows\SysNative\aticaldd64.dll
[2010/09/27 18:55:08 | 000,278,528 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysWow64\Oemdspif.dll
[2010/09/27 18:55:08 | 000,143,360 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\atiapfxx.exe
[2010/09/27 18:55:07 | 000,002,857 | —- | M] () – C:\Windows\SysWow64\atipblag.dat
[2010/09/27 18:55:07 | 000,002,857 | —- | M] () – C:\Windows\SysNative\atipblag.dat
[2010/09/27 18:55:06 | 000,462,336 | —- | M] (AMD) – C:\Windows\SysNative\atieclxx.exe
[2010/09/27 18:55:05 | 003,392,000 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysWow64\atiumdva.dll
[2010/09/27 18:55:03 | 005,202,944 | —- | M] (ATI Technologies Inc. ) – C:\Windows\SysNative\atiumd64.dll
[2010/09/27 18:55:01 | 000,014,848 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atig6pxx.dll
[2010/09/27 18:55:00 | 004,375,552 | —- | M] (Advanced Micro Devices Inc.) – C:\Windows\SysWow64\aticaldd.dll
[2010/09/27 18:54:59 | 000,616,960 | —- | M] (ATI Technologies Inc. ) – C:\Windows\SysNative\aticfx64.dll
[2010/09/27 18:54:59 | 000,053,760 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atimpc64.dll
[2010/09/27 18:54:59 | 000,053,760 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\amdpcom64.dll
[2010/09/27 18:54:58 | 000,046,080 | —- | M] (Advanced Micro Devices Inc.) – C:\Windows\SysWow64\aticalrt.dll
[2010/09/27 18:54:57 | 000,338,432 | —- | M] (Advanced Micro Devices, Inc.) – C:\Windows\SysNative\atiadlxx.dll
[2010/09/27 18:54:55 | 000,203,264 | —- | M] (AMD) – C:\Windows\SysNative\atiesrxx.exe
[2010/09/27 18:54:55 | 000,044,032 | —- | M] (Advanced Micro Devices Inc.) – C:\Windows\SysWow64\aticalcl.dll
[2010/09/27 18:54:55 | 000,021,504 | —- | M] (Advanced Micro Devices, Inc. ) – C:\Windows\SysNative\atig6txx.dll
[2010/09/21 08:52:57 | 000,000,172 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1108000.005\isolate.ini
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/10 18:03:09 | 464,332,808 | —- | C] () – C:\Users\Brent\Desktop\Untitled3.zip
[2010/10/10 02:33:04 | 000,015,880 | —- | C] () – C:\Windows\SysNative\lsdelete.exe
[2010/10/10 02:33:04 | 000,000,004 | -H– | C] () – C:\aaw7boot.cmd
[2010/10/09 23:53:17 | 000,001,179 | —- | C] () – C:\Users\Brent\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/10/09 22:11:30 | 422,081,800 | —- | C] () – C:\Users\Brent\Desktop\Untitled2.zip
[2010/10/08 20:43:46 | 000,005,120 | —- | C] () – C:\Users\Brent\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/27 18:55:42 | 000,583,888 | —- | C] () – C:\Windows\SysNative\atiumd6a.cap
