What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Possible Packed.Win32.Krap.ao

26 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
Done as advised. Had a hard time getting ie8 to open the link. It kept hanging up and I had to go into task manager n end all the ie8's running. Been testing it since and it doesn't seem to have fixed the problem. Do you think we should start over and see if there are any new infections etc?
Post #18
Yes,

Please run DDS and GMER,

I'll give you the links and instructions again:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #19
Sorry it took a while. Had internet problems today. The ISP, not me. DDS (Ver_10-11-10.01) - NTFS_AMD64 Run by [removed] at 13:59:43.97 on Mon 11/15/2010 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.6141.4559 [GMT -6:00] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Program Files\Common Files\logishrd\Bluetooth\LBTServ.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Logitech\SetPoint\LBTWiz.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Windows\system32\sppsvc.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Windows Mail\WinMail.exe C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~2\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\Program Files\CheckPoint\ZAForceField\ForceField.exe C:\Windows\SysWOW64\ZoneLabs\vsmon.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Users\steve\Desktop\dds.com C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2070226 uSearch Bar = Preserve BHO: HelperObject Class: {00c6482d-c502-44c8-8409-fce54ad9c208} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItBHO.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: WhiteSmoke Toolbar: {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItIEAddin.dll TB: WhiteSmoke Toolbar: {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe" /automount mRun: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" StartupFolder: C:\Users\steve\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop (1).ini StartupFolder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop (1).ini StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll LSP: C:\Windows\system32\lspC8BB.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" BHO-X64: ZoneAlarm Toolbar Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll BHO-X64: ZoneAlarm Toolbar Registrar - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll TB-X64: ZoneAlarm Toolbar: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun-x64: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent ================= FIREFOX =================== FF - ProfilePath - C:\Users\steve\AppData\Roaming\Mozilla\Firefox\Profiles\6au9l2ft.default\ FF - prefs.js: browser.search.selectedEngine - Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2070226 FF - prefs.js: keyword.URL - hxxp://search.fresh-search.net/?sid=10101069100&s= FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll FF - component: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\components\MozillaDownload.dll FF - component: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\components\MozillaExtensions.dll FF - component: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\components\TrustCheckerMozillaPlugin.dll FF - plugin: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\NOS\bin\np_gp.dll —- FIREFOX POLICIES —- FF - user.js: browser.search.selectedEngine - Search FF - user.js: browser.search.order.1 - Search FF - user.js: keyword.URL - hxxp://search.fresh-search.net/?sid=10101069100&s=C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true); C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true); C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true); C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true); C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified ============= SERVICES / DRIVERS =============== R0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);C:\Windows\System32\drivers\tdrpm258.sys [2010-11-2 1477728] R2 afcdpsrv;Acronis Nonstop Backup service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2010-11-2 2480048] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-8-4 