Google Redirect

Bejabers Topic Starter · November 25, 2010, 4:30 PM UTC

Every time I go to Google I am asked to type in a phrase to confirm that I am a human. It says that it has detected unusual traffic from my computer network and it needs to check and see if it is me sending the requests and not a robot.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:00:27 AM, on 25/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\notepad.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O24 - Desktop Component 0: (no name) - http://www.mpgh.net/forum/clientscript/vbu…global.js?v=382

–
End of file - 5960 bytes

When I did the HiJackThis Scan it came up with a notice saying: For some reason your system denied write access to the Hosts file, it told me to hit Run then type: notepad C:\WINDOWS\System32\drivers\etc\hosts and press Enter and here is what was displayed:

74.125.45.100 securitysoftwarepayments.com
74.125.45.100 privatesecuredpayments.com
74.125.45.100 secure.privatesecuredpayments.com
74.125.45.100 getantivirusplusnow.com
74.125.45.100 secure-plus-payments.com
74.125.45.100 www.getantivirusplusnow.com
74.125.45.100 www.secure-plus-payments.com
74.125.45.100 www.getavplusnow.com
74.125.45.100 safebrowsing-cache.google.com
74.125.45.100 urs.microsoft.com
74.125.45.100 www.securesoftwarebill.com
74.125.45.100 secure.paysecuresystem.com
74.125.45.100 paysoftbillsolution.com
74.125.45.100 protected.maxisoftwaremart.com
64.46.38.208 www.google.com
64.46.38.208 google.com
64.46.38.208 google.com.au
64.46.38.208 www.google.com.au
64.46.38.208 google.be
64.46.38.208 www.google.be
64.46.38.208 google.com.br
64.46.38.208 www.google.com.br
64.46.38.208 google.ca
64.46.38.208 www.google.ca
64.46.38.208 google.ch
64.46.38.208 www.google.ch
64.46.38.208 google.de
64.46.38.208 www.google.de
64.46.38.208 google.dk
64.46.38.208 www.google.dk
64.46.38.208 google.fr
64.46.38.208 www.google.fr
64.46.38.208 google.ie
64.46.38.208 www.google.ie
64.46.38.208 google.it
64.46.38.208 www.google.it
64.46.38.208 google.co.jp
64.46.38.208 www.google.co.jp
64.46.38.208 google.nl
64.46.38.208 www.google.nl
64.46.38.208 google.no
64.46.38.208 www.google.no
64.46.38.208 google.co.nz
64.46.38.208 www.google.co.nz
64.46.38.208 google.pl
64.46.38.208 www.google.pl
64.46.38.208 google.se
64.46.38.208 www.google.se
64.46.38.208 google.co.uk
64.46.38.208 www.google.co.uk
64.46.38.208 google.co.za
64.46.38.208 www.google.co.za
64.46.38.208 www.google-analytics.com
64.46.38.208 www.bing.com
64.46.38.208 search.yahoo.com
64.46.38.208 www.search.yahoo.com
64.46.38.208 uk.search.yahoo.com
64.46.38.208 ca.search.yahoo.com
64.46.38.208 de.search.yahoo.com
64.46.38.208 fr.search.yahoo.com
64.46.38.208 au.search.yahoo.com
64.46.38.208 www.youtube.com

RPMcMurphy · November 25, 2010, 10:09 PM UTC

Hello Bejabers and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:

Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any underlined text in my posts indicates a clickable link.
You should print any instructions I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.com
DDS.pif

Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:

Make sure that your security software is disabled
Uncheck the box next to "Files" this time also
If you still can't run it, try in the Safe Mode

Please include the following in your next post:

DDS.txt and Attach.txt logs

GMER log

Bejabers · November 26, 2010, 3:05 PM UTC

DDS came up with a message saying it cannot be run in DOS mode

Gmer.txt worked

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-25 23:21:12
Windows 5.1.2600 Service Pack 3
Running: c8z23rvd.exe; Driver: C:\DOCUME~1\Shane\LOCALS~1\Temp\uxrcqkow.sys

—- System - GMER 1.0.15 —-

SSDT 8A8EEC90 ZwAssignProcessToJobObject
SSDT 8A8EF200 ZwDebugActiveProcess
SSDT 8A8EF2F0 ZwDuplicateObject
SSDT 8A8EE590 ZwOpenProcess
SSDT 8A8EE800 ZwOpenThread
SSDT 8A8EEFD0 ZwProtectVirtualMemory
SSDT 8A8EF0E0 ZwQueueApcThread
SSDT 8A8EEEC0 ZwSetContextThread
SSDT 8A8EED90 ZwSetInformationThread
SSDT 8A8EBDA0 ZwSetSecurityObject
SSDT 8A8EEB90 ZwSuspendProcess
SSDT 8A8EEA80 ZwSuspendThread
SSDT 8A8EE6E0 ZwTerminateProcess
SSDT 8A8EEA50 ZwTerminateThread
SSDT 8A8EF6D0 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2DE4 80504680 4 Bytes CALL 5774D113
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB72CA3A0, 0x59FFE5, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\SearchIndexer.exe[1284] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[2044] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)

—- EOF - GMER 1.0.15 —-

RPMcMurphy · November 26, 2010, 3:50 PM UTC

Bejabers:

🖼Click to load external image (Posted Image) Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and paste them into your next post.