[2010/09/27 18:55:35 | 000,021,866 | —- | C] () – C:\Windows\atiogl.xml
[2010/09/27 18:55:28 | 000,076,216 | —- | C] () – C:\Windows\SysNative\atiapfxx.blb
[2010/09/27 18:55:26 | 000,583,888 | —- | C] () – C:\Windows\SysWow64\atiumdva.cap
[2010/09/27 18:55:13 | 000,219,348 | —- | C] () – C:\Windows\SysNative\atiicdxx.dat
[2010/09/27 18:55:06 | 000,002,857 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2010/09/27 18:55:06 | 000,002,857 | —- | C] () – C:\Windows\SysNative\atipblag.dat
[2010/07/10 01:06:24 | 000,000,161 | —- | C] () – C:\Users\Brent\AppData\Roaming\default.rss
[2010/07/10 01:05:31 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2010/07/05 02:11:13 | 000,000,093 | —- | C] () – C:\Users\Brent\AppData\Local\fusioncache.dat
[2010/07/05 02:09:34 | 000,734,870 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/04/16 22:00:20 | 000,000,125 | -HS- | C] () – C:\ProgramData\.zreglib
[2010/04/02 18:17:34 | 000,179,091 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2010/03/16 16:56:01 | 000,007,653 | —- | C] () – C:\Users\Brent\AppData\Local\Resmon.ResmonCfg
[2010/03/16 16:53:05 | 000,000,296 | —- | C] () – C:\Windows\lgfwup.ini
[2010/03/15 23:24:21 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/07/14 10:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/14 08:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/04/16 22:41:25 | 000,000,000 | —D | M] – C:\Users\Brent\AppData\Roaming\Autodesk
[2010/04/15 11:48:51 | 000,000,000 | —D | M] – C:\Users\Brent\AppData\Roaming\Foxit
[2010/03/15 21:25:37 | 000,000,000 | —D | M] – C:\Users\Brent\AppData\Roaming\WD
[2010/08/08 15:42:33 | 000,032,630 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/10/10 17:15:42 | 000,000,004 | -H– | M] () – C:\aaw7boot.cmd
[2009/07/14 12:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2010/03/16 13:49:18 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/10/09 23:56:49 | 536,170,495 | -HS- | M] () – C:\hiberfil.sys
[2010/10/09 23:57:00 | 2146,549,759 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 16:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 16:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 16:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 16:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 07:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >
[2009/12/03 11:47:08 | 000,225,103 | —- | M] () – C:\Windows\SysWOW64\loginbkg.jpg