203776] R2 ISWKL;ZoneAlarm ForceField ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2010-6-15 33008] R2 IswSvc;ZoneAlarm ForceField IswSvc;C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe [2010-6-15 823272] R3 afcdp;afcdp;C:\Windows\System32\drivers\afcdp.sys [2010-11-2 252512] R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-10-27 8012288] R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-10-27 287232] R3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2008-8-28 51240] R3 icsak;icsak;C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys [2010-6-15 44784] R3 lvpepf64;Volume Adapter;C:\Windows\System32\drivers\lv302a64.sys [2008-7-26 15768] R3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2008-7-26 790424] R3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\System32\drivers\LVUSBS64.sys [2008-7-26 50072] R3 rt70x64;Linksys Home Wireless-G USB Adaptor Driver;C:\Windows\System32\drivers\netr7064.sys [2010-4-27 388448] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 StarWindServiceAE;StarWind AE Service;C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-5-28 275968] S3 nosGetPlusHelper;getPlus® Helper 3004;C:\Windows\System32\svchost.exe -k nosGetPlusHelper [2009-7-13 27136] S3 SureThing Labelflash service;SureThing Labelflash service;C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [2010-11-3 74392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-11-3 1255736] =============== Created Last 30 ================ 2010-11-14 18:44:14 ——– d—–w- C:\Program Files (x86)\ieSpell 2010-11-14 17:42:40 ——– d—–w- C:\Users\steve\AppData\Roaming\KeePass 2010-11-14 17:34:53 ——– d—–w- C:\Program Files (x86)\KeePass Password Safe 2 2010-11-13 18:48:01 ——– d—–w- C:\Program Files (x86)\ESET 2010-11-13 03:48:30 327680 ——w- C:\Windows\SysWow64\haspms32.dll 2010-11-13 03:48:30 ——– d—–w- C:\Program Files (x86)\Common Files\ALLDATA Shared 2010-11-12 00:57:17 ——– d—–w- C:\Program Files (x86)\Yahoo! 2010-11-11 14:06:00 ——– d—–w- C:\Program Files (x86)\whitesmoketoolbar 2010-11-10 23:09:14 ——– d—–w- C:\Users\steve\AppData\Roaming\GetRightToGo 2010-11-10 22:48:43 47490 —-a-w- C:\Windows\SysWow64\lspC8BB.dll 2010-11-10 21:23:04 ——– d—–w- C:\PROGRA~3\iHoOm02038 2010-11-10 15:40:31 ——– d—–w- C:\PROGRA~3\WSTB 2010-11-10 15:40:16 11264 –sh–w- C:\Users\steve\AppData\Local\cleanmgr.dll 2010-11-09 10:02:51 8006480 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{B79A27DF-BDFC-4AFF-87BA-2F5468920987}\mpengine.dll 2010-11-08 22:42:06 ——– d—–w- C:\Users\steve\AppData\Roaming\Ratbag 2010-11-08 22:22:55 128000 —-a-w- C:\Windows\SysWow64\fmod.dll 2010-11-08 18:36:17 ——– d—–w- C:\Users\steve\AppData\Roaming\MailboxFetch 2010-11-07 17:53:55 ——– d—–w- C:\Program Files\Motorola Inc 2010-11-07 17:53:55 ——– d—–w- C:\Program Files\Common Files\Motorola Shared 2010-11-07 17:53:55 ——– d—–w- C:\Program Files (x86)\Motorola 2010-11-07 17:53:55 ——– d—–w- C:\Program Files (x86)\Common Files\MSSoap 2010-11-07 17:47:06 ——– d—–w- C:\Program Files (x86)\Motorola Phone Tools 2010-11-06 19:16:47 212992 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll 2010-11-06 19:16:12 306688 —-a-w- C:\Windows\IsUninst.exe 2010-11-06 19:14:55 ——– d—–w- C:\Program Files (x86)\GameSpy Arcade 2010-11-06 16:57:26 69715 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll 2010-11-06 16:57:26 32768 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll 2010-11-06 16:57:26 266240 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll 2010-11-06 16:57:26 172032 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll 2010-11-06 16:57:25 733184 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll 2010-11-06 16:57:25 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe 2010-11-06 16:57:25 303236 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll 2010-11-06 16:57:25 180356 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll 2010-11-05 22:58:26 ——– d—–w- C:\Program Files (x86)\uTorrent 2010-11-05 22:38:10 ——– d—–w- C:\Program Files (x86)\QuickPar 2010-11-05 16:32:18 ——– d—–w- C:\Program Files (x86)\VideoLAN 2010-11-04 10:33:35 8006480 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2010-11-04 08:02:41 