TrojanDownloader:Win32/Genome.I and Exploit:Java/CVE-2009-3869.L on my

dav123 Topic Starter

Post #1December 1, 2010, 7:25 PM UTC

I have microsoft security essentials and the above two were detected and subsequently removed. however, using the internet has now become painstakingly slow.

any suggestions? thanks

RPMcMurphy

Post #2December 3, 2010, 1:38 AM UTC

Hello dav123 and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:

Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Any underlined text in my posts indicates a clickable link.
If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.com
DDS.pif

Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:

Make sure that your security software is disabled
Uncheck the box next to "Files" this time also
If you still can't run it, try in the Safe Mode

Please include the following in your next post:

DDS.txt and Attach.txt logs

GMER log

dav123

Post #3December 3, 2010, 9:28 PM UTC

thanks for this, i'm in the process of trying to download these but again this is very slow. as soon as i can i will post the results. thanks again for your response RPMcMurphy

RPMcMurphy

Post #4December 3, 2010, 9:35 PM UTC

Thanks for letting me know - I'll be looking for them.

dav123

Post #5December 3, 2010, 10:12 PM UTC

hi again,

after must persistence of trying to download the dds it now won't work with the following "is not a valid win32 application". ???

however, the gmer produced the following results:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-03 21:50:47
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 FUJITSU_MHY2120BH rev.0085000B
Running: gmer.exe; Driver: C:\DOCUME~1\PAULKI~1\LOCALS~1\Temp\pxtdapob.sys