Please include the following in your next post:

OTL.txt and Extras.txt logs

Bejabers · November 26, 2010, 6:23 PM UTC

OTL logfile created on: 26/11/2010 10:17:28 AM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Shane\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 81.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 500 1000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 139.28 Gb Total Space | 97.39 Gb Free Space | 69.93% Space Free | Partition Type: NTFS
Drive I: | 3.19 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 465.76 Gb Total Space | 309.20 Gb Free Space | 66.39% Space Free | Partition Type: NTFS

Computer Name: HOME-S4N8AQFTL1 | User Name: Shane | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/26 10:17:04 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Shane\Desktop\OTL.exe
PRC - [2009/11/16 09:04:30 | 000,735,960 | —- | M] (ESET) – C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2009/11/16 09:03:32 | 002,054,360 | —- | M] (ESET) – C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2008/04/13 16:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/07/11 14:57:42 | 000,880,640 | R— | M] (Sony Ericsson Mobile Communications AB) – C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
PRC - [2007/03/16 02:23:20 | 000,983,040 | R— | M] (Teleca AB) – C:\Program Files\Common Files\Teleca Shared\Generic.exe
PRC - [2006/11/15 20:23:15 | 001,073,152 | —- | M] () – C:\Program Files\WiFiConnector\NintendoWFCReg.exe

========== Modules (SafeList) ==========

MOD - [2010/11/26 10:17:04 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Shane\Desktop\OTL.exe
MOD - [2010/08/23 08:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2006/05/03 22:53:54 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\framedyn.dll

========== Win32 Services (SafeList) ==========

SRV - [2009/11/16 09:12:54 | 000,020,680 | —- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe – (EhttpSrv)
SRV - [2009/11/16 09:04:30 | 000,735,960 | —- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET Smart Security\ekrn.exe – (ekrn)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva374.sys – (XDva374)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva372.sys – (XDva372)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva370.sys – (XDva370)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva368.sys – (XDva368)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva367.sys – (XDva367)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva366.sys – (XDva366)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva362.sys – (XDva362)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva361.sys – (XDva361)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva359.sys – (XDva359)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva358.sys – (XDva358)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva352.sys – (XDva352)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\XDva349.sys – (XDva349)
DRV - File not found [Kernel | On_Demand | Stopped] – I:\PciCon.sys – (PciCon)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\EagleNT.sys – (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\ATIRWVD.SYS – (ATI Remote Wonder II)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\Advanced System Optimizer 3\adasprot32.sys – (ADASPROT)
DRV - [2010/07/10 05:38:00 | 010,604,128 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2010/01/08 08:13:12 | 000,033,096 | —- | M] (ESET) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\epfwndis.sys – (Epfwndis)
DRV - [2009/12/18 15:02:26 | 000,135,048 | —- | M] (ESET) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\epfw.sys – (epfw)
DRV - [2009/11/16 09:06:48 | 000,055,768 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\epfwtdi.sys – (epfwtdi)
DRV - [2009/11/16 09:03:36 | 000,108,792 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\ehdrv.sys – (ehdrv)
DRV - [2009/11/16 08:56:12 | 000,116,520 | —- | M] (ESET) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\eamon.sys – (eamon)
DRV - [2008/04/13 08:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2007/12/06 09:51:00 | 000,285,952 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\yk51x86.sys – (yukonwxp)
DRV - [2007/05/16 11:20:32 | 000,043,008 | —- | M] (D-Link ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\dlkfet5b.sys – (FETNDISB)
DRV - [2007/05/02 11:11:16 | 000,083,592 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ss_bus.sys – (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2007/04/24 10:33:46 | 000,100,488 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s125mgmt.sys – (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM)
DRV - [2007/04/24 10:33:46 | 000,098,696 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s125obex.sys – (s125obex)
DRV - [2007/04/24 10:33:44 | 000,108,680 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s125mdm.sys – (s125mdm)
DRV - [2007/04/24 10:33:42 | 000,015,112 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s125mdfl.sys – (s125mdfl)
DRV - [2007/04/24 10:33:34 | 000,083,336 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s125bus.sys – (s125bus) Sony Ericsson Device 125 driver (WDM)
DRV - [2007/04/16 21:46:00 | 000,033,792 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdPPM.sys – (AmdPPM)
DRV - [2007/04/03 12:57:54 | 000,099,080 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116unic.sys – (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM)
DRV - [2007/04/03 12:57:52 | 000,098,696 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116obex.sys – (s116obex)
DRV - [2007/04/03 12:57:52 | 000,023,176 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116nd5.sys – (s116nd5) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS)
DRV - [2007/04/03 12:57:50 | 000,100,488 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116mgmt.sys – (s116mgmt) Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM)
DRV - [2007/04/03 12:57:48 | 000,108,680 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116mdm.sys – (s116mdm)
DRV - [2007/04/03 12:57:48 | 000,015,112 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116mdfl.sys – (s116mdfl)
DRV - [2007/04/03 12:57:42 | 000,083,336 | R— | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\s116bus.sys – (s116bus) Sony Ericsson Device 116 driver (WDM)
DRV - [2006/12/12 11:28:26 | 000,052,224 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BrSerIf.sys – (BrSerIf)
DRV - [2006/09/03 09:53:54 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2006/07/24 16:05:00 | 000,005,632 | —- | M] () [File_System | System | Running] – C:\WINDOWS\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2006/06/06 04:09:26 | 004,284,928 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.Sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/06/01 14:15:20 | 000,509,440 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\xnacc.sys – (xnacc)
DRV - [2006/04/09 21:02:18 | 000,162,816 | —- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RT25USBAP.SYS – (RT25USBAP)
DRV - [2004/10/15 12:50:20 | 000,015,295 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BrScnUsb.sys – (BrScnUsb)
DRV - [2004/09/07 17:57:00 | 000,316,152 | —- | M] (Jungo) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\windrvr6.sys – (WinDriver6)
DRV - [2003/07/16 14:27:40 | 000,043,264 | —- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ser2pl.sys – (Ser2pl)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions [2010/07/17 17:29:16 | 000,000,000 | —D | M]