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2010-11-03 21:02:51 ——– d—–w- C:\Users\steve\AppData\Roaming\Malwarebytes 2010-11-03 21:02:19 38224 —-a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys 2010-11-03 21:02:19 ——– d—–w- C:\PROGRA~3\Malwarebytes 2010-11-03 21:02:18 24664 —-a-w- C:\Windows\System32\drivers\mbam.sys 2010-11-03 21:02:18 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2010-11-03 20:38:50 ——– d—–w- C:\Program Files (x86)\Common Files\Wise Installation Wizard 2010-11-03 19:10:10 ——– d—–w- C:\Program Files (x86)\RapidShareManager 2010-11-03 19:08:59 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2010-11-03 19:06:05 521448 —-a-w- C:\Windows\System32\deployJava1.dll 2010-11-03 17:12:10 ——– d—–w- C:\Program Files (x86)\Microsoft ActiveSync 2010-11-03 17:07:48 ——– d—–w- C:\Windows\SHELLNEW 2010-11-03 17:07:09 ——– d—–w- C:\Windows\PCHEALTH 2010-11-03 16:56:23 487424 —-a-w- C:\Windows\SysWow64\msvcp70.dll 2010-11-03 16:56:23 344064 —-a-w- C:\Windows\SysWow64\msvcr70.dll 2010-11-03 16:56:22 ——– d—–w- C:\Program Files (x86)\Common Files\SureThing Shared 2010-11-03 16:56:14 ——– d—–w- C:\Program Files (x86)\SureThing CD Labeler 5 2010-11-03 16:36:57 ——– d—–w- C:\Program Files (x86)\UltraISO 2010-11-03 16:36:57 ——– d—–w- C:\Program Files (x86)\Common Files\EZB Systems 2010-11-03 16:29:23 871408 —-a-w- C:\Windows\System32\drivers\sptd.sys 2010-11-03 16:15:24 ——– d—–w- C:\Program Files (x86)\guru's Mailbox Fetch 2010-11-03 15:30:37 190992 —-a-w- C:\Windows\System32\BtCoreIf.dll 2010-11-03 15:30:35 96272 —-a-w- C:\Windows\System32\KemXML.dll 2010-11-03 15:30:35 235536 —-a-w- C:\Windows\System32\KemUtil.dll 2010-11-03 15:30:35 235536 —-a-w- C:\Windows\System32\kemutb.dll 2010-11-03 15:30:35 159248 —-a-w- C:\Windows\System32\KemWnd.dll 2010-11-03 15:24:25 ——– d—–w- C:\Program Files (x86)\ESTsoft 2010-11-03 14:55:31 ——– d—–w- C:\Program Files\SonicWallES 2010-11-03 08:00:42 ——– d—–w- C:\Windows\SysWow64\Wat 2010-11-03 08:00:42 ——– d—–w- C:\Windows\System32\Wat 2010-11-03 05:28:59 ——– d—–w- C:\Program Files (x86)\Glary Utilities 2010-11-03 03:44:25 ——– d—–w- C:\PROGRA~3\Kaspersky SDK 2010-11-03 02:35:36 ——– d—–w- C:\PROGRA~3\WEBREG 2010-11-03 02:33:38 249856 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpfpp70w.dll 2010-11-03 02:31:27 ——– d—–w- C:\Windows\SysWow64\spool 2010-11-03 02:29:57 ——– d—–w- C:\Program Files (x86)\Common Files\HP 2010-11-03 02:29:55 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard 2010-11-03 02:29:39 ——– d—–w- C:\Windows\hpoj4500g510a-f 2010-11-03 02:29:22 551424 —-a-w- C:\Windows\System32\hppldcoi.dll 2010-11-03 02:29:20 902656 —-a-w- C:\Windows\System32\hpwwiax7.dll 2010-11-03 02:29:20 503296 —-a-w- C:\Windows\System32\hpwvst01.dll 2010-11-03 02:29:20 1418240 —-a-w- C:\Windows\System32\hpwtiop6.dll 2010-11-03 02:29:14 642360 —-a-w- C:\Windows\System32\hpzids40.dll 2010-11-03 02:29:12 136704 —-a-w- C:\Windows\System32\hpf3l70w.dll 2010-11-03 02:27:26 ——– d—–w- C:\Program Files (x86)\HP 2010-11-03 02:17:32 ——– d—–w- C:\Users\steve\AppData\Roaming\MailFrontier 2010-11-03 02:17:32 ——– d—–w- C:\Users\steve\AppData\Roaming\CheckPoint 2010-11-03 02:11:24 ——– d—–w- C:\Program Files\CheckPoint 2010-11-03 02:11:21 72704 —-a-w- C:\Windows\zllsputility.exe 2010-11-03 02:11:17 157712 —-a-w- C:\Windows\System32\drivers\kl1.sys 2010-11-03 02:09:28 ——– d—–w- C:\PROGRA~3\CheckPoint 2010-11-03 02:09:27 ——– d—–w- C:\Windows\Internet Logs 2010-11-03 01:02:35 50176 —-a-w- C:\Windows\System32\LBTCoIns.DLL 2010-11-03 00:50:57 252512 —-a-w- C:\Windows\System32\drivers\afcdp.sys 2010-11-03 00:50:54 1477728 —-a-w- C:\Windows\System32\drivers\tdrpm258.sys 2010-11-03 00:50:51 943712 —-a-w- C:\Windows\System32\drivers\timntr.sys 2010-11-03 00:50:42 271456 —-a-w- C:\Windows\System32\drivers\snapman.sys 2010-11-02 23:53:20 ——– d—–w- C:\Windows\Panther 2010-11-02 23:53:07 ——– d-sh–w- C:\Boot 2010-11-02 23:52:56 ——– d—–w- C:\Windows\System32\oem 2010-11-02 23:08:46 ——– d—–w- C:\Users\steve\AppData\Local\Frameworkx.com 2010-11-02 23:08:22 ——– d—–w- C:\Program Files\Frameworkx 2010-11-02 23:08:01 ——– d-sh–w- C:\Windows\Installer 2010-11-02 22:55:49 0 —-a-w- C:\Windows\ativpsrm.bin 