—- System - GMER 1.0.15 —-

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwAssignProcessToJobObject [0xEE3E0FE4]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwCreateFile [0xEE3E1996]
SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys (RapportCerberus/Trusteer Ltd.) ZwCreateThread [0xF79F7864]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteFile [0xEE3E1AF6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteKey [0xEE3E536C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteValueKey [0xEE3E539E]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwLoadKey [0xEE3E5500]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenFile [0xEE3E1A5A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenProcess [0xEE3E1128]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenThread [0xEE3E131A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwProtectVirtualMemory [0xEE3E144C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwQueryValueKey [0xEE3E5476]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRenameKey [0xEE3E53E0]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwReplaceKey [0xEE3E5412]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRestoreKey [0xEE3E5444]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetContextThread [0xEE3E0F8A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetInformationFile [0xEE3E1B56]
SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys (RapportCerberus/Trusteer Ltd.) ZwSetValueKey [0xF79F782E]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSuspendThread [0xEE3E0F26]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateProcess [0xEE3E0E7A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateThread [0xEE3E0EC2]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 01907420 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] ntdll.dll!LdrLoadDll + 1 7C9163C4 5 Bytes [22, 00, 68, 71, C3]
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 6 Bytes PUSH 71500022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!TranslateMessage 7E418BF6 6 Bytes PUSH 71440022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!RegisterClassW 7E41A39A 6 Bytes PUSH 71560022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!RegisterClassExW 7E41AF7F 6 Bytes PUSH 716E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!DdeInitializeW 7E4206D7 6 Bytes PUSH 714A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9ACD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254656 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!RegisterClassA 7E42EA5E 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!GetClipboardData 7E430DBA 6 Bytes PUSH 71470022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] GDI32.dll!BitBlt 77F16F79 6 Bytes PUSH 71530022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 714D0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E538F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71030022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 71070022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetCloseHandle 3D949088 6 Bytes PUSH 712C0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetQueryDataAvailable 3D94BF7F 6 Bytes PUSH 71170022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpAddRequestHeadersA 3D94CF46 6 Bytes PUSH 71410022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpOpenRequestA 3D94D508 6 Bytes PUSH 713E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetConnectA 3D94DEAE 6 Bytes PUSH 71290022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetConnectW 3D94F862 6 Bytes PUSH 71260022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpSendRequestW 3D94FABE 6 Bytes PUSH 712F0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpOpenRequestW 3D94FBFB 6 Bytes PUSH 713B0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetOpenA 3D95D690 6 Bytes PUSH 711D0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetOpenW 3D95DB09 6 Bytes PUSH 711A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetSetStatusCallback 3D95DCC8 6 Bytes PUSH 71110022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpSendRequestA 3D95EE89 6 Bytes PUSH 71380022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetReadFileExA 3D963381 6 Bytes PUSH 71140022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetGetCookieExA 3D964BD0 6 Bytes PUSH 71200022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetWriteFile 3D9A6076 6 Bytes PUSH 710E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpSendRequestExA 3D9BA642 6 Bytes PUSH 71350022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!HttpSendRequestExW 3D9BA69B 6 Bytes PUSH 71320022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[836] WININET.dll!InternetGetCookieA 3D9BBD24 6 Bytes PUSH 71230022; RET
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1348] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 00414C10 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1348] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1348] USER32.dll!GetGUIThreadInfo + FB 7E428023 6 Bytes JMP 716E001E
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1348] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71650022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1348] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 71680022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 02707420 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] ntdll.dll!LdrLoadDll + 1 7C9163C4 5 Bytes [22, 00, 68, 71, C3]
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 6 Bytes PUSH 71510022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!TranslateMessage 7E418BF6 6 Bytes PUSH 71450022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!RegisterClassW 7E41A39A 6 Bytes PUSH 71570022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!RegisterClassExW 7E41AF7F 6 Bytes PUSH 716E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!DdeInitializeW 7E4206D7 6 Bytes PUSH 714B0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!RegisterClassA 7E42EA5E 6 Bytes PUSH 71620022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!GetClipboardData 7E430DBA 6 Bytes PUSH 71480022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] GDI32.dll!BitBlt 77F16F79 6 Bytes PUSH 71540022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 714E0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 71650022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71040022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 71080022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetCloseHandle 3D949088 6 Bytes PUSH 712D0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetQueryDataAvailable 3D94BF7F 6 Bytes PUSH 71180022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpAddRequestHeadersA 3D94CF46 6 Bytes PUSH 71420022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpOpenRequestA 3D94D508 6 Bytes PUSH 713F0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetConnectA 3D94DEAE 6 Bytes PUSH 712A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetConnectW 3D94F862 6 Bytes PUSH 71270022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpSendRequestW 3D94FABE 6 Bytes PUSH 71300022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpOpenRequestW 3D94FBFB 6 Bytes PUSH 713C0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetOpenA 3D95D690 6 Bytes PUSH 711E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetOpenW 3D95DB09 6 Bytes PUSH 711B0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetSetStatusCallback 3D95DCC8 6 Bytes PUSH 71120022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpSendRequestA 3D95EE89 6 Bytes PUSH 71390022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetReadFileExA 3D963381 6 Bytes PUSH 71150022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetGetCookieExA 3D964BD0 6 Bytes PUSH 71210022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetWriteFile 3D9A6076 6 Bytes PUSH 710F0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpSendRequestExA 3D9BA642 6 Bytes PUSH 71360022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!HttpSendRequestExW 3D9BA69B 6 Bytes PUSH 71330022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2948] WININET.dll!InternetGetCookieA 3D9BBD24 6 Bytes PUSH 71240022; RET