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 15:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/15 19:18:33 | 000,000,221 | -HS- | M] () – C:\Users\Brent\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/09 23:51:40 | 133,582,520 | —- | M] (Lavasoft ) – C:\Users\Brent\Desktop\Ad-AwareInstall.exe
[2010/10/11 00:58:52 | 000,576,512 | —- | M] (OldTimer Tools) – C:\Users\Brent\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 48 bytes -> C:\Windows:4CA9DD0DD90CAA1B
< End of report >

————————————————————————————————————————————————————————————

Extras.txt Report

OTL Extras logfile created on: 11/10/2010 1:06:58 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Brent\Desktop
64bit- An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

6.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 68.00% Memory free
12.00 Gb Paging File | 8.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.46 Gb Total Space | 88.72 Gb Free Space | 31.75% Space Free | Partition Type: NTFS
Drive D: | 298.09 Gb Total Space | 297.99 Gb Free Space | 99.97% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 66.56 Gb Free Space | 28.58% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 931.51 Gb Total Space | 696.88 Gb Free Space | 74.81% Space Free | Partition Type: NTFS
Drive I: | 465.76 Gb Total Space | 226.19 Gb Free Space | 48.56% Space Free | Partition Type: NTFS

Computer Name: TUARA
Current User Name: Brent
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{104FB32A-7CE3-4C4B-B2AA-70C613FF9DFA}" = iTunes
"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support
"{3DDACE1F-3B1E-D6AB-CD3D-B6E987511945}" = ATI Catalyst Install Manager
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503640E5-B2ED-3173-D109-D4D03153471A}" = AMD Drag and Drop Transcoding
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A9F1B5F6-0EE6-0409-BADD-F8BD360FACC3}" = Autodesk 3ds Max 2010 64-bit
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B9E591DD-DAAC-0409-B1B8-5667E359170B}" = Autodesk 3ds Max 2010 64-bit Components
"{C7311329-C491-427B-8880-133E84869B3A}" = Vista Shortcut Manager x64
"{D9C50188-12D5-4D3E-8F00-682346C2AA5F}" = Microsoft Xbox 360 Accessories 1.2
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FD53298A-4734-AFCB-B733-4C07776E589E}" = ccc-utility64
"Autodesk FBX Plugin 2009.4 - 3ds Max 2010 64-bit" = Autodesk FBX Plugin 2009.4 - 3ds Max 2010 64-bit
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help
"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool
"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM
"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights
"{179C91E9-D9ED-D5CC-F0D8-9579DBDED8D6}" = CCC Help English
"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart
"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax
"{37B03AA0-B125-4649-900C-F26E1081F163}" = Camtasia Studio 7
"{3D347E6D-5A03-4342-B5BA-6A771885F379}" = Autodesk Backburner 2008.1
"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{54194F60-988C-4D03-B922-C2B00EFDA39A}" = NVIDIA PhysX
"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV
"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap
"{54904d53-8f02-40f6-a272-78e8cf1cc29c}" = Nero 9
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5A62A775-A29A-4CE1-BBC2-4A9CD0B211EF}" = Nero Live Help
"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision
"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help
"{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help
"{5C9BB0B3-E830-4814-BBA4-D93535E1C7B9}" = Nero Live
"{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG ODD Auto Firmware Update
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6530EB5E-F2BE-45D3-906B-E4AFFF2D1588}" = Windows Live Device Manager
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = CyberLink PowerDVD
"{68131B0A-D78D-4aed-B74E-33A6C7324E50}" = WD Anywhere Backup
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C8B53B9-41EE-AD83-007A-55EE64DE6932}" = Catalyst Control Center Graphics Previews Common
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed
"{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express
"{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime
"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center
"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress
"{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool
"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed
"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor
"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help
"{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit
"{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent
"{CF5DE1DD-F7E6-694D-1E82-84C7C9C9ABDB}" = Catalyst Control Center Graphics Previews Vista
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DDA34038-89BD-4804-B0B8-DC48D5DFB463}" = Catalyst Control Center - Branding
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget
"{E551D82D-4D56-4AF7-A2C9-8897D7A0CB00}" = Autodesk 3ds Max 2010 Tutorials Files
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help
"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F71E7762-8A64-AECC-0917-DA51677041CF}" = Catalyst Control Center InstallProxy
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{F9D65BA1-84C5-B4CB-91FE-D68F07ECBA24}" = ccc-core-static
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AnyDVD" = AnyDVD
"CCleaner" = CCleaner
"CloneDVD2" = CloneDVD2
"Foxit Reader" = Foxit Reader
"NIS" = Norton Internet Security
"Office14.SingleImage" = Microsoft Office Professional 2010
"OpenAL" = OpenAL
"PunkBusterSvc" = PunkBuster Services
"RocketDock_is1" = RocketDock 1.3.5
"Steam App 13210" = Unreal Tournament 3: Black Edition
"Steam App 17300" = Crysis
"Steam App 21090" = F.E.A.R.
"Steam App 220" = Half-Life 2
"Steam App 22000" = World of Goo
"Steam App 22600" = Worms Reloaded
"Steam App 380" = Half-Life 2: Episode One
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 43110" = Metro 2033
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 630" = Alien Swarm
"Steam App 8190" = Just Cause 2
"Steam App 8400" = Geometry Wars: Retro Evolved
"Steam App 8980" = Borderlands
"VLC media player" = VLC media player 1.1.0
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/10/2010 6:59:22 PM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero Recode\Recode.exe.Manifest".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.
Component
2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.