2010-11-02 22:48:06 311808 —-a-w- C:\Windows\System32\msv1_0.dll 2010-11-02 22:48:06 257024 —-a-w- C:\Windows\SysWow64\msv1_0.dll 2010-11-02 22:44:50 14336 —-a-w- C:\Windows\System32\drivers\sffp_sd.sys 2010-11-02 22:43:50 99176 —-a-w- C:\Windows\SysWow64\PresentationHostProxy.dll 2010-11-02 22:43:50 49472 —-a-w- C:\Windows\SysWow64\netfxperf.dll 2010-11-02 22:43:50 48960 —-a-w- C:\Windows\System32\netfxperf.dll 2010-11-02 22:43:50 444752 —-a-w- C:\Windows\System32\mscoree.dll 2010-11-02 22:43:50 320352 —-a-w- C:\Windows\System32\PresentationHost.exe 2010-11-02 22:43:50 297808 —-a-w- C:\Windows\SysWow64\mscoree.dll 2010-11-02 22:43:50 295264 —-a-w- C:\Windows\SysWow64\PresentationHost.exe 2010-11-02 22:43:50 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2010-11-02 22:43:50 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2010-11-02 22:43:50 109912 —-a-w- C:\Windows\System32\PresentationHostProxy.dll 2010-11-02 22:39:08 243712 —-a-w- C:\Windows\System32\drivers\ks.sys 2010-11-02 22:35:08 1975296 —-a-w- C:\Windows\System32\CertEnroll.dll 2010-11-02 22:35:08 1320960 —-a-w- C:\Windows\SysWow64\CertEnroll.dll 2010-11-02 22:33:48 961024 —-a-w- C:\Windows\System32\CPFilters.dll 2010-11-02 22:33:48 641536 —-a-w- C:\Windows\SysWow64\CPFilters.dll 2010-11-02 22:33:48 552960 —-a-w- C:\Windows\System32\msdri.dll 2010-11-02 22:33:48 288256 —-a-w- C:\Windows\System32\MSNP.ax 2010-11-02 22:33:48 258560 —-a-w- C:\Windows\System32\mpg2splt.ax 2010-11-02 22:33:48 204288 —-a-w- C:\Windows\SysWow64\MSNP.ax 2010-11-02 22:33:47 613888 —-a-w- C:\Windows\System32\psisdecd.dll 2010-11-02 22:33:47 465408 —-a-w- C:\Windows\SysWow64\psisdecd.dll 2010-11-02 22:33:47 199680 —-a-w- C:\Windows\SysWow64\mpg2splt.ax 2010-11-02 22:31:56 976896 —-a-w- C:\Windows\System32\inetcomm.dll 2010-11-02 22:30:10 9728 —-a-w- C:\Windows\SysWow64\sscore.dll 2010-11-02 22:30:10 463360 —-a-w- C:\Windows\System32\drivers\srv.sys 2010-11-02 22:30:10 402944 —-a-w- C:\Windows\System32\drivers\srv2.sys 2010-11-02 22:30:10 236032 —-a-w- C:\Windows\System32\srvsvc.dll 2010-11-02 22:30:10 161792 —-a-w- C:\Windows\System32\drivers\srvnet.sys 2010-11-02 22:30:00 82944 —-a-w- C:\Windows\SysWow64\iccvid.dll 2010-11-02 22:29:59 982600 —-a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2010-11-02 22:29:59 144384 —-a-w- C:\Windows\System32\cdd.dll 2010-11-02 22:29:31 220672 —-a-w- C:\Windows\System32\wintrust.dll 2010-11-02 22:29:31 172032 —-a-w- C:\Windows\SysWow64\wintrust.dll 2010-11-02 22:29:17 139264 —-a-w- C:\Windows\System32\cabview.dll 2010-11-02 22:29:17 132608 —-a-w- C:\Windows\SysWow64\cabview.dll 2010-11-02 22:29:09 3123712 —-a-w- C:\Windows\System32\win32k.sys 2010-11-02 22:28:03 270720 ——w- C:\Windows\System32\MpSigStub.exe 2010-11-02 22:07:28 77824 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll 2010-11-02 22:07:28 32768 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll 2010-11-02 22:07:28 225280 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll 2010-11-02 22:07:28 176128 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll 2010-11-02 22:07:28 ——– d—–w- C:\Program Files (x86)\Linksys Wireless-G USB Wireless Network Monitor 2010-11-02 22:07:27 614532 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe 2010-11-02 21:54:14 ——– d—–w- C:\Users\steve\AppData\Local\ElevatedDiagnostics 2010-11-02 21:34:09 ——– d—–w- C:\Users\steve\AppData\Local\Mozilla 2010-11-02 21:34:09 ——– d—–w- C:\Users\steve\AppData\Local\Apple Computer 2010-11-02 21:33:10 ——– dc—-w- C:\Users\steve\AppData\Local\MigWiz 2010-10-27 10:00:16 8012288 —-a-w- C:\Windows\System32\drivers\atikmdag.sys 2010-10-27 09:25:38 21422592 —-a-w- C:\Windows\System32\atio6axx.dll 2010-10-27 09:08:18 16281600 —-a-w- C:\Windows\SysWow64\atioglxx.dll 2010-10-27 08:55:32 143360 —-a-w- C:\Windows\System32\atiapfxx.exe 2010-10-27 08:55:24 547328 —-a-w- C:\Windows\SysWow64\aticfx32.dll 2010-10-27 08:52:18 450560 —-a-w- C:\Windows\System32\ATIDEMGX.dll 2010-10-27 08:50:30 120320 —-a-w- C:\Windows\System32\atitmm64.dll 2010-10-27 08:50:16 423424 —-a-w- C:\Windows\System32\atipdl64.dll 2010-10-27 08:50:10 356352 —-a-w- C:\Windows\SysWow64\atipdlxx.dll 2010-10-27 08:49:58 