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3176] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 004397C0 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (RapportService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3176] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3176] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71680022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3176] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 716E0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 01907420 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] ntdll.dll!LdrLoadDll + 1 7C9163C4 5 Bytes [22, 00, 68, 71, C3]
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 6 Bytes PUSH 71500022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!TranslateMessage 7E418BF6 6 Bytes PUSH 71440022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!RegisterClassW 7E41A39A 6 Bytes PUSH 71560022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!RegisterClassExW 7E41AF7F 6 Bytes PUSH 716E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!DdeInitializeW 7E4206D7 6 Bytes PUSH 714A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9ACD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254656 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!RegisterClassA 7E42EA5E 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!GetClipboardData 7E430DBA 6 Bytes PUSH 71470022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] GDI32.dll!BitBlt 77F16F79 6 Bytes PUSH 71530022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 714D0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E538F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71030022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 71070022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetCloseHandle 3D949088 6 Bytes PUSH 712C0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetQueryDataAvailable 3D94BF7F 6 Bytes PUSH 71170022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpAddRequestHeadersA 3D94CF46 6 Bytes PUSH 71410022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpOpenRequestA 3D94D508 6 Bytes PUSH 713E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetConnectA 3D94DEAE 6 Bytes PUSH 71290022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetConnectW 3D94F862 6 Bytes PUSH 71260022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpSendRequestW 3D94FABE 6 Bytes PUSH 712F0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpOpenRequestW 3D94FBFB 6 Bytes PUSH 713B0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetOpenA 3D95D690 6 Bytes PUSH 711D0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetOpenW 3D95DB09 6 Bytes PUSH 711A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetSetStatusCallback 3D95DCC8 6 Bytes PUSH 71110022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpSendRequestA 3D95EE89 6 Bytes PUSH 71380022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetReadFileExA 3D963381 6 Bytes PUSH 71140022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetGetCookieExA 3D964BD0 6 Bytes PUSH 71200022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetWriteFile 3D9A6076 6 Bytes PUSH 710E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpSendRequestExA 3D9BA642 6 Bytes PUSH 71350022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!HttpSendRequestExW 3D9BA69B 6 Bytes PUSH 71320022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4224] WININET.dll!InternetGetCookieA 3D9BBD24 6 Bytes PUSH 71230022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 01907420 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] ntdll.dll!LdrLoadDll + 1 7C9163C4 5 Bytes [22, 00, 68, 71, C3]
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 6 Bytes PUSH 71500022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!TranslateMessage 7E418BF6 6 Bytes PUSH 71440022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!RegisterClassW 7E41A39A 6 Bytes PUSH 71560022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!RegisterClassExW 7E41AF7F 6 Bytes PUSH 716E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!DdeInitializeW 7E4206D7 6 Bytes PUSH 714A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9ACD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254656 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!RegisterClassA 7E42EA5E 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!GetClipboardData 7E430DBA 6 Bytes PUSH 71470022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] GDI32.dll!BitBlt 77F16F79 6 Bytes PUSH 71530022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 714D0022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E538F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71030022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 71070022
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetCloseHandle 3D949088 6 Bytes PUSH 712C0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetQueryDataAvailable 3D94BF7F 6 Bytes PUSH 71170022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpAddRequestHeadersA 3D94CF46 6 Bytes PUSH 71410022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpOpenRequestA 3D94D508 6 Bytes PUSH 713E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetConnectA 3D94DEAE 6 Bytes PUSH 71290022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetConnectW 3D94F862 6 Bytes PUSH 71260022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpSendRequestW 3D94FABE 6 Bytes PUSH 712F0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpOpenRequestW 3D94FBFB 6 Bytes PUSH 713B0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetOpenA 3D95D690 6 Bytes PUSH 711D0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetOpenW 3D95DB09 6 Bytes PUSH 711A0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetSetStatusCallback 3D95DCC8 6 Bytes PUSH 71110022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpSendRequestA 3D95EE89 6 Bytes PUSH 71380022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetReadFileExA 3D963381 6 Bytes PUSH 71140022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetGetCookieExA 3D964BD0 6 Bytes PUSH 71200022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetWriteFile 3D9A6076 6 Bytes PUSH 710E0022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpSendRequestExA 3D9BA642 6 Bytes PUSH 71350022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!HttpSendRequestExW 3D9BA69B 6 Bytes PUSH 71320022; RET
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[5712] WININET.dll!InternetGetCookieA 3D9BBD24 6 Bytes PUSH 71230022; RET