[2010/07/09 16:34:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Mozilla\Extensions
[2010/07/09 16:34:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2010/10/29 18:41:50 | 000,001,905 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 64.46.38.208 www.google.com
O1 - Hosts: 64.46.38.208 google.com
O1 - Hosts: 64.46.38.208 google.com.au
O1 - Hosts: 64.46.38.208 www.google.com.au
O1 - Hosts: 64.46.38.208 google.be
O1 - Hosts: 64.46.38.208 www.google.be
O1 - Hosts: 64.46.38.208 google.com.br
O1 - Hosts: 64.46.38.208 www.google.com.br
O1 - Hosts: 64.46.38.208 google.ca
O1 - Hosts: 64.46.38.208 www.google.ca
O1 - Hosts: 64.46.38.208 google.ch
O1 - Hosts: 37 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O15 - HKCU\..Trusted Domains: budcamp.ca ([www] https in Trusted sites)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://www.mpgh.net/forum/clientscript/vbu…global.js?v=382
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Shane\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Shane\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/12/29 11:54:17 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/10/17 10:45:38 | 000,000,066 | R— | M] () - I:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (sasnative32) - File not found
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/26 10:17:03 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Shane\Desktop\OTL.exe
[2010/11/25 09:45:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Shane\Application Data\WinPatrol
[2010/11/25 09:45:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\InstallMate
[2010/11/25 09:45:01 | 000,000,000 | —D | C] – C:\Program Files\BillP Studios
[2010/11/25 09:39:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Shane\Desktop\GooredFix Backups
[2010/11/25 07:44:29 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/26 10:17:04 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Shane\Desktop\OTL.exe
[2010/11/26 10:11:22 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/26 07:06:29 | 000,625,272 | —- | M] () – C:\Documents and Settings\Shane\Desktop\dds.com
[2010/11/26 06:56:00 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/11/26 06:55:58 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/26 06:55:58 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\SDMsgUpdate (TE).job
[2010/11/25 23:32:04 | 000,000,440 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.ics
[2010/11/25 23:31:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/11/25 15:02:52 | 000,296,448 | —- | M] () – C:\Documents and Settings\Shane\Desktop\c8z23rvd.exe
[2010/11/25 08:26:17 | 000,002,447 | —- | M] () – C:\Documents and Settings\Shane\Desktop\HiJackThis.lnk
[2010/11/20 15:52:12 | 000,163,840 | —- | M] () – C:\Documents and Settings\Shane\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/20 09:36:58 | 000,034,777 | —- | M] () – C:\Documents and Settings\Shane\My Documents\korbin.jpg
[2010/11/20 09:33:57 | 000,031,782 | —- | M] () – C:\Documents and Settings\Shane\My Documents\cm1.jpg
[2010/11/17 20:05:36 | 000,000,188 | —- | M] () – C:\Documents and Settings\Shane\Desktop\My Sony Ericsson W810.lnk
[2010/11/09 13:36:53 | 000,001,312 | —- | M] () – C:\WINDOWS\System32\inui09.dat
[2010/11/08 22:02:44 | 000,232,968 | —- | M] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2010/11/08 22:02:44 | 000,000,001 | —- | M] () – C:\WINDOWS\System32\nvdrssel.bin
[2010/11/08 22:02:38 | 000,232,968 | —- | M] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2010/11/08 22:02:38 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\nvdrswr.lk
[2010/11/08 19:18:15 | 000,453,400 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/08 19:18:15 | 000,074,366 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/11/08 19:16:03 | 000,272,073 | —- | M] () – C:\WINDOWS\System32\NvApps.xml
[2010/10/30 18:58:00 | 000,000,099 | —- | M] () – C:\Documents and Settings\Shane\jagex_runescape_preferences2.dat
[2010/10/30 18:51:25 | 000,000,046 | —- | M] () – C:\Documents and Settings\Shane\jagex_runescape_preferences.dat
[2010/10/29 18:41:50 | 000,001,905 | RHS- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/26 07:06:29 | 000,625,272 | —- | C] () – C:\Documents and Settings\Shane\Desktop\dds.com
[2010/11/25 15:02:51 | 000,296,448 | —- | C] () – C:\Documents and Settings\Shane\Desktop\c8z23rvd.exe
[2010/11/25 07:44:29 | 000,002,447 | —- | C] () – C:\Documents and Settings\Shane\Desktop\HiJackThis.lnk
[2010/11/20 09:37:07 | 000,034,777 | —- | C] () – C:\Documents and Settings\Shane\My Documents\korbin.jpg
[2010/11/20 09:34:17 | 000,031,782 | —- | C] () – C:\Documents and Settings\Shane\My Documents\cm1.jpg
[2010/11/17 20:05:36 | 000,000,188 | —- | C] () – C:\Documents and Settings\Shane\Desktop\My Sony Ericsson W810.lnk
[2010/11/08 22:02:44 | 000,232,968 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2010/11/08 22:02:38 | 000,232,968 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2010/11/08 22:02:38 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2010/11/08 22:02:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\nvdrswr.lk
[2010/02/07 12:27:06 | 000,022,328 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010/02/07 12:27:05 | 000,022,328 | —- | C] () – C:\Documents and Settings\Shane\Application Data\PnkBstrK.sys
[2010/02/07 12:26:45 | 000,000,316 | —- | C] () – C:\WINDOWS\game.ini
[2010/01/16 14:35:27 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2010/01/16 14:34:41 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2010/01/14 12:11:05 | 000,163,840 | —- | C] () – C:\Documents and Settings\Shane\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/02 22:21:16 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2010/01/01 22:56:47 | 000,135,168 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2009/12/30 10:44:11 | 000,000,773 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2009/12/30 10:44:11 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2009/12/30 10:43:35 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2009/12/30 10:43:34 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2009/12/29 16:37:01 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2009/12/29 16:37:01 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2009/12/29 03:45:56 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/09/17 23:55:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/10/10 17:56:12 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005/06/17 11:41:14 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\vuins32.dll

========== LOP Check ==========

[2010/03/15 16:25:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010/01/23 12:07:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2009/12/30 12:27:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2010/11/25 09:45:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallMate
[2010/07/02 16:51:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2010/07/02 16:51:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/10/20 20:31:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/09/28 05:37:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuestDns
[2010/11/08 21:37:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Systweak
[2010/04/06 07:54:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Teleca
[2010/01/01 20:11:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Backup Manager
[2010/01/23 12:08:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\ESET
[2010/01/01 10:59:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\GARMIN
[2010/10/20 17:36:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\InstantAction
[2010/10/20 20:31:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\OpenCandy
[2010/03/05 07:48:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\OpenOffice.org
[2010/01/04 18:08:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\PC-FAX TX
[2010/07/19 22:07:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\ShopperReports3
[2010/10/02 17:17:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\SmartDraw
[2010/10/08 10:18:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Sony Online Entertainment
[2010/06/24 10:40:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\SPORE
[2010/11/08 21:37:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Systweak
[2010/04/06 08:10:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Teleca
[2010/07/10 12:06:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Vivox
[2009/12/29 16:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Windows Desktop Search
[2010/03/02 09:54:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\Windows Search
[2010/11/25 09:45:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Shane\Application Data\WinPatrol
[2010/11/26 06:55:58 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\SDMsgUpdate (TE).job

========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 26/11/2010 10:17:28 AM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Shane\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 81.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 500 1000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 139.28 Gb Total Space | 97.39 Gb Free Space | 69.93% Space Free | Partition Type: NTFS
Drive I: | 3.19 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 465.76 Gb Total Space | 309.20 Gb Free Space | 66.39% Space Free | Partition Type: NTFS

Computer Name: HOME-S4N8AQFTL1 | User Name: Shane | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"57600:TCP" = 57600:TCP:*:Enabled:Pando Media Booster
"57600:UDP" = 57600:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"57600:TCP" = 57600:TCP:*:Enabled:Pando Media Booster
"57600:UDP" = 57600:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\WiFiConnector\NintendoWFCReg.exe" = C:\Program Files\WiFiConnector\NintendoWFCReg.exe:*:Enabled:Nintendo Wi-Fi USB Connector – ()
"C:\Program Files\Aspyr\Guitar Hero III\GH3.exe" = C:\Program Files\Aspyr\Guitar Hero III\GH3.exe:*:Enabled:Guitar Hero III – (Aspyr Media, Inc.)
"C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqw.exe" = C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars™ – (Splash Damage, Ltd.)
"C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe" = C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe:*:Enabled:etqwded.exe – (Splash Damage, Ltd.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager – (Nexon)
"C:\Nexon\Combat Arms\NMService.exe" = C:\Nexon\Combat Arms\NMService.exe:*:Enabled:Nexon Messenger Core – (Nexon Corp.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007811BF-E310-4285-BFC6-55DB29B3EDDE}" = WinPatrol
"{00B22EE2-207E-45EE-AFCB-7F3C934AA176}" = DFE-538TX
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}" = Guitar Hero III
"{0ED38503-B69A-44B4-98BE-21BFF284A9B6}" = Brother Driver Deployment Wizard
"{15F4085A-BC98-4590-AFFD-03BBBE49524E}" = Garmin Communicator Plugin
"{25BEC3AB-5CD4-481D-9143-215C1BBB189E}" = Sony Ericsson PC Suite
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E5EE953-0D92-A385-E3A0-FBFCB2DE15AA}" = EA Download Manager UI
"{5EECEB40-3EE2-4762-872D-264346A26B84}_is1" = Rubber Ninjas Demo 1.05
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = The Sims 2 Open For Business
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{9600B88C-BE14-4BEA-A529-F5F312900BA3}" = Samsung PC Studio 3
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9C244239-ED8E-40f1-937F-51C706CD2160}" = The Sims™ 2 Deluxe
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A347C572-F7B4-43A3-BD51-FFC99184F70D}" = Jurassic Park Operation Genesis
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B6143A6F-A2EB-4CA1-A30A-26E783CF8F82}" = Garmin TOPO Canada v4
"{B7A585C8-CE4E-4150-84C6-A13C3CB1379F}" = Enemy Territory - QUAKE Wars™
"{BE09FBC2-74BF-42A5-8FFF-12E784BAA42C}" = ESET Smart Security
"{C01408FC-117C-44B7-8B0C-17794E526A01}" = Disc2Phone
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C60BA916-9E44-4DA4-B11A-9E27B7624EF5}" = Sony Ericsson Drivers
"{C92E7DF1-624A-4D95-A4C4-18CB491B44A4}" = Sony Ericsson Device Data
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6BF6477-8369-489F-8DE6-3731F4B88560}" = Sony Ericsson PC Suite
"{EB92F7F9-26AC-4178-AC60-0BBB5ACED798}" = Garmin BaseCamp
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = UC-232A USB-to-Serial
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows Driver Package - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows Driver Package - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Age of Mythology 1.0" = Age of Mythology
"All ATI Software" = ATI - Software Uninstall Utility
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Combat Arms" = Combat Arms
"Cross Fire_is1" = Cross Fire En
"EA Download Manager" = EA Download Manager
"Halo CE" = Microsoft Halo Custom Edition
"ie8" = Windows Internet Explorer 8
"InstallShield_{00B22EE2-207E-45EE-AFCB-7F3C934AA176}" = DFE-538TX
"InstallShield_{A347C572-F7B4-43A3-BD51-FFC99184F70D}" = Jurassic Park Operation Genesis
"InstallShield_{B7A585C8-CE4E-4150-84C6-A13C3CB1379F}" = Enemy Territory - QUAKE Wars™
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"myTaxExpress NETFILE 2009_is1" = myTaxExpress NETFILE 2009
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"QuestDns" = QuestDns 1.0 build 117
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"ShopperReportsSA" = ShopperReports
"SmartDraw VP" = SmartDraw VP
"VN_VUIns_Rhine_D-Link" = D-Link PCI Fast Ethernet Adapter
"WiFiConnector" = Nintendo Wi-Fi USB Connector Registration Tool
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinISD beta" = WinISD beta
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xbox_360_CC_Driver" = Xbox 360 Controller for Windows

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for Shane

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 04/04/2010 8:32:22 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3013
Description = The entry SIMS 2\NEIGHBORHOODS\N004\N004_NEIGHBORHOOD.PACKAGE> in the hash map cannot be
updated. Context: Application, SystemIndex Catalog Details: A device attached to the
system is not functioning. (0x8007001f)

Error - 04/04/2010 9:53:11 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3013
Description = The entry SIMS 2\NEIGHBORHOODS\NEIGHBORHOODMANAGER.PACKAGE> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 06/04/2010 12:26:05 AM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3013
Description = The entry SIMS 2\NEIGHBORHOODS\N001\N001_NEIGHBORHOOD.PACKAGE> in the hash map cannot be
updated. Context: Application, SystemIndex Catalog Details: A device attached to the
system is not functioning. (0x8007001f)

Error - 06/04/2010 11:41:40 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application setup.exe, version 1.0.0.1, faulting module tkernelinterface.dll,
version 0.0.0.0, fault address 0x00019828.

Error - 06/04/2010 11:41:59 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1001
Description = Fault bucket 37196028.

Error - 03/05/2010 9:43:35 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Application, SystemIndex
Catalog

Error - 13/05/2010 8:13:17 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application SearchIndexer.exe, version 7.0.6001.16503, faulting
module tquery.dll, version 7.0.6001.16503, fault address 0x00119d38.

Error - 15/05/2010 4:10:57 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x056469e3.

Error - 17/05/2010 9:26:08 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application setup.exe, version 1.0.0.1, faulting module tkernelinterface.dll,
version 0.0.0.0, fault address 0x00019828.

Error - 17/05/2010 9:26:13 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1001
Description = Fault bucket 37196028.

[ Application Events ]
Error - 04/04/2010 8:32:22 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3013
Description = The entry SIMS 2\NEIGHBORHOODS\N004\N004_NEIGHBORHOOD.PACKAGE> in the hash map cannot be
updated. Context: Application, SystemIndex Catalog Details: A device attached to the
system is not functioning. (0x8007001f)

Error - 04/04/2010 9:53:11 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3013
Description = The entry SIMS 2\NEIGHBORHOODS\NEIGHBORHOODMANAGER.PACKAGE> in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 06/04/2010 12:26:05 AM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3013
Description = The entry SIMS 2\NEIGHBORHOODS\N001\N001_NEIGHBORHOOD.PACKAGE> in the hash map cannot be
updated. Context: Application, SystemIndex Catalog Details: A device attached to the
system is not functioning. (0x8007001f)

Error - 06/04/2010 11:41:40 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application setup.exe, version 1.0.0.1, faulting module tkernelinterface.dll,
version 0.0.0.0, fault address 0x00019828.

Error - 06/04/2010 11:41:59 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1001
Description = Fault bucket 37196028.

Error - 03/05/2010 9:43:35 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Application, SystemIndex
Catalog

Error - 13/05/2010 8:13:17 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application SearchIndexer.exe, version 7.0.6001.16503, faulting
module tquery.dll, version 7.0.6001.16503, fault address 0x00119d38.

Error - 15/05/2010 4:10:57 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x056469e3.

Error - 17/05/2010 9:26:08 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1000
Description = Faulting application setup.exe, version 1.0.0.1, faulting module tkernelinterface.dll,
version 0.0.0.0, fault address 0x00019828.

Error - 17/05/2010 9:26:13 PM | Computer Name = HOME-S4N8AQFTL1 | Source = Application Error | ID = 1001
Description = Fault bucket 37196028.

[ System Events ]
Error - 25/11/2010 7:04:27 PM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 25/11/2010 7:04:27 PM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 25/11/2010 7:04:27 PM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 25/11/2010 7:04:27 PM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 25/11/2010 7:04:27 PM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 26/11/2010 3:25:08 AM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 26/11/2010 11:07:41 AM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 26/11/2010 11:07:41 AM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 26/11/2010 11:07:41 AM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

Error - 26/11/2010 11:08:20 AM | Computer Name = HOME-S4N8AQFTL1 | Source = ipnathlp | ID = 31012
Description = The DNS proxy agent encountered an error while obtaining the local
list of name-resolution servers. Some DNS or WINS servers may be inaccessible to
clients on the local network. The data is the error code.

< End of report >

RPMcMurphy · November 27, 2010, 1:12 AM UTC

Bejabers:

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O34 - HKLM BootExecute: (sasnative32) - File not found
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
:Commands
[EmptyFlash]
[EmptyTemp]
[Purity]
[ResetHosts]

Then click the Run Fix button at the top
Let the program run unhindered, it will reboot when it is done and produce a log

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post the results.

Please include the following in your next post:

OTL Fix log

MBAM log

Bejabers · November 29, 2010, 2:45 AM UTC

All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\WINDOWS\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found. Starting removal of ActiveX control DirectAnimation Java Classes Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found. File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found. Starting removal of ActiveX control Microsoft XML Parser for Java Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:sasnative32 deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3d.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dara.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dchs.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dcht.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dcsy.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3ddan.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3ddeu.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dell.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3deng.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3desm.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3desn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dfin.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dfra.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dheb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dhun.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dita.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3djpn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dkor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dnld.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dnor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dplk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dptb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dptg.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3drus.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dsky.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dslv.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dsve.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dtha.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nv3dtrk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpl.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplara.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplchs.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplcht.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplcsy.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpldan.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpldeu.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplell.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpleng.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplesm.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplesn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplfin.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplfra.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplheb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplhun.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplita.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpljpn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplkor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplnld.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplnor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplplk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplptb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplptg.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplrus.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplsky.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplslv.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcplsve.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpltha.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvcpltrk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdsp.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspara.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspchs.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspcht.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspcsy.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspdan.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspdeu.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspell.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspeng.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspesm.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspesn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspfin.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspfra.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspheb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdsphun.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspita.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspjpn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspkor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspnld.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspnor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspplk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspptb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspptg.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdsprus.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspsky.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspslv.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdspsve.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdsptha.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvdsptrk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmob.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobara.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobchs.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobcht.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobcsy.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobdan.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobdeu.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobell.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobeng.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobesm.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobesn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobfin.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobfra.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobheb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobhun.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobita.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobjpn.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobkor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobnld.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobnor.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobplk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobptb.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobptg.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobrus.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobsky.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobslv.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobsve.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobtha.chm deleted successfully. C:\WINDOWS\NV40443856.TMP\nvmobtrk.chm deleted successfully. C:\WINDOWS\NV40443856.TMP folder deleted successfully. C:\WINDOWS\SET3.tmp deleted successfully. C:\WINDOWS\SETA.tmp deleted successfully. C:\WINDOWS\System32\CONFIG.TMP deleted successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default User ->Flash cache emptied: 41620 bytes User: Kids ->Flash cache emptied: 16917 bytes User: LocalService User: NetworkService User: Shane ->Flash cache emptied: 499835 bytes Total Flash Files Cleaned = 1.00 mb [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes User: Kids ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Shane ->Temp folder emptied: 6671121 bytes ->Temporary Internet Files folder emptied: 67553840 bytes ->Java cache emptied: 10470757 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 117291145 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 54430548 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33728 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 245.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.17.3 log created on 11282010_001416 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Shane\Local Settings\Temp\~DF9CA2.tmp not found! File\Folder C:\Documents and Settings\Shane\Local Settings\Temp\~DF9D63.tmp not found! File\Folder C:\Documents and Settings\Shane\Local Settings\Temp\~DF9DF0.tmp not found! File\Folder C:\Documents and Settings\Shane\Local Settings\Temp\~DF9DFC.tmp not found! File\Folder C:\Documents and Settings\Shane\Local Settings\Temp\~DFA101.tmp not found! File\Folder C:\Documents and Settings\Shane\Local Settings\Temp\~DFA11A.tmp not found! C:\Documents and Settings\Shane\Local Settings\Temporary Internet Files\Content.IE5\IIJW3VMR\ads[2].htm moved successfully. C:\Documents and Settings\Shane\Local Settings\Temporary Internet Files\Content.IE5\IIJW3VMR\index[2].htm moved successfully. C:\Documents and Settings\Shane\Local Settings\Temporary Internet Files\Content.IE5\HC5S4G5B\ads[2].htm moved successfully. C:\Documents and Settings\Shane\Local Settings\Temporary Internet Files\Content.IE5\FK7YT649\iframe[1].htm moved successfully. C:\Documents and Settings\Shane\Local Settings\Temporary Internet Files\Content.IE5\FK7YT649\like[1].htm moved successfully. Registry entries deleted on Reboot… Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 5204 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 28/11/2010 6:42:16 PM mbam-log-2010-11-28 (18-42-16).txt Scan type: Quick scan Objects scanned: 146892 Time elapsed: 3 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 99 Registry Values Infected: 3 Registry Data Items Infected: 4 Folders Infected: 25 Files Infected: 32 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\shopperreports.asyncreporter (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{f1a1892c-2a6c-4817-98b4-ff81443cba20} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e25da6d6-c365-46cf-abaf-dc5893135d7a} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{09325003-167c-483d-a4ba-8b3122abb432} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6dd76b7b-6423-4df0-9a07-84a6cad973a0} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7f6cfb6a-9227-4bb8-b941-f2b067e76f51} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ab0ee208-df60-4fa7-a617-c4269760033e} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e12aeab6-7d12-4c07-8e36-5892efb4dafb} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e2f2c137-a782-4fb5-81af-086156f5eb0a} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{f1d06c9f-51f0-4476-bede-5ddf91be304e} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{f3a32df2-7413-4fb1-b575-1ac920a17b76} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.asyncreporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.cntntdic (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{02aed140-2b62-4b49-8b3b-179020cc39b9} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{17bf1e05-c0e8-413c-bd1f-a481eea3b8e9} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{83b2fe06-ba20-4f7d-96c6-6fc3a4e877d3} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b32966a2-f7c2-4362-a6cf-399ec8b44110} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cc7bd6f1-565c-47ce-a5bb-9c935e77b59d} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cfc16189-8a92-4a29-a940-60248385f426} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.cntntdic.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.cntntdisp (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.cntntdisp.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.dwnldr (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.dwnldr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.hbguru (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.hbguru.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.kopff (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{573f4abb-a1a2-44ed-9ba9-a8dad40aac46} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{71e02280-5212-45c3-b174-4d5a35da254f} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{396cfc12-932d-496b-a0a8-5d7201e105e1} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{60da826c-b1c6-4358-bdec-4837ced45470} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{74c22317-5b90-471f-9ad2-fec049870a16} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c1089f63-7afc-4538-b0eb-bea0f4225a57} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.kopff.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.mozillanvgtntrpr (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.mozillanvgtntrpr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.mozillapsexecuter (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{5fe0ceae-cb69-40af-a323-40f94257dacb} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{65a16874-2ed0-460e-a547-5fe2ec3a13a7} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2721a8e5-bfdb-4562-9912-9e0531ca616c} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.mozillapsexecuter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.reportdata (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.reportdata.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.reporter (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.scopes (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.scopes.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.stock (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.stock.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.triggerimmidiate (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.triggerimmidiate.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.triggerimmidiateorrandomts (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.triggerimmidiateorrandomts.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.triggeronceinday (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shopperreports.triggeronceinday.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{21ba420e-161c-413a-b21e-4e42ae1f4226} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{453db0c5-f41c-4d97-8dd6-cc72ecd5f699} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{4afc07d0-59bb-46b8-b097-1a46e88eef71} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{6511ce4c-4722-40d0-ad3d-4afa2f50978a} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{9bec9b38-bf39-4899-806e-a1c5dfeb60a2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b86d82bf-d39f-439a-a07c-43eddc6f6ea6} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{da6305b9-0869-4235-8c1d-533a65e639e5} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e6961c59-cfce-4ccd-b794-bc78db98413a} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f8b4ec8a-2407-4be0-aee2-0f430d65a90d} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{0d82acd6-a652-4496-a298-2bde705f4227} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{7025e484-d4b0-441a-9f0b-69063bd679ce} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{8258b35c-05b8-4c0e-9525-9bccc70f8f2d} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{a89256ad-ec17-4a83-bef5-4b8bc4f39306} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{dee758b4-c3fb-4a5b-9939-848b9c77a2fb} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{acc62306-9a63-4864-bd2f-c8825d2d7ea6} (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89f88394-3828-4d03-a0cf-8203604c3da6} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{d4233f04-1789-483c-a137-731e8f113dd5} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\questdns (Adware.QuestDns) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\BRNstIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\CmndFF.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\mozillaps.dll (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\Pltfrm.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperReportsSA (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\QuestDns (Adware.QuestDns) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\shopperreports 3.0.485.0 (Adware.HotBar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\srs_it_e8790270b2765c5536a197 (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\[removed] (ShopperReports) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CLASSES_ROOT\batfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" %*) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\comfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" %*) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\piffile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" %*) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Application Data\QuestDns (Adware.QuestDns) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\report (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\res1 (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\report (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\res1 (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\QuestDns (Adware.QuestDns) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0 (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\chrome (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\components (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ShopperReports (Adware.ShopperReports) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\ShopperReports3\bin\3.0.485.0\Pltfrm.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\CntntCntr.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\CmndFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\mozillaps.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\BRNstIE.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\report\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\report\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Shane\Application Data\ShopperReports3\IE\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\report\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\report\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\Kids\Application Data\ShopperReports3\IE\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\QuestDns\questdns.dll (Adware.QuestDns) -> Quarantined and deleted successfully. C:\Program Files\QuestDns\uninstall.exe (Adware.QuestDns) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\link.ico (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\ShopperReports.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\ShopperReportsUninstaller.exe (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\chrome.manifest (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\install.rdf (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\chrome\firefoxtoolbar.jar (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Program Files\ShopperReports3\bin\3.0.485.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.xpt (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ShopperReports\About Us.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ShopperReports\Customer Support.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ShopperReports\ShopperReports Uninstall Instructions.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.

RPMcMurphy · November 29, 2010, 4:02 AM UTC

Bejabers:

How is it running now - are you still being redirected? Please do this next:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Java™ 6 Update 18 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. If it does not, let me know.

Once the install is complete…

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

On the General tab, under Temporary Internet Files, click the Settings button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH Checked
- Applications and Applets
- Trace and Log Files
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

🖼Click to load external image (Posted Image) Please run ESET Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Please include the following in your next post:

ESET log

How is your computer running now?

Bejabers · November 29, 2010, 7:29 AM UTC

C:\pagefile.sys - error opening [4] C:\Documents and Settings\Kids\My Documents\id Software\Enemy Territory - QUAKE Wars\ETQW-client-1.0-1.5-update.exe » NSIS - archive damaged C:\Documents and Settings\Shane\Desktop\KIDS GAMES\CombatArmsSetupV47.exe » CAB » Game\SND.rez - next archive volume not found C:\Documents and Settings\Shane\My Documents\id Software\Enemy Territory - QUAKE Wars\ETQW-client-1.0-1.5-update.exe » NSIS - archive damaged K:\Downloads\7-11_vista32_dd_ccc_wdm_enu_54440.exe » NSIS » Branding.msi » MSI - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\HD-CEU2.zip » ZIP » DriveNavi.EXE » LHA » - error - unknown compression method K:\Downloads\WindowsEasyTransferCompanion.msi » MSI » wetc.cab » CAB » WETC » ZIP » 1 - archive damaged - the file could not be extracted. K:\Downloads\WindowsEasyTransferCompanion.msi » MSI » wetc.cab » CAB » WETC » ZIP » - archive damaged K:\Misc\Number.1.Cheerleader.Camp.2010.DVDRiP.XviD-QCF\number.1.cheerleader.camp.2010.dvdrip.xvid-qcf.part01.rar » RAR » number.1.cheerleader.camp.2010.dvdrip.xvid-qcf.avi - next archive volume not found K:\Movies\UNWATCHED\A.Nightmare.on.Elm.Street.2010.DVDRip.XviD-Larceny\l-noes-xvid.rar » RAR » l-noes-xvid.avi - next archive volume not found

Bejabers · November 29, 2010, 3:12 PM UTC

I was unable to use the ESET online scanner, however; I have ESET Smart Security 4.0 which should be the same scan. Webpages load way quicker and Google works fine. Could you help me configure my ESET Smart Security 4.0 settings to avoid future problems? Thanks for all your assistance

RPMcMurphy · November 29, 2010, 4:48 PM UTC

Go ahead and run a full scan with ESET Smart Security and let me know what, if anything, turns up.

Bejabers · November 29, 2010, 5:17 PM UTC

I already did the scan and nothing came up, my previous post shows the scan log file. Do you know how to configure the settings for ESET Smart Security 4.0 to prevent future problems. There are a ton of advanced options and I have enabled all of them, however, some may be unnecessary and most of the options state that they will affect my computers' speed so if they aren't needed I would rather not slow my computer.

RPMcMurphy · November 29, 2010, 7:19 PM UTC

Bejabers:

While I can't help you configure ESET (only because I'm not familiar with it) I can tell you that the primary infection I removed was a Host file hijack. You could always ask in their support forum how to cofigure to protect against that.

I have another update and some very important cleanup for you to take care of next:

🖼Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

🖼Click to load external image (Posted Image) Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Manually delete any remaining logs or tools.

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

Restart any anti-malware programs that we disabled while we were cleaning your machine.
Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
Consider running in a limited user account. See this post for more information.
Please carefully review the information in the Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

Bejabers · November 29, 2010, 9:01 PM UTC

I am having trouble downloading Adobe X, when the popup tab opens asking about installing Active X the page closes and I get the message: A problem with this webpage caused IE to close and reopen this tab Also my WinPatrol has been detecting a change to file associations .scr and .bat it is saying the change from notepad to : Name, company name % 1 / s

RPMcMurphy · November 29, 2010, 10:40 PM UTC

Are you disabling your security apps, including WinPatrol, when you attempt to install Adobe X? That file association change is OK to approve.

Google Redirect

✨ Ask AI

Ask AI