278528 —-a-w- C:\Windows\SysWow64\Oemdspif.dll 2010-10-27 08:49:54 16384 —-a-w- C:\Windows\System32\atimuixx.dll 2010-10-27 08:49:50 59392 —-a-w- C:\Windows\System32\atiedu64.dll 2010-10-27 08:49:46 43520 —-a-w- C:\Windows\SysWow64\ati2edxx.dll 2010-10-27 08:46:58 4020736 —-a-w- C:\Windows\SysWow64\atidxx32.dll 2010-10-27 08:35:30 51200 —-a-w- C:\Windows\System32\aticalrt64.dll 2010-10-27 08:35:28 46080 —-a-w- C:\Windows\SysWow64\aticalrt.dll 2010-10-27 08:35:20 44544 —-a-w- C:\Windows\System32\aticalcl64.dll 2010-10-27 08:35:18 44032 —-a-w- C:\Windows\SysWow64\aticalcl.dll 2010-10-27 08:35:08 6815744 —-a-w- C:\Windows\System32\aticaldd64.dll 2010-10-27 08:33:52 5441536 —-a-w- C:\Windows\SysWow64\aticaldd.dll 2010-10-27 08:28:22 4094464 —-a-w- C:\Windows\SysWow64\atiumdag.dll 2010-10-27 08:14:52 249856 —-a-w- C:\Windows\SysWow64\atiadlxy.dll 2010-10-27 08:14:44 14848 —-a-w- C:\Windows\System32\atig6pxx.dll 2010-10-27 08:14:42 12800 —-a-w- C:\Windows\SysWow64\atiglpxx.dll 2010-10-27 08:14:42 12800 —-a-w- C:\Windows\System32\atiglpxx.dll 2010-10-27 08:14:38 31744 —-a-w- C:\Windows\System32\atig6txx.dll 2010-10-27 08:14:32 27136 —-a-w- C:\Windows\SysWow64\atigktxx.dll 2010-10-27 08:14:24 287232 —-a-w- C:\Windows\System32\drivers\atikmpag.sys 2010-10-27 08:13:36 30720 —-a-w- C:\Windows\SysWow64\atiuxpag.dll 2010-10-27 08:13:24 28672 —-a-w- C:\Windows\SysWow64\atiu9pag.dll 2010-10-27 08:12:56 53248 —-a-w- C:\Windows\System32\drivers\ati2erec.dll 2010-10-27 07:50:10 3460096 —-a-w- C:\Windows\SysWow64\atiumdva.dll 2010-10-27 07:37:18 53760 —-a-w- C:\Windows\System32\atimpc64.dll 2010-10-27 07:37:18 53760 —-a-w- C:\Windows\System32\amdpcom64.dll 2010-10-27 07:37:14 52736 —-a-w- C:\Windows\SysWow64\atimpc32.dll 2010-10-27 07:37:14 52736 —-a-w- C:\Windows\SysWow64\amdpcom32.dll ==================== Find3M ==================== 2010-10-27 08:54:24 645120 —-a-w- C:\Windows\System32\aticfx64.dll 2010-10-27 08:52:14 478208 —-a-w- C:\Windows\System32\atieclxx.exe 2010-10-27 08:51:38 203776 —-a-w- C:\Windows\System32\atiesrxx.exe 2010-10-27 08:38:04 4744704 —-a-w- C:\Windows\System32\atidxx64.dll 2010-10-27 08:22:04 5218304 —-a-w- C:\Windows\System32\atiumd64.dll 2010-10-27 08:15:00 58880 —-a-w- C:\Windows\System32\coinst.dll 2010-10-27 08:14:58 349184 —-a-w- C:\Windows\System32\atiadlxx.dll 2010-10-27 08:13:44 39936 —-a-w- C:\Windows\System32\atiuxp64.dll 2010-10-27 08:13:30 37888 —-a-w- C:\Windows\System32\atiu9p64.dll 2010-10-27 07:57:04 3221504 —-a-w- C:\Windows\System32\atiumd6a.dll 2010-09-10 05:35:44 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2010-09-10 05:35:43 347648 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2010-09-08 05:36:17 1192960 —-a-w- C:\Windows\System32\wininet.dll 2010-09-08 05:34:34 57856 —-a-w- C:\Windows\System32\licmgr10.dll 2010-09-08 04:30:04 978432 —-a-w- C:\Windows\SysWow64\wininet.dll 2010-09-08 04:28:15 44544 —-a-w- C:\Windows\SysWow64\licmgr10.dll 2010-09-08 04:16:38 482816 —-a-w- C:\Windows\System32\html.iec 2010-09-08 03:35:30 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2010-09-08 03:22:31 386048 —-a-w- C:\Windows\SysWow64\html.iec 2010-09-08 02:48:16 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2010-09-01 05:12:09 12625920 —-a-w- C:\Windows\System32\wmploc.DLL 2010-09-01 04:23:49 12625408 —-a-w- C:\Windows\SysWow64\wmploc.DLL 2010-08-31 04:32:30 954752 —-a-w- C:\Windows\SysWow64\mfc40.dll 2010-08-31 04:32:30 954288 —-a-w- C:\Windows\SysWow64\mfc40u.dll 2010-08-28 00:33:08 332800 —-a-w- C:\Windows\System32\ATIODE.exe 2010-08-26 05:27:28 148992 —-a-w- C:\Windows\System32\t2embed.dll 2010-08-26 04:39:58 109056 —-a-w- C:\Windows\SysWow64\t2embed.dll 2010-08-21 06:38:47 1024512 —-a-w- C:\Windows\System32\wmpmde.dll 2010-08-21 06:36:49 340992 —-a-w- C:\Windows\System32\schannel.dll 2010-08-21 06:31:06 633856 —-a-w- C:\Windows\System32\comctl32.dll 2010-08-21 06:29:47 558592 —-a-w- C:\Windows\System32\spoolsv.exe 2010-08-21 05:36:33 738816 —-a-w- C:\Windows\SysWow64\wmpmde.dll 2010-08-21 05:36:24 224256 —-a-w- C:\Windows\SysWow64\schannel.dll 2010-08-21 05:33:24 530432 —-a-w- C:\Windows\SysWow64\comctl32.dll ============= FINISH: 14:00:57.27 ===============