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \FileSystem\Fastfat \Fat B8D53D20

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)

—- Registry - GMER 1.0.15 —-

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA6319C0-31B7-401E-A518-A07C3DB8F777}\iexplore@Count 11105
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}\iexplore@Count 5691

—- EOF - GMER 1.0.15 —-

does this help?

thanks

dav123

RPMcMurphy

Post #6December 4, 2010, 12:33 AM UTC

dav123:

That helps, but it's not enough for a diagnosis. Please try this scan instead of DDS:

🖼Click to load external image (Posted Image) Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and paste them into your next post.

Please include the following in your next post:

OTL.txt and Extras.txt log

dav123

Post #7December 4, 2010, 11:02 AM UTC

OTL.txt:

OTL logfile created on: 04/12/2010 10:50:15 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Paul Kinsella\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

894.00 Mb Total Physical Memory | 416.00 Mb Available Physical Memory | 47.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.67 Gb Total Space | 81.94 Gb Free Space | 73.37% Space Free | Partition Type: NTFS

Computer Name: PK | User Name: Paul Kinsella | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/04 10:48:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Paul Kinsella\Desktop\OTL1.exe
PRC - [2010/10/03 22:43:16 | 001,266,920 | —- | M] (Trusteer Ltd.) – C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
PRC - [2010/10/03 22:43:16 | 000,767,208 | —- | M] (Trusteer Ltd.) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
PRC - [2010/09/15 03:34:02 | 001,094,224 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/07/05 20:26:21 | 000,030,192 | —- | M] (Google) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
PRC - [2010/04/19 16:57:43 | 000,095,232 | —- | M] () – C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
PRC - [2010/03/25 20:40:44 | 000,017,904 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009/05/21 10:13:58 | 000,206,064 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/12/03 12:47:34 | 001,205,760 | —- | M] (Nokia) – C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
PRC - [2008/11/11 09:38:06 | 000,620,544 | —- | M] (Nokia.) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2008/09/19 08:52:04 | 000,130,560 | —- | M] () – C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2008/08/13 23:04:44 | 000,201,968 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/06/03 08:02:34 | 000,119,808 | —- | M] () – C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2008/04/14 00:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/02/08 21:32:57 | 000,147,456 | —- | M] (Lime Wire, LLC) – C:\Program Files\LimeWire\LimeWire.exe
PRC - [2007/07/20 15:55:46 | 001,228,800 | —- | M] (Dell Inc.) – C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2007/04/23 20:01:30 | 000,303,104 | —- | M] (SigmaTel, Inc.) – C:\WINDOWS\stsystra.exe
PRC - [2007/04/23 10:23:14 | 001,032,640 | —- | M] (Kontiki Inc.) – C:\Program Files\Kontiki\KHost.exe
PRC - [2007/04/23 10:22:14 | 003,068,352 | —- | M] (Kontiki Inc.) – C:\Program Files\Kontiki\KService.exe
PRC - [2006/11/03 17:02:14 | 000,050,688 | —- | M] (Avanquest Software ) – C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2006/10/20 16:23:38 | 000,118,784 | —- | M] (CyberLink Corp.) – C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
PRC - [2006/08/17 08:00:00 | 001,116,920 | —- | M] (Roxio) – C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
PRC - [2006/01/02 16:41:22 | 000,045,056 | —- | M] (ATI Technologies Inc.) – C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/11/10 12:03:52 | 000,036,975 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
PRC - [2004/07/27 15:50:18 | 000,081,920 | —- | M] (InstallShield Software Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

========== Modules (SafeList) ==========

MOD - [2010/12/04 10:48:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Paul Kinsella\Desktop\OTL1.exe
MOD - [2010/10/03 22:43:42 | 000,431,336 | —- | M] (Trusteer Ltd.) – C:\Program Files\Trusteer\Rapport\bin\rooksbas.dll
MOD - [2010/08/23 16:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – C:\WINDOWS\System32\hidserv.dll – (HidServ)
SRV - [2010/10/03 22:43:16 | 000,767,208 | —- | M] (Trusteer Ltd.) [Auto | Running] – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe – (RapportMgmtService)
SRV - [2010/07/05 20:26:21 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/03/25 20:40:44 | 000,017,904 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Essentials\MsMpEng.exe – (MsMpSvc)
SRV - [2008/11/11 09:38:06 | 000,620,544 | —- | M] (Nokia.) [On_Demand | Running] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2008/08/13 23:04:44 | 000,201,968 | —- | M] (SupportSoft, Inc.) [Auto | Running] – C:\Program Files\Dell Support Center\bin\sprtsvc.exe – (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2007/04/23 10:22:14 | 003,068,352 | —- | M] (Kontiki Inc.) [Auto | Running] – C:\Program Files\Kontiki\KService.exe – (KService)