Error - 5/10/2010 8:05:42 PM | Computer Name = tuara | Source = Application Hang | ID = 1002
Description = The program steam.exe version 1.0.868.88 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 8bc Start
Time: 01cb64e9ca13c916 Termination Time: 16 Application Path: C:\Program Files (x86)\Steam\steam.exe

Report
Id: 72994fd6-d0dd-11df-aab3-001fc6eb6a1e

Error - 6/10/2010 2:24:16 AM | Computer Name = tuara | Source = Application Hang | ID = 1002
Description = The program hl2.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 620 Start Time:
01cb650aeeaec336 Termination Time: 316 Application Path: c:\program files (x86)\steam\steamapps\agent_xen\half-life
2\hl2.exe Report Id:

Error - 7/10/2010 4:43:31 AM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest".Error in manifest or policy file
"" on line . A component version required by the application conflicts with another
component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.

Error - 7/10/2010 4:43:31 AM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero Recode\Recode.exe.Manifest".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.
Component
2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.

Error - 8/10/2010 11:50:34 PM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest".Error in manifest or policy file
"" on line . A component version required by the application conflicts with another
component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.

Error - 8/10/2010 11:50:34 PM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero Recode\Recode.exe.Manifest".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.
Component
2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.

Error - 9/10/2010 8:53:39 AM | Computer Name = tuara | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9/10/2010 11:56:06 AM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest".Error in manifest or policy file
"" on line . A component version required by the application conflicts with another
component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.

Error - 9/10/2010 11:56:06 AM | Computer Name = tuara | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero
9\Nero Recode\Recode.exe.Manifest".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.
Component
2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.

[ System Events ]
Error - 19/09/2010 12:00:59 PM | Computer Name = tuara | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk3\DR3.

Error - 19/09/2010 6:58:15 PM | Computer Name = tuara | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk3\DR3.

Error - 19/09/2010 6:58:16 PM | Computer Name = tuara | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk3\DR3.

Error - 24/09/2010 1:48:39 PM | Computer Name = tuara | Source = Microsoft-Windows-HAL | ID = 12
Description = The platform firmware has corrupted memory across the previous system
power transition. Please check for updated firmware for your system.

Error - 24/09/2010 7:27:25 PM | Computer Name = tuara | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk3\DR3.

Error - 24/09/2010 7:27:30 PM | Computer Name = tuara | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk3\DR3.

Error - 24/09/2010 7:27:31 PM | Computer Name = tuara | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk3\DR3.

Error - 26/09/2010 2:36:22 AM | Computer Name = tuara | Source = NetBT | ID = 4321
Description = The name "MSHOME :1d" could not be registered on the interface
with IP address 192.168.1.3. The computer with the IP address 192.168.1.6 did not
allow the name to be claimed by this computer.

Error - 26/09/2010 2:36:54 AM | Computer Name = tuara | Source = NetBT | ID = 4321
Description = The name "MSHOME :1d" could not be registered on the interface
with IP address 192.168.1.3. The computer with the IP address 192.168.1.6 did not
allow the name to be claimed by this computer.

Error - 27/09/2010 1:01:51 AM | Computer Name = tuara | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

< End of report >

————————————————————————————————————————————————————————————

Blottedisk

Post #2October 12, 2010, 1:58 PM UTC

Hi o0xen0o,

Welcome to WhattheTech. My name is Blottedisk and I will be helping you with your malware issues. We apologize for the delay in responding to your request for help. Here at WhattheTech we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.
Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice. This may cause a delay in response time, but I will do my best to keep it as short as possible.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.

Please bear with me, I will post back to you shortly with instructions.

Thanks

Blottedisk

Post #3October 13, 2010, 12:23 AM UTC

Hi again,

Please follow these steps in order:

Step 1 | Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
```
:OTL

:Commands
[purity]
[EmptyFlash]
[emptytemp]
```
Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
It will produce a log for you on reboot, please post that log in your next reply.

Step 2 | Click on the following link to visit java website: Java Runtime Environment (JRE) 6

Scroll down to where it says "JDK 6 Update 21 (JDK or JRE)".
Click the "Download" button to the right column (JRE).
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue. The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Then from your desktop double-click on the recently downloaded java installer icon to install the newest version.

Step 3 | Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Step 4 | Please go to Kaspersky website and perform an online antivirus scan. Note: Internet Explorer should be used.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
Click on My Computer under Scan and then put the kettle on!
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place like your Desktop. Change the Files of type to Text file (.txt) before clicking on the Save button.
Copy and paste the report into your next.

[external image: Posted Image]

o0xen0o

Post #4October 13, 2010, 11:19 AM UTC

Hello, Thank-you very much for your aid in this matter, I was beginning to give up hope and formatting my computer was looking like an option

since my last post I have had someone acess my web baised e-mail and send virus filled e-mails to only people on my friends list (including my self) and I have most recently had a blue screen which I have never experianced with this computer before. From what I have see the scans have picked up nothing which worries me: —————————————————————————————————————————————————————————————————————————————————————————— All processes killed ========== OTL ========== ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Brent ->Flash cache emptied: 43101 bytes User: Default User: Default User User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Brent ->Temp folder emptied: 2740229272 bytes ->Temporary Internet Files folder emptied: 1344116558 bytes ->Flash cache emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 155696 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 50454431 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes RecycleBin emptied: 15225160033 bytes Total Files Cleaned = 18,463.00 mb OTL by OldTimer - Version 3.2.14.1 log created on 10132010_112725 Files\Folders moved on Reboot… C:\Users\Brent\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\Brent\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q64GLFZW\o0xen0o[1].png moved successfully. Registry entries deleted on Reboot… —————————————————————————————————————————————————————————————————————————————————————————— Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4806 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 13/10/2010 12:01:29 PM mbam-log-2010-10-13 (12-01-29).txt Scan type: Quick scan Objects scanned: 135494 Time elapsed: 1 minute(s), 59 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) —————————————————————————————————————————————————————————————————————————————————————————— ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, October 13, 2010 Operating system: Microsoft (build 7600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Tuesday, October 12, 2010 21:45:01 Records in database: 4202656 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Objects scanned: 353258 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 06:44:42 No threats found. Scanned area is clean. Selected area has been scanned. —————————————————————————————————————————————————————————————————————————————————————————— I have also noticed these warnings appearing alot lately I don't know if it's related but I thought I should mention it (images attached) 📎unauthorized.jpg 📎unprotected.jpg Thanks again

Blottedisk

Post #5October 14, 2010, 1:36 AM UTC

Hi there,

Well, you don't appear to be infected. That Norton message doesn't mean there's malware in your computer. You probably tried to access an infected website through Internet Explorer, and Norton blocked that attempt. There's nothing to worry about.

Now, please do the following:

Step 1 | Clean up with OTL

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Now, from the desktop, delete any logs that you have left over.

Last Step | Now, in order to avoid future infections, please take time to read the following articles:

Simple and easy ways to keep your computer safe and secure on the Internet
Preventing Malware - Tools and Practices for Safe Computing
So how did I get infected in the first place?
How to prevent malware

Read those articles and your potential for being infected will reduce dramatically.

Do you have any questions?

o0xen0o

Post #6October 14, 2010, 6:19 AM UTC

thats very strange, all the site I acess are site I have for year and never recieved these types of messages from Norton and that high priority warning seemed like it was coming from within my computer from its wording; 📎intrusion.jpg but thank-you for your help I'm now a little wiser from this, thanks again.

Blottedisk

Post #7October 15, 2010, 12:17 AM UTC

Let's try this rootkit scan just in case. Please download Rootkit Unhooker and save it to your Desktop

Right click on RKUnhookerLE and select "Run as administrator" to run it
Click the Report tab, then click Scan
Check Drivers, Stealth and uncheck the rest
Click OK
Wait until it's finished and then go to File > Save Report
Save the report to your Desktop
Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Blottedisk

Post #8October 19, 2010, 5:28 AM UTC

Hi, It's been several days since my last reply. Are you still with us?

CatByte

Post #9October 21, 2010, 9:15 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

HTTP Nukesploit Request

✨ Ask AI

Ask AI