Attachments:

Post #20
Hi

There doesn't appear to be any malware in those logs:

Lets run a different scanner to have another look


Download OTS to your Desktop

  • Close ALL OTHER PROGRAMS.
  • Double-click on OTS.exe to start the program.
  • Check the box that says Scan All Users
  • Under Additional Scans check the following:
    • File - Lop Check
    • File - Purity Scan
    • Evnt - EventViewer Errors/Warnings (last 10 Errors)
    • Reg - File Associations
    • Reg - NetSvcs
    • Reg - Shell Spawning
    • Under custom scans copy and paste the following:
      netsvcs
      %SYSTEMDRIVE%\*.exe
      %SYSTEMDRIVE%\eventlog.dll /s /md5
      %SYSTEMDRIVE%\scecli.dll /s /md5
      %SYSTEMDRIVE%\netlogon.dll /s /md5
      %SYSTEMDRIVE%\cngaudit.dll /s /md5
      %SYSTEMDRIVE%\sceclt.dll /s /md5
      %SYSTEMDRIVE%\ntelogon.dll /s /md5
      %SYSTEMDRIVE%\logevent.dll /s /md5
      %SYSTEMDRIVE%\iaStor.sys /s /md5
      %SYSTEMDRIVE%\nvstor.sys /s /md5
      %SYSTEMDRIVE%\atapi.sys /s /md5
      %SYSTEMDRIVE%\IdeChnDr.sys /s /md5
      %SYSTEMDRIVE%\viasraid.sys /s /md5
      %SYSTEMDRIVE%\AGP440.sys /s /md5
      %SYSTEMDRIVE%\vaxscsi.sys /s /md5
    • Now click the Run Scan button on the toolbar.
    • Let it run unhindered until it finishes.
    • When the scan is complete Notepad will open with the report file loaded in it.
    • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
    Please attach the log in your next post.
Post #24
Please do the following:


Start OTS
Copy/Paste the information inside the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.