========== Driver Services (SafeList) ==========

DRV - [2010/10/03 22:54:04 | 000,034,792 | —- | M] (Trusteer Ltd.) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys – (RapportCerberus_19917)
DRV - [2010/10/03 22:43:44 | 000,169,320 | —- | M] (Trusteer Ltd.) [Kernel | System | Running] – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys – (RapportPG)
DRV - [2010/10/03 22:43:44 | 000,059,240 | —- | M] (Trusteer Ltd.) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\RapportKELL.sys – (RapportKELL)
DRV - [2008/09/15 07:56:34 | 000,008,064 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys – (UsbserFilt)
DRV - [2008/09/15 07:56:24 | 000,022,016 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ccdcmbo.sys – (nmwcdc)
DRV - [2008/09/15 07:56:24 | 000,017,664 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ccdcmb.sys – (nmwcd)
DRV - [2008/09/15 07:56:24 | 000,008,064 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys – (upperdev)
DRV - [2008/08/26 09:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2008/04/13 18:36:39 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2008/04/13 18:36:39 | 000,040,960 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2008/04/13 16:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2007/12/02 17:26:22 | 000,989,952 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2007/12/02 17:26:20 | 000,731,136 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2007/12/02 17:26:20 | 000,211,200 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2007/10/16 13:16:14 | 001,777,152 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2007/10/09 03:17:42 | 001,123,328 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\BCMWL5.SYS – (BCM43XX)
DRV - [2007/05/23 13:07:28 | 000,003,456 | —- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\atiide.sys – (atiide)
DRV - [2007/04/26 23:37:24 | 000,202,912 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2007/04/23 20:29:38 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2007/04/23 20:01:28 | 001,228,296 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sthda.sys – (STHDA)
DRV - [2007/04/23 20:00:16 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/08/18 12:18:08 | 000,009,400 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLADResM.SYS – (DLADResM)
DRV - [2006/08/18 12:17:46 | 000,035,096 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLABMFSM.SYS – (DLABMFSM)
DRV - [2006/08/18 12:17:44 | 000,097,848 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS – (DLAUDF_M)
DRV - [2006/08/18 12:17:44 | 000,094,648 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS – (DLAUDFAM)
DRV - [2006/08/18 12:17:42 | 000,026,008 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS – (DLAOPIOM)
DRV - [2006/08/18 12:17:40 | 000,032,472 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLABOIOM.SYS – (DLABOIOM)
DRV - [2006/08/18 12:17:38 | 000,104,472 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS – (DLAIFS_M)
DRV - [2006/08/18 12:17:38 | 000,014,520 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAPoolM.SYS – (DLAPoolM)
DRV - [2006/08/11 10:05:58 | 000,051,768 | —- | M] (Roxio) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\DRVNDDM.SYS – (DRVNDDM)
DRV - [2006/08/11 09:35:18 | 000,012,920 | —- | M] (Roxio) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLACDBHM.SYS – (DLACDBHM)
DRV - [2006/08/11 09:35:16 | 000,028,184 | —- | M] (Roxio) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLARTL_M.SYS – (DLARTL_M)
DRV - [2006/07/21 10:21:26 | 000,099,176 | —- | M] (Sonic Solutions) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS – (DRVMCDB)
DRV - [2005/08/12 16:50:46 | 000,016,128 | —- | M] (Dell Inc) [Kernel | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS – (APPDRV)
DRV - [2004/08/03 21:29:56 | 001,897,408 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2001/08/17 13:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 13:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 13:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 13:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 13:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 12:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 12:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 12:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 12:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 12:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 12:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 12:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 12:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 12:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 12:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://partnerpage.google.com/smallbiz.del…amp;ibd=0080402
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.co.uk/hws/sb/dell-usuk/e…?channel=uk-smb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://partnerpage.google.com/smallbiz.del…amp;ibd=0080402

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.bing.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk/hws/sb/dell-usuk/e…?channel=uk-smb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2008/12/30 20:14:23 | 000,000,000 | —D | M]

O1 HOSTS File: ([2004/08/04 04:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKLM..\Run: [4oD] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\dell\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
O4 - Startup: C:\Documents and Settings\Paul Kinsella\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe ()
O4 - Startup: C:\Documents and Settings\Paul Kinsella\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Microgaming\Poker\ladbrokesMPP\MPPoker.exe (Microgaming)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Paul Kinsella\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Paul Kinsella\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 16:15:00 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{a2cacf4c-16fe-11dd-af68-001d09c6f5ad}\Shell\AutoRun\command - "" = E:\setupSNK.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/04 10:47:03 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Paul Kinsella\Desktop\OTL1.exe
[2010/11/26 21:27:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul Kinsella\Application Data\skypePM
[2010/11/26 21:20:09 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/11/26 21:19:52 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/11/26 21:19:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul Kinsella\Application Data\Skype
[2010/11/26 21:19:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Skype
[2010/11/11 20:39:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul Kinsella\My Documents\dads applications
[6 C:\*.tmp files -> C:\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/04 10:48:09 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Paul Kinsella\Desktop\OTL1.exe
[2010/12/04 09:12:15 | 000,000,408 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/12/04 09:10:59 | 000,000,752 | —- | M] () – C:\Documents and Settings\Paul Kinsella\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk
[2010/12/04 09:10:55 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{8CDE104E-8BC9-4ECD-A30F-B2680EBC103A}.job
[2010/12/04 09:07:33 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/04 09:06:52 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/04 09:06:48 | 937,472,000 | -HS- | M] () – C:\hiberfil.sys
[2010/12/03 21:56:01 | 000,248,465 | —- | M] () – C:\Documents and Settings\Paul Kinsella\Desktop\dds1.pif
[2010/12/03 21:42:53 | 000,296,448 | —- | M] () – C:\Documents and Settings\Paul Kinsella\Desktop\gmer.exe
[2010/12/01 19:49:36 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\null
[2010/11/30 13:27:05 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/11/27 23:05:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/11/26 21:28:01 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/11/26 21:20:12 | 000,001,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/11/22 22:50:31 | 000,031,232 | —- | M] () – C:\Documents and Settings\Paul Kinsella\My Documents\Book1.xls
[2010/11/11 19:52:20 | 000,002,497 | —- | M] () – C:\Documents and Settings\Paul Kinsella\Desktop\Microsoft Office Word 2003 (2).lnk
[2010/11/06 00:12:14 | 000,000,792 | —- | M] () – C:\Documents and Settings\Paul Kinsella\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2010/11/06 00:12:13 | 000,445,608 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/06 00:12:13 | 000,072,774 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[6 C:\*.tmp files -> C:\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/03 21:55:36 | 000,248,465 | —- | C] () – C:\Documents and Settings\Paul Kinsella\Desktop\dds1.pif
[2010/12/03 21:42:46 | 000,296,448 | —- | C] () – C:\Documents and Settings\Paul Kinsella\Desktop\gmer.exe
[2010/11/26 21:28:01 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/11/26 21:20:12 | 000,001,878 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/11/22 22:50:31 | 000,031,232 | —- | C] () – C:\Documents and Settings\Paul Kinsella\My Documents\Book1.xls
[2008/05/15 22:32:23 | 000,011,776 | —- | C] () – C:\Documents and Settings\Paul Kinsella\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/09 19:45:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/04/09 17:33:56 | 000,000,136 | —- | C] () – C:\Documents and Settings\Paul Kinsella\Local Settings\Application Data\fusioncache.dat
[2008/04/01 22:54:50 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/04/01 22:44:36 | 000,056,056 | —- | C] () – C:\WINDOWS\System32\DLAAPI_W.DLL
[2008/04/01 22:44:36 | 000,000,120 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/04/01 22:43:26 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2008/04/01 22:43:25 | 000,753,664 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2008/04/01 22:15:12 | 000,001,201 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2007/03/29 22:00:40 | 000,203,264 | —- | C] () – C:\WINDOWS\System32\CddbCdda.dll
[2006/11/07 03:25:58 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2006/09/16 22:36:50 | 000,520,192 | —- | C] () – C:\WINDOWS\System32\CddbPlaylist2Roxio.dll
[2006/09/16 22:36:50 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
[2004/08/11 16:24:19 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 16:11:31 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 16:07:24 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/11 16:00:45 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/11 16:00:45 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/11 16:00:45 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/11 16:00:45 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/11 16:00:45 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/05/18 17:42:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avanquest Software
[2008/04/16 21:03:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Channel4
[2008/12/30 17:49:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2010/12/04 10:52:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2010/07/16 12:35:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2008/04/01 22:51:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2010/03/27 09:32:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2009/12/26 15:37:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/16 19:35:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/12/30 01:15:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2008/04/26 20:11:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\Betfair
[2010/12/04 09:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\LimeWire
[2010/04/02 22:53:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\Microgaming
[2010/08/29 14:35:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\Nokia
[2008/12/30 17:52:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\PC Suite
[2010/08/29 14:08:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\Spotify
[2010/03/27 09:36:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul Kinsella\Application Data\Trusteer
[2010/12/04 09:12:15 | 000,000,408 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/12/04 09:10:55 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{8CDE104E-8BC9-4ECD-A30F-B2680EBC103A}.job

========== Purity Check ==========

< End of report >

extras.txt:

OTL Extras logfile created on: 04/12/2010 10:50:15 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Paul Kinsella\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

894.00 Mb Total Physical Memory | 416.00 Mb Available Physical Memory | 47.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.67 Gb Total Space | 81.94 Gb Free Space | 73.37% Space Free | Partition Type: NTFS