[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< FireFox Settings [Prefs.js] > -> C:\Users\steve\AppData\Roaming\Mozilla\FireFox\Profiles\6au9l2ft.default\prefs.js
YN -> keyword.URL -> "http://search.fresh-search.net/?sid=10101069100&s="
< FireFox Settings [User.js] > -> C:\Users\steve\AppData\Roaming\Mozilla\FireFox\Profiles\6au9l2ft.default\user.js
YN -> keyword.URL -> "http://search.fresh-search.net/?sid=10101069100&s="
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
YN -> HKLM\software\mozilla\Firefox\Extensions\\{ACFEF96A-35C6-4F40-B3A1-AEA95172DB2C} -> C:\USERS\STEVE\APPDATA\LOCAL\{ACFEF96A-35C6-4F40-B3A1-AEA95172DB2C}\
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {52794457-af6c-4c50-9def-f2e24f4c8889} [HKLM] -> C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll [WhiteSmoke Toolbar]
< 64bit-Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YY -> "{52794457-af6c-4c50-9def-f2e24f4c8889}" [HKLM] -> C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll [WhiteSmoke Toolbar]
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Winlogon settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*Shell* -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
YY -> C:\Windows\System32\config\systemprofile\AppData\Roaming\hotfix.exe -> C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\hotfix.exe
< Winlogon settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*Shell* -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
YY -> C:\Windows\System32\config\systemprofile\AppData\Roaming\hotfix.exe -> C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\hotfix.exe
< Winlogon settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< 64bit-SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck]
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck]
[Files/Folders - Created Within 30 Days]
NY -> whitesmoketoolbar -> C:\Program Files (x86)\whitesmoketoolbar
NY -> iHoOm02038 -> C:\ProgramData\iHoOm02038
NY -> WSTB -> C:\ProgramData\WSTB
[Files/Folders - Modified Within 30 Days]
NY -> Windows -> C:\Windows
NY -> iexplore.sy_ -> C:\Windows\SysWow64\iexplore.sy_
NY -> lspC8BB.dll -> C:\Windows\SysWow64\lspC8BB.dll
NY -> lkfl.dat -> C:\Windows\SysWow64\lkfl.dat
NY -> ibfl.dat -> C:\Windows\SysWow64\ibfl.dat
[Files - No Company Name]
NY -> iexplore.sy_ -> C:\Windows\SysWow64\iexplore.sy_
NY -> lspC8BB.dll -> C:\Windows\SysWow64\lspC8BB.dll
[Purity]
[Empty Temp Folders]
[Start Explorer]
[Reboot]


The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.



NEXT

Do you know what these folders are?