Computer Name: PK | User Name: Paul Kinsella | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\Program Files\Kontiki\KService.exe" = C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service – (Kontiki Inc.)
"C:\Program Files\Spotify\spotify.exe" = C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify – (Spotify Ltd)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}" = Nokia Connectivity Cable Driver
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{281ECE39-F043-492B-8337-F2E546B5604A}" = PowerDVD
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}" = Nokia PC Suite
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{78225D0F-D12C-09E4-5D6D-A64D763E8982}" = BBC iPlayer Desktop
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B7443F5-E141-42A0-AB61-ED2331AAD606}" = 4oD
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C994D98C-293D-4825-958E-EB684B4D413F}" = MSN Toolbar
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4A6F05B-D32D-4EA3-B288-05894E803225}" = Betfair Poker
"{D848D140-41C3-4A53-86D8-E866A100B4CD}" = PC Connectivity Solution
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E56D39F8-2A9F-44B4-B068-A72E45A073E6}" = Safari
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EF40BAC3-372B-46F4-A32D-B37CF4217CE7}" = ATI Catalyst Control Center
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"4oD" = 4oD
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"5986551A16FD8E9B1B4C89E7AAD17C1BB3196D28" = Windows Driver Package - Nokia Modem (10/27/2008 7.01.0.1)
"6D296974BAB6CA8429D5E687B292A6DA3E9FBD4A" = Windows Driver Package - Nokia Modem (10/27/2008 3.9)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"APIL Model Letters for Personal Injury Lawyers" = APIL Model Letters for Personal Injury Lawyers
"ATI Display Driver" = ATI Display Driver
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"circuspoker" = Circus Poker
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2C06&SUBSYS;_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Google Desktop" = Google Desktop
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Ladbrokes Poker" = Ladbrokes Poker
"LDC Driving Test Complete3.0" = LDC Driving Test Complete
"LimeWire" = LimeWire 4.16.6
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"Paddy Power Poker" = Paddy Power Poker
"Rapport_msi" = Rapport
"SearchAssist" = SearchAssist
"Spotify" = Spotify
"SynTPDeinstKey" = Dell Touchpad
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"William Hill Poker" = William Hill Poker
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 17/11/2010 17:50:57 | Computer Name = PK | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

Error - 24/11/2010 18:22:57 | Computer Name = PK | Source = Application Hang | ID = 1002
Description = Hanging application BBC iPlayer Desktop.exe, version 0.0.0.0, hang
module hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 26/11/2010 15:35:31 | Computer Name = PK | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 27/11/2010 12:07:34 | Computer Name = PK | Source = Application Hang | ID = 1002
Description = Hanging application Skype.exe, version 5.0.0.152, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 28/11/2010 07:01:14 | Computer Name = PK | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3
download, P4 2.1.6805.0, P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware
(bcf43643-a118-4432-aede-d861fcbcfcde), P8 NIL, P9 NIL, P10 NIL.

Error - 03/12/2010 15:14:40 | Computer Name = PK | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3
download, P4 2.1.6805.0, P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware
(bcf43643-a118-4432-aede-d861fcbcfcde), P8 NIL, P9 NIL, P10 NIL.

Error - 03/12/2010 17:28:58 | Computer Name = PK | Source = MSSecurityEssentials | ID = 5000
Description =

[ System Events ]
Error - 01/12/2010 05:15:49 | Computer Name = PK | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 01/12/2010 13:10:31 | Computer Name = PK | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 02/12/2010 09:53:38 | Computer Name = PK | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 02/12/2010 14:19:26 | Computer Name = PK | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 03/12/2010 14:05:08 | Computer Name = PK | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 03/12/2010 15:14:38 | Computer Name = PK | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.95.1025.0 Update Source: %%859 Update Stage:
%%853 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error
code: 0x80240022 Error description: The program can't check for definition updates.

Error - 03/12/2010 15:14:38 | Computer Name = PK | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.95.1025.0 Update Source: %%859 Update Stage:
%%853 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error
code: 0x80240022 Error description: The program can't check for definition updates.

Error - 03/12/2010 17:45:33 | Computer Name = PK | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort2, did not respond within the timeout
period.

Error - 04/12/2010 05:08:44 | Computer Name = PK | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 04/12/2010 05:10:46 | Computer Name = PK | Source = DCOM | ID = 10010
Description = The server {8C9813D0-9FEA-4F37-AAF0-89D9C805B89F} did not register
with DCOM within the required timeout.

< End of report >

cheers

dav123

RPMcMurphy

Post #8December 4, 2010, 5:33 PM UTC

dav123:

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:

ComboFix log

dav123

Post #9December 6, 2010, 6:15 PM UTC

well the system recovery console would not downlad however the combofix did eventually with the following report:

ComboFix 10-12-04.01 - Paul Kinsella 05/12/2010 15:22:46.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.280 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2010-11-05 to 2010-12-05 )))))))))))))))))))))))))))))))
.

2010-12-05 13:36 . 2010-11-10 04:33 6273872 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F337F975-6512-4742-B7F9-74B750BDBA17}\mpengine.dll
2010-11-26 21:27 . 2010-11-28 16:00 ——– d—–w- c:\documents and settings\Paul Kinsella\Application Data\skypePM
2010-11-26 21:20 . 2010-11-26 21:20 ——– d—–w- c:\program files\Common Files\Skype
2010-11-26 21:19 . 2010-11-26 21:24 ——– d—–r- c:\program files\Skype
2010-11-26 21:19 . 2010-11-28 21:01 ——– d—–w- c:\documents and settings\Paul Kinsella\Application Data\Skype
2010-11-26 21:19 . 2010-11-26 21:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-10 04:33 . 2009-12-25 19:24 6273872 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-10-19 20:51 . 2009-12-23 21:25 222080 ——w- c:\windows\system32\MpSigStub.exe
2010-10-03 22:43 . 2010-10-03 22:43 59240 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2010-09-18 11:23 . 2004-08-11 16:00 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-11 16:00 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-11 16:00 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-11 16:00 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2004-08-11 16:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2004-08-11 16:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2004-08-11 16:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 851968]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"SigmatelSysTrayApp"="stsystra.exe" [2007-04-23 303104]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-07-20 1228800]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-09 2183168]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-05 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-01-17 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-02-13 16384]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\Paul Kinsella\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2010-4-19 95232]
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-2-8 147456]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-4-1 50688]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [01/04/2008 22:17 3456]
R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [03/10/2010 22:43 59240]
R1 RapportCerberus_19917;RapportCerberus_19917;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [03/10/2010 22:54 34792]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [03/10/2010 22:43 169320]
R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [03/10/2010 22:43 767208]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [01/04/2008 22:45 30192]
.
Contents of the 'Scheduled Tasks' folder

2010-12-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-12-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-25 20:40]

2010-12-05 c:\windows\Tasks\User_Feed_Synchronization-{8CDE104E-8BC9-4ECD-A30F-B2680EBC103A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 04:31]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
AddRemove-Ladbrokes Poker - c:\microg~1\Poker\LADBRO~1\LADBRO~1\UNWISE.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-05 15:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(892)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2884)
c:\windows\system32\WININET.dll
c:\program files\Trusteer\Rapport\bin\rooksbas.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Kontiki\KService.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2010-12-05 15:54:17 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-05 15:53

Pre-Run: 89,150,562,304 bytes free
Post-Run: 89,254,674,432 bytes free

- - End Of File - - A6CE570219FB63CD1FDFD5DE6A434EC0

after running this the internet connection slowed to a halt, today it seems to have recovered a little. is there any other steps i can take or anything that can be done?

thanks

dav123

RPMcMurphy

Post #10December 6, 2010, 11:27 PM UTC

dav123:

Do any other computers use your internet connection? If so, are they running at normal speed and performance?

Please run these for me:

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post the results.

🖼Click to load external image (Posted Image) Please run ESET Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Please include the following in your next post:

MBAM log

ESET log

dav123

Post #11December 9, 2010, 9:35 PM UTC

hi, the malwarebytes scan: Malwarebytes' Anti-Malware 1.50 www.malwarebytes.org Database version: 5274 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 08/12/2010 20:29:19 mbam-log-2010-12-08 (20-29-19).txt Scan type: Quick scan Objects scanned: 152521 Time elapsed: 16 minute(s), 45 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) the eset scan found no threats also (no option for a log when complete) everything now runs at the original speed, startin to think my internet connection may have just gone slow possibly? if this is the case then many apologies

RPMcMurphy

Post #12December 10, 2010, 2:23 AM UTC

dav123:

Your logs look good, so I'd be inclined to believe that you had an issue with your connection. I have another update and some important cleanup for you to take care of now:

🖼Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

🖼Click to load external image (Posted Image) Uninstall ComboFix

Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
Combofix /Uninstall

🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Manually delete any remaining logs or tools.

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

Restart any anti-malware programs that we disabled while we were cleaning your machine.
Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
Consider running in a limited user account. See this post for more information.
Please carefully review the information in the Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

dav123

Post #13December 12, 2010, 12:42 PM UTC

I've done the above and i will give the 'best practices and prevention forum a good read. thanks alot for your help and time

RPMcMurphy

Post #14December 12, 2010, 11:19 PM UTC

You're welcome, dav123. Take care.

RPMcMurphy

Post #15December 12, 2010, 11:20 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

TrojanDownloader:Win32/Genome.I and Exploit:Java/CVE-2009-3869.L on my

✨ Ask AI

Ask AI