C:\Users\steve\AppData\Roaming\Ukinu
C:\Users\steve\AppData\Roaming\Ohlau

browse to them, open and let me know what they contain.
Post #25 last edited
C:\Users\steve\AppData\Roaming\Ukinu has two files in an unknown extension. I've zipped it and attached it in case u wanted to look at it. C:\Users\steve\AppData\Roaming\Ohlau is empty so I deleted it. All Processes Killed [Registry - Safe List] Prefs.js: "http://search.fresh-search.net/?sid=10101069100&s=" removed from keyword.URL User.js: "http://search.fresh-search.net/?sid=10101069100&s=" removed from keyword.URL Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACFEF96A-35C6-4F40-B3A1-AEA95172DB2C} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ACFEF96A-35C6-4F40-B3A1-AEA95172DB2C}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52794457-af6c-4c50-9def-f2e24f4c8889}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52794457-af6c-4c50-9def-f2e24f4c8889}\ deleted successfully. LoadLibrary failed for C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll moved successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{52794457-af6c-4c50-9def-f2e24f4c8889} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52794457-af6c-4c50-9def-f2e24f4c8889}\ not found. File C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\Locked deleted successfully. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3}\ not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3}\ not found. Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Windows\System32\config\systemprofile\AppData\Roaming\hotfix.exe deleted successfully. File C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\hotfix.exe not found. Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Windows\System32\config\systemprofile\AppData\Roaming\hotfix.exe deleted successfully. File C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\hotfix.exe not found. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. [Files/Folders - Created Within 30 Days] C:\Program Files (x86)\whitesmoketoolbar\components folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\searchbar folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\options folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\weatherbutton folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\uwa folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\radio\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\radio\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\radio folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels\default\scripts folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels\default\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels\default\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels\default folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib\panels folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\lib folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\DTXWizard\skin\icon_library\Basics folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\DTXWizard\skin\icon_library folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\DTXWizard\skin folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin\DTXWizard folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\skin folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\data\weather folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\data\search folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\data\rss folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\data\dynamicElements folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\data folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\scripts folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\skin folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\js folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.YouTube folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\scripts folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV\skin folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.WebTV folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\scripts folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\skin folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\js folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Twitter folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\scripts folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin\css folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook\skin folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.Facebook folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\widgets folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\newtab\images folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\newtab folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\modules folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content\lib folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome\content folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar\chrome folder moved successfully. C:\Program Files (x86)\whitesmoketoolbar folder moved successfully. C:\ProgramData\iHoOm02038 folder moved successfully. C:\ProgramData\WSTB folder moved successfully. [Files/Folders - Modified Within 30 Days] C:\Windows moved successfully. C:\Windows\SysWow64\iexplore.sy_ moved successfully. DllUnregisterServer procedure not found in C:\Windows\SysWow64\lspC8BB.dll C:\Windows\SysWow64\lspC8BB.dll moved successfully. C:\Windows\SysWow64\lkfl.dat moved successfully. C:\Windows\SysWow64\ibfl.dat moved successfully. [Files - No Company Name] File C:\Windows\SysWow64\iexplore.sy_ not found! File C:\Windows\SysWow64\lspC8BB.dll not found! [Purity] Purity scan complete. [Empty Temp Folders] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService User: Public User: steve ->Temp folder emptied: 39357333 bytes ->Temporary Internet Files folder emptied: 79149215 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 672014 bytes ->Flash cache emptied: 659 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 51045441 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 162.00 mb < End of fix log > OTS by OldTimer - Version 3.1.40.1 fix logfile created on 11152010_190633 Files\Folders moved on Reboot… C:\Users\steve\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. File\Folder C:\Users\steve\AppData\Local\Temp\ppcrlui_2676_2 not found! File\Folder C:\Users\steve\AppData\Local\Temp\~DF002B763F77A52DC4.TMP not found! File\Folder C:\Users\steve\AppData\Local\Temp\~DF330E436FAD6B27B6.TMP not found! File\Folder C:\Users\steve\AppData\Local\Temp\~DF5527D29B03DF1E67.TMP not found! File\Folder C:\Users\steve\AppData\Local\Temp\~DF6C64F64F2F8373FD.TMP not found! C:\Users\steve\AppData\Local\Temp\~DF84982D3957351492.TMP moved successfully. File\Folder C:\Users\steve\AppData\Local\Temp\~DFC8C212753411C990.TMP not found! File\Folder C:\Users\steve\AppData\Local\Temp\~DFFBC678B30D51234F.TMP not found! C:\Users\steve\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LF01P902\index[7].htm moved successfully. File\Folder C:\Users\steve\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4S7TQEVP\like[1].htm not found! C:\Users\steve\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\24BRPZ1U\iframe[2].htm moved successfully. C:\Users\steve\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. File\Folder C:\Windows\temp\avB99A.tmp not found! C:\Windows\temp\iswift.dat moved successfully. C:\Windows\temp\sfdb.dat moved successfully. C:\Windows\temp\ZLT07c08.TMP moved successfully. Registry entries deleted on Reboot…
Post #26
Hi

You can go ahead and delete that other folder.

:\Users\steve\AppData\Roaming\Ukinu

how is the computer running now?

Please post a fresh DDS log
Post #27
Can't open a link from an email now. It always shows the bad connection page in ie8. But if I use either of the icons mentioned ie8 will open. The icon that is pinned to the taskbar and the one in quick laungh show a (1) at the end of the link but there is no iexplore. exe (1) in the ie folder plus there are dup files with weird lettering in the file names. I zipped the ie folder up and attached it but due to size of the zip I could only send an example of the files.

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI