Spyware / Malware / Virus Removal

Possible Alureon.h Tojan?

22 min read

Looking for the outcome? Ask AI

Conspire

Post #16December 16, 2010, 3:26 PM UTC

Sure, your feedback is much appreciated. But I think we still need to do more to make sure it is clear.

Conspire

Post #17December 16, 2010, 4:55 PM UTC

Hi,

Please get a new OTL scan log.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

===================================================

On your next reply please post :
Fresh OTL log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Tiki_Dood

Post #18December 17, 2010, 3:24 PM UTC

It seems to be working normally again!

Here is the additional log you requested:

OTL logfile created on: 12/17/2010 7:16:54 AM - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

246.00 Mb Total Physical Memory | 149.00 Mb Available Physical Memory | 60.00% Memory free
989.00 Mb Paging File | 778.00 Mb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 22.60 Gb Free Space | 60.65% Space Free | Partition Type: NTFS

Computer Name: USER-05BGTB89GT | User Name: Tony | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
PRC - C:\WINDOWS\system32\ZCfgSvc.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\1XConfig.exe (Intel)
PRC - C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
PRC - C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Panasonic\HotKey Appendix\hkeyapp.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\Program Files\Panasonic\WRITING\WRITING.EXE (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (S24EventMonitor) – C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) – C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (Netaapl) – C:\WINDOWS\system32\drivers\netaapl.sys (Apple Inc.)
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (brecal) – C:\Program Files\Panasonic\BRECAL\Brecal.sys (Matsushita Electric Industrial Co., Ltd.)
DRV - (w22n51) Intel® – C:\WINDOWS\system32\drivers\w22n51.sys (Intel® Corporation)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\system32\drivers\stac97.sys (SigmaTel, Inc.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (pcinfo) – C:\Program Files\Panasonic\PCINFO\PCINFO.sys (Matsushita Electric Industrial Co., Ltd.)
DRV - (HOTKEY) – C:\WINDOWS\system32\drivers\HOTKEY.SYS (Matsushita Electric Industrial Co.,Ltd.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (FIDMOU) – C:\WINDOWS\system32\drivers\Fidmou.sys (Fujitsu Component Limited)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/12 00:40:05 | 000,000,000 | —D | M]

[2010/12/13 09:04:31 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/12/13 19:10:34 | 000,426,903 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14704 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [gemstrmw] C:\WINDOWS\System32\gemstrmw.exe (Gemplus)
O4 - HKLM..\Run: [Hotkey] C:\WINDOWS\system32\HKEYMAN.EXE (Matsushita Electric Industrial Co., Ltd.)
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [P3000x_S2P] C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
O4 - HKLM..\Run: [Panasonic HotKey Manager] C:\Program Files\Panasonic\HotKey Appendix\HKEYAPP.EXE (Matsushita Electric Industrial Co., Ltd.)
O4 - HKLM..\Run: [PCinfo] C:\Program Files\Panasonic\PCINFO\SetDiag.exe (Matsushita Electric Industrial Co.,Ltd.)
O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe (Intel® Corporation)
O4 - HKLM..\Run: [PRunOnce] C:\util\prunonce\PRunOnce.exe (Matsushita Electric Industrial Co., Ltd)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Panasonic Hand Writing.lnk = C:\Program Files\Panasonic\WRITING\WRITING.EXE (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\Sebring: DllName - C:\WINDOWS\System32\LgNotify.dll - C:\WINDOWS\system32\LgNotify.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/04/06 10:59:45 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/17 06:19:40 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/12/17 06:07:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\CutePDF Writer
[2010/12/17 03:03:22 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/12/16 12:32:59 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/12/16 12:32:59 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/12/16 12:32:41 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/12/16 12:31:11 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2010/12/16 12:30:53 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010/12/16 12:30:52 | 002,189,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010/12/16 12:30:52 | 002,024,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010/12/16 12:30:51 | 002,066,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2010/12/16 12:25:46 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2010/12/16 12:01:32 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2010/12/16 12:01:32 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2010/12/16 07:43:56 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netapi32.dll
[2010/12/16 07:39:06 | 000,455,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010/12/16 07:33:08 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fontsub.dll
[2010/12/16 07:33:07 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\t2embed.dll
[2010/12/16 07:32:25 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2010/12/16 07:23:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\Fix'n Stuff
[2010/12/16 06:48:30 | 000,045,056 | R— | C] (Samsung Electronics) – C:\WINDOWS\System32\Ssuiext.dll
[2010/12/16 06:45:40 | 000,073,728 | R— | C] (Samsung Software Center) – C:\WINDOWS\wiainst.exe
[2010/12/16 06:23:10 | 000,151,552 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\VdSetup.Exe
[2010/12/16 06:23:10 | 000,053,248 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\VdSetup.dll
[2010/12/16 06:23:09 | 000,013,227 | —- | C] (Samsung Electronics.) – C:\WINDOWS\System32\DelR1LMK.DLL
[2010/12/16 06:22:59 | 000,143,360 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\SSCoinst.exe
[2010/12/16 06:22:59 | 000,135,168 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\SVSetup.Exe
[2010/12/16 06:22:59 | 000,057,344 | —- | C] (SEC) – C:\WINDOWS\System32\SSCoinst.dll
[2010/12/16 06:22:59 | 000,053,248 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\SVSetup.dll
[2010/12/16 06:22:47 | 000,065,536 | —- | C] (Samsung Electronics) – C:\WINDOWS\System32\ssdevm.dll
[2010/12/16 06:22:47 | 000,049,152 | —- | C] (Samsung Electronics) – C:\WINDOWS\System32\ssusbpn.dll
[2010/12/16 06:22:11 | 000,000,000 | —D | C] – C:\Program Files\DELL
[2010/12/16 06:18:52 | 000,000,000 | —D | C] – C:\Dell
[2010/12/16 05:58:56 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/12/15 06:43:45 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe
[2010/12/15 06:43:10 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/14 21:49:41 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
[2010/12/14 04:14:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/12/13 20:01:12 | 013,063,352 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\mssefullinstall-x86fre-en-us-xp.exe
[2010/12/13 12:24:49 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2010/12/13 10:59:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Malwarebytes
[2010/12/13 10:40:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\ApplicationHistory
[2010/12/13 10:28:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Security
[2010/12/13 10:05:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My Videos
[2010/12/13 09:43:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Adobe
[2010/12/13 09:41:58 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/12/13 09:39:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Employment Related Documents
[2010/12/13 09:39:07 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/12/13 09:39:07 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/12/13 09:39:06 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/12/13 09:39:06 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/12/13 09:39:05 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/12/13 09:27:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Sun
[2010/12/13 09:20:59 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\IECompatCache
[2010/12/13 09:20:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Adobe
[2010/12/13 09:20:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Apple Computer
[2010/12/13 09:20:21 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\PrivacIE
[2010/12/13 09:20:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Apple Computer
[2010/12/13 09:19:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Real
[2010/12/13 09:18:35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\IETldCache
[2010/12/13 09:18:21 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings
[2010/12/13 09:18:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Microsoft
[2010/12/13 09:18:17 | 000,000,000 | –SD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Microsoft
[2010/12/13 09:18:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\SendTo
[2010/12/13 09:18:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Recent
[2010/12/13 09:18:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Start Menu
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My Pictures
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My Music
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Favorites
[2010/12/13 09:18:17 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Cookies
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\WLANProfiles
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Templates
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\PrintHood
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\NetHood
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My eBooks
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Macromedia
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\InterTrust
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Identities
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop
[2010/12/13 09:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2010/12/13 08:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe(3)
[2010/12/10 18:28:07 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/12/10 18:05:33 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun(3)
[2010/12/09 13:40:13 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2010/12/09 09:35:23 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Real
[2010/12/09 09:33:51 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe(2)
[2010/12/09 08:47:18 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/12/09 05:27:41 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/09 05:27:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/12/08 22:04:19 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/12/08 19:06:03 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun(2)
[2010/12/08 17:15:32 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe(2)
[2010/12/08 16:40:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/12/08 16:40:15 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/08 01:48:40 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/12/08 01:48:36 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/11/18 10:12:44 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isign32.dll
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/17 07:16:41 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/17 07:16:38 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/17 06:25:00 | 000,001,230 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/17 06:25:00 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At7.job
[2010/12/17 06:24:54 | 000,000,292 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1007.job
[2010/12/17 06:24:54 | 000,000,274 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/17 06:24:53 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/17 06:24:53 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-500.job
[2010/12/17 06:17:52 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At6.job
[2010/12/17 06:17:52 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2010/12/17 06:17:48 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/17 06:17:46 | 258,527,232 | -HS- | M] () – C:\hiberfil.sys
[2010/12/17 03:44:17 | 000,403,384 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/12/17 03:44:17 | 000,063,782 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At5.job
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2010/12/17 03:40:10 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2010/12/17 03:40:00 | 000,114,176 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/17 03:16:22 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/12/17 02:28:35 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/16 12:19:45 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At9.job
[2010/12/16 12:19:45 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At8.job
[2010/12/15 23:36:31 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2010/12/15 22:41:30 | 000,008,192 | —- | M] () – C:\WINDOWS\REGLOCS.OLD
[2010/12/15 06:27:05 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/15 05:49:58 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2010/12/15 05:49:58 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2010/12/15 05:49:58 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2010/12/15 05:49:58 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2010/12/15 05:49:58 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2010/12/15 05:33:56 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe
[2010/12/14 23:11:53 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/14 21:24:15 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2010/12/14 21:24:02 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2010/12/14 18:15:01 | 000,000,300 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1007.job
[2010/12/14 04:25:32 | 000,015,560 | —- | M] () – C:\WINDOWS\System32\333.js
[2010/12/14 02:57:28 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2010/12/13 20:26:44 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2010/12/13 20:01:32 | 013,063,352 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\mssefullinstall-x86fre-en-us-xp.exe
[2010/12/13 19:43:36 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2010/12/13 19:43:36 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2010/12/13 19:43:36 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2010/12/13 19:21:43 | 000,029,696 | —- | M] () – C:\Normal.dot
[2010/12/13 19:10:34 | 000,426,903 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/13 15:25:19 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2010/12/13 12:24:51 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/13 10:59:00 | 000,000,734 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20101213-191034.backup
[2010/12/13 09:16:13 | 000,025,600 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\https.doc
[2010/12/13 09:15:57 | 000,000,302 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-500.job
[2010/11/30 19:43:44 | 001,660,789 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\nuvi750-GPS-Atl_OwnersManual.pdf
[2010/11/18 10:12:44 | 000,081,920 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\isign32.dll
[2010/11/18 10:12:44 | 000,081,920 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isign32.dll
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/17 02:28:37 | 000,000,296 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/17 02:28:34 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/16 06:48:30 | 000,005,773 | R— | C] () – C:\WINDOWS\System32\WIAUISTR.loc
[2010/12/16 06:48:29 | 000,081,920 | R— | C] () – C:\WINDOWS\System32\WIAEH.dll
[2010/12/16 06:48:29 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\WIAIPH.dll
[2010/12/16 06:48:29 | 000,053,315 | R— | C] () – C:\WINDOWS\System32\Sswiadrv.dll
[2010/12/16 06:48:29 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\WIASTIIO.dll
[2010/12/16 06:46:19 | 000,024,576 | —- | C] () – C:\WINDOWS\SvcCon.exe
[2010/12/15 22:41:30 | 000,008,192 | —- | C] () – C:\WINDOWS\REGLOCS.OLD
[2010/12/14 22:21:08 | 000,000,274 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/14 22:21:04 | 000,000,282 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/14 02:57:30 | 000,001,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/12/14 02:57:30 | 000,001,421 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Panasonic Hand Writing.lnk
[2010/12/13 21:13:06 | 258,527,232 | -HS- | C] () – C:\hiberfil.sys
[2010/12/13 19:21:42 | 000,029,696 | —- | C] () – C:\Normal.dot
[2010/12/13 12:25:10 | 000,015,560 | —- | C] () – C:\WINDOWS\System32\333.js
[2010/12/13 09:38:00 | 001,660,789 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\nuvi750-GPS-Atl_OwnersManual.pdf
[2010/12/13 09:31:07 | 000,000,276 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/13 09:30:57 | 000,000,284 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/13 09:18:19 | 000,000,779 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/13 09:18:19 | 000,000,079 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/12/13 09:16:12 | 000,025,600 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\https.doc
[2010/12/08 22:04:49 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/08 17:23:19 | 000,000,294 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-500.job
[2010/12/08 01:25:37 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At24.job
[2010/12/08 01:25:36 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At23.job
[2010/12/08 01:25:36 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At22.job
[2010/12/08 01:25:36 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At21.job
[2010/12/08 01:25:36 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At20.job
[2010/12/08 01:25:36 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At19.job
[2010/12/08 01:25:36 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At18.job
[2010/12/08 01:25:35 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At17.job
[2010/12/08 01:25:34 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At16.job
[2010/12/08 01:25:34 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At15.job
[2010/12/08 01:25:33 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At14.job
[2010/12/08 01:25:33 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At13.job
[2010/12/08 01:25:33 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At12.job
[2010/12/08 01:25:32 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At9.job
[2010/12/08 01:25:32 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At8.job
[2010/12/08 01:25:32 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At7.job
[2010/12/08 01:25:32 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At6.job
[2010/12/08 01:25:32 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At11.job
[2010/12/08 01:25:32 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At10.job
[2010/12/08 01:25:31 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At5.job
[2010/12/08 01:25:31 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At4.job
[2010/12/08 01:25:31 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At3.job
[2010/12/08 01:25:30 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At2.job
[2010/12/08 01:25:29 | 000,000,392 | —- | C] () – C:\WINDOWS\tasks\At1.job
[2010/10/22 14:38:54 | 000,000,372 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/10/21 23:54:08 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/10/10 02:38:35 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2010/10/09 08:19:00 | 000,257,536 | —- | C] () – C:\WINDOWS\System32\biimg.dll
[2010/10/09 08:19:00 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\bieresnt.dll
[2004/05/06 16:32:44 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/04/06 12:04:29 | 000,000,711 | —- | C] () – C:\WINDOWS\chgdisp.ini
[2004/04/06 12:00:42 | 000,000,072 | —- | C] () – C:\WINDOWS\AcrobatSetupStatus.ini
[2004/04/06 11:48:03 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/04/06 11:46:00 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/06 11:37:58 | 000,000,052 | —- | C] () – C:\WINDOWS\DMIVIEW.INI
[2004/04/06 03:52:13 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/04/06 02:26:57 | 000,003,767 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/04/17 11:35:00 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2003/04/17 11:35:00 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll

< End of report >

Conspire

Post #19December 18, 2010, 2:32 AM UTC

Hi,

Go to My Computer-> Tools-> Folder Options-> View tab:

Under the Hidden files and folders heading:
Select - Show hidden files and folders.
Uncheck- Hide protected operating system files (recommended) option.
Also, make sure there is no checkmark beside Hide file extensions for known file types.
Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
jotti.org
VirScan
Virus Total

click on Browse, and upload the following file for analysis:
C:\WINDOWS\System32\333.js

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

===================================================

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
```
:Files
C:\WINDOWS\tasks\At*.job

:Commands
[emptyflash]
[emptytemp]
[Reboot]
```
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

===================================================

On your next reply please post :
File scanner report
OTL fix log
Fresh OTL log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Tiki_Dood

Post #20December 21, 2010, 3:13 AM UTC

[external image: Posted Image]

Fix Log

All processes killed
========== FILES ==========
C:\WINDOWS\tasks\At1.job moved successfully.
C:\WINDOWS\tasks\At10.job moved successfully.
C:\WINDOWS\tasks\At11.job moved successfully.
C:\WINDOWS\tasks\At12.job moved successfully.
C:\WINDOWS\tasks\At13.job moved successfully.
C:\WINDOWS\tasks\At14.job moved successfully.
C:\WINDOWS\tasks\At15.job moved successfully.
C:\WINDOWS\tasks\At16.job moved successfully.
C:\WINDOWS\tasks\At17.job moved successfully.
C:\WINDOWS\tasks\At18.job moved successfully.
C:\WINDOWS\tasks\At19.job moved successfully.
C:\WINDOWS\tasks\At2.job moved successfully.
C:\WINDOWS\tasks\At20.job moved successfully.
C:\WINDOWS\tasks\At21.job moved successfully.
C:\WINDOWS\tasks\At22.job moved successfully.
C:\WINDOWS\tasks\At23.job moved successfully.
C:\WINDOWS\tasks\At24.job moved successfully.
C:\WINDOWS\tasks\At3.job moved successfully.
C:\WINDOWS\tasks\At4.job moved successfully.
C:\WINDOWS\tasks\At5.job moved successfully.
C:\WINDOWS\tasks\At6.job moved successfully.
C:\WINDOWS\tasks\At7.job moved successfully.
C:\WINDOWS\tasks\At8.job moved successfully.
C:\WINDOWS\tasks\At9.job moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: C-1 WPD Patrol
->Flash cache emptied: 60260 bytes

User: Default User
->Flash cache emptied: 56504 bytes

User: LocalService
->Flash cache emptied: 8081 bytes

User: NetworkService
->Flash cache emptied: 15915 bytes

User: Tony
->Flash cache emptied: 56504 bytes

User: Tony.USER-05BGTB89GT
->Flash cache emptied: 58853 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: Administrator

User: All Users

User: C-1 WPD Patrol
->Temp folder emptied: 42116117 bytes
->Temporary Internet Files folder emptied: 203651032 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 174826308 bytes
->Java cache emptied: 12 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 61006786 bytes
->Temporary Internet Files folder emptied: 154992950 bytes
->Flash cache emptied: 0 bytes

User: Tony
->Temp folder emptied: 3356 bytes
->Temporary Internet Files folder emptied: 102779 bytes
->Flash cache emptied: 0 bytes

User: Tony.USER-05BGTB89GT
->Temp folder emptied: 40789899 bytes
->Temporary Internet Files folder emptied: 163475731 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 39097 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25752758 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 48795312 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 108006 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 873.00 mb

OTL by OldTimer - Version 3.2.17.3 log created on 12202010_184001

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\C-1 WPD Patrol\Local Settings\Temp\Temporary Internet Files\Content.IE5\9WUNBYV7\data=LtgX-e3f8ctI3U5dJtbt7EJ1ZfRneYme,__2CTCCAh_R9Mw8ooIP0_9yBu9EUm2FdwLcAQqORXQDEwx4ZSOZH
iAvQ7IsR2cUkO8JWq3DYIlRppf5_hPaQEx-Z_GKmt4d9pfAR5plZKTl3a-R28A[1].gif not found!
File\Folder C:\Documents and Settings\C-1 WPD Patrol\Local Settings\Temp\Temporary Internet Files\Content.IE5\3ZS8V1FQ\T0laaGAUWNwXy1xPkWGxx3jmgjY5yhh2ys1USQTLiJiv-VN-HYfooWd_VoYZLmPpClhcx2divAd3jzN8DK5NJGqOlIEzQ9peteObmEMRMHtG2jKPDVDIXqEx_1gAzOfc
lkpXEl5FcV8NYDhrB8Cwya16NDZwSVUjPj-3WPRP2Q[1].gif not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\SZ8GFQ19\data=LtgX-e3f8ctI3U5dJtbt7EJ1ZfRneYme,YYuDoFXaYdpUot3Dm9VeAExqbomZwuM7mclb_jatAXacCHqZexeF
0tb5OL0ikhhs3QrTwvmNKIiH36-yekSAaipKuYURNFN9YHdESWh7WARtaibr9g[1].gif not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\SZ8GFQ19\et=ns;u=,ns-59352586_1292328510,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=207652;contx=Miscellaneous;dc=d;btg=;ord=4440619910534605[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\SZ8GFQ19\torials;net=ns;u=,ns-13267821_1292328368,11d08818ec0d18e,Miscellaneous,;;kw=;tile=2;sz=300x250,300x60
0;net=ns;ord1=818007;contx=Miscellaneous;dc=w;btg=;ord=1343092828991020[1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\SZ8GFQ19\torials;net=ns;u=,ns-78107778_1292327961,11d08818ec0d18e,Miscellaneous,;;kw=;tile=2;sz=300x250,300x60
0;net=ns;ord1=931872;contx=Miscellaneous;dc=d;btg=;ord=5757492118250017[1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\MSTHHHDP\et=ns;u=,ns-68937719_1292328229,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=142871;contx=Miscellaneous;dc=w;btg=;ord=6368790351923221[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\LI6SRUHT\et=ns;u=,ns-37369380_1292328490,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=789860;contx=Miscellaneous;dc=d;btg=;ord=6585021896470211[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\LI6SRUHT\et=ns;u=,ns-41958618_1292328107,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=597649;contx=Miscellaneous;dc=d;btg=;ord=6954839863990898[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\LI6SRUHT\et=ns;u=,ns-68025038_1292327986,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=823662;contx=Miscellaneous;dc=d;btg=;ord=6079228283844256[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\LI6SRUHT\et=ns;u=,ns-74493293_1292328496,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=363022;contx=Miscellaneous;dc=d;btg=;ord=4455924649444662[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\LI6SRUHT\et=ns;u=,ns-91648018_1292328480,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=959858;contx=Miscellaneous;dc=d;btg=;ord=9571962244807160[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\Temporary Internet Files\Content.IE5\4U46YXRZ\et=ns;u=,ns-91019711_1292328528,11d08818ec0d18e,Miscellaneous,;;ppos=btf;kw=;tile=2;sz=300x2
50,336x280;net=ns;ord1=796620;contx=Miscellaneous;dc=d;btg=;ord=3195817030987766[
1] not found!
File\Folder C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temp\fla7B.tmp not found!
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\ZRRJMGAV\2b38b9b523cd0e336ae967e805472b47c2fa6f57[1].htm moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\ZRRJMGAV\ads[5].htm moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\X86HSTJC\ads[2].htm moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\X86HSTJC\like[1].htm moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\X86HSTJC\Newsnow_20101220_A_93338[1].mp4 moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\VKDHD05Y\index[1].htm moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\Content.IE5\KWF6IFK6\iframe[1].htm moved successfully.
C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot…

OTL Scan Log

OTL logfile created on: 12/20/2010 6:56:15 PM - Run 3
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

246.00 Mb Total Physical Memory | 112.00 Mb Available Physical Memory | 45.00% Memory free
989.00 Mb Paging File | 749.00 Mb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 21.91 Gb Free Space | 58.81% Space Free | Partition Type: NTFS

Computer Name: USER-05BGTB89GT | User Name: Tony | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
PRC - C:\WINDOWS\system32\ZCfgSvc.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\1XConfig.exe (Intel)
PRC - C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
PRC - C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Panasonic\HotKey Appendix\hkeyapp.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\Program Files\Panasonic\WRITING\WRITING.EXE (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (S24EventMonitor) – C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) – C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (Netaapl) – C:\WINDOWS\system32\drivers\netaapl.sys (Apple Inc.)
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (brecal) – C:\Program Files\Panasonic\BRECAL\Brecal.sys (Matsushita Electric Industrial Co., Ltd.)
DRV - (w22n51) Intel® – C:\WINDOWS\system32\drivers\w22n51.sys (Intel® Corporation)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\system32\drivers\stac97.sys (SigmaTel, Inc.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (pcinfo) – C:\Program Files\Panasonic\PCINFO\PCINFO.sys (Matsushita Electric Industrial Co., Ltd.)
DRV - (HOTKEY) – C:\WINDOWS\system32\drivers\HOTKEY.SYS (Matsushita Electric Industrial Co.,Ltd.)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (FIDMOU) – C:\WINDOWS\system32\drivers\Fidmou.sys (Fujitsu Component Limited)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/12 00:40:05 | 000,000,000 | —D | M]

[2010/12/13 09:04:31 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/12/13 19:10:34 | 000,426,903 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14704 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [gemstrmw] C:\WINDOWS\System32\gemstrmw.exe (Gemplus)
O4 - HKLM..\Run: [Hotkey] C:\WINDOWS\system32\HKEYMAN.EXE (Matsushita Electric Industrial Co., Ltd.)
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [P3000x_S2P] C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe ()
O4 - HKLM..\Run: [Panasonic HotKey Manager] C:\Program Files\Panasonic\HotKey Appendix\HKEYAPP.EXE (Matsushita Electric Industrial Co., Ltd.)
O4 - HKLM..\Run: [PCinfo] C:\Program Files\Panasonic\PCINFO\SetDiag.exe (Matsushita Electric Industrial Co.,Ltd.)
O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe (Intel® Corporation)
O4 - HKLM..\Run: [PRunOnce] C:\util\prunonce\PRunOnce.exe (Matsushita Electric Industrial Co., Ltd)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Panasonic Hand Writing.lnk = C:\Program Files\Panasonic\WRITING\WRITING.EXE (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\Sebring: DllName - C:\WINDOWS\System32\LgNotify.dll - C:\WINDOWS\system32\LgNotify.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/04/06 10:59:45 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/20 18:40:02 | 000,000,000 | —D | C] – C:\_OTL
[2010/12/19 03:19:34 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2010/12/19 03:19:24 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2010/12/19 03:19:06 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2010/12/19 03:17:29 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2010/12/19 03:17:29 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2010/12/19 03:17:29 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2010/12/19 03:17:29 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2010/12/19 03:17:28 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2010/12/19 03:17:28 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2010/12/19 03:17:28 | 000,000,000 | —D | C] – C:\9666bec9dcf0a85bcceb549f62d3fe
[2010/12/17 06:07:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\CutePDF Writer
[2010/12/16 12:32:59 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/12/16 12:32:59 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/12/16 12:32:41 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/12/16 12:31:11 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2010/12/16 12:30:53 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010/12/16 12:30:52 | 002,189,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010/12/16 12:30:52 | 002,024,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010/12/16 12:30:51 | 002,066,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2010/12/16 12:25:46 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2010/12/16 12:01:32 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2010/12/16 12:01:32 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2010/12/16 07:43:56 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netapi32.dll
[2010/12/16 07:39:06 | 000,455,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010/12/16 07:33:08 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fontsub.dll
[2010/12/16 07:33:07 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\t2embed.dll
[2010/12/16 07:32:25 | 000,730,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2010/12/16 07:23:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\Fix'n Stuff
[2010/12/16 06:48:30 | 000,045,056 | R— | C] (Samsung Electronics) – C:\WINDOWS\System32\Ssuiext.dll
[2010/12/16 06:45:40 | 000,073,728 | R— | C] (Samsung Software Center) – C:\WINDOWS\wiainst.exe
[2010/12/16 06:23:10 | 000,151,552 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\VdSetup.Exe
[2010/12/16 06:23:10 | 000,053,248 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\VdSetup.dll
[2010/12/16 06:23:09 | 000,013,227 | —- | C] (Samsung Electronics.) – C:\WINDOWS\System32\DelR1LMK.DLL
[2010/12/16 06:22:59 | 000,143,360 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\SSCoinst.exe
[2010/12/16 06:22:59 | 000,135,168 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\SVSetup.Exe
[2010/12/16 06:22:59 | 000,057,344 | —- | C] (SEC) – C:\WINDOWS\System32\SSCoinst.dll
[2010/12/16 06:22:59 | 000,053,248 | —- | C] (Samsung Electronics Co., Ltd.) – C:\WINDOWS\System32\SVSetup.dll
[2010/12/16 06:22:47 | 000,065,536 | —- | C] (Samsung Electronics) – C:\WINDOWS\System32\ssdevm.dll
[2010/12/16 06:22:47 | 000,049,152 | —- | C] (Samsung Electronics) – C:\WINDOWS\System32\ssusbpn.dll
[2010/12/16 06:22:11 | 000,000,000 | —D | C] – C:\Program Files\DELL
[2010/12/16 06:18:52 | 000,000,000 | —D | C] – C:\Dell
[2010/12/16 05:58:56 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/12/15 06:43:45 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe
[2010/12/15 06:43:10 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/14 21:49:41 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
[2010/12/14 04:14:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/12/13 20:01:12 | 013,063,352 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\mssefullinstall-x86fre-en-us-xp.exe
[2010/12/13 12:24:49 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2010/12/13 10:59:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Malwarebytes
[2010/12/13 10:40:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\ApplicationHistory
[2010/12/13 10:28:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Security
[2010/12/13 10:05:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My Videos
[2010/12/13 09:43:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Adobe
[2010/12/13 09:41:58 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/12/13 09:39:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Employment Related Documents
[2010/12/13 09:39:07 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/12/13 09:39:07 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/12/13 09:39:06 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/12/13 09:39:06 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/12/13 09:39:05 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/12/13 09:27:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Sun
[2010/12/13 09:20:59 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\IECompatCache
[2010/12/13 09:20:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Adobe
[2010/12/13 09:20:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Apple Computer
[2010/12/13 09:20:21 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\PrivacIE
[2010/12/13 09:20:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Apple Computer
[2010/12/13 09:19:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Real
[2010/12/13 09:18:35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\IETldCache
[2010/12/13 09:18:21 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings
[2010/12/13 09:18:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Local Settings\Application Data\Microsoft
[2010/12/13 09:18:17 | 000,000,000 | –SD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Microsoft
[2010/12/13 09:18:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\SendTo
[2010/12/13 09:18:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Recent
[2010/12/13 09:18:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Start Menu
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My Pictures
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My Music
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents
[2010/12/13 09:18:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Favorites
[2010/12/13 09:18:17 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Cookies
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\WLANProfiles
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Templates
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\PrintHood
[2010/12/13 09:18:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\NetHood
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\My eBooks
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Macromedia
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\InterTrust
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Identities
[2010/12/13 09:18:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop
[2010/12/13 09:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2010/12/13 08:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe(3)
[2010/12/10 18:28:07 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/12/10 18:05:33 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun(3)
[2010/12/09 13:40:13 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2010/12/09 09:35:23 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Real
[2010/12/09 09:33:51 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe(2)
[2010/12/09 08:47:18 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/12/09 05:27:41 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/09 05:27:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/12/08 22:04:19 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/12/08 19:06:03 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun(2)
[2010/12/08 17:15:32 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe(2)
[2010/12/08 16:40:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/12/08 16:40:15 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/08 01:48:40 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/12/08 01:48:36 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe

========== Files - Modified Within 30 Days ==========

[2010/12/20 18:59:38 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/20 18:59:36 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/20 18:52:07 | 000,001,230 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/20 18:51:50 | 000,000,292 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1007.job
[2010/12/20 18:51:49 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/20 18:51:49 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-500.job
[2010/12/20 18:51:49 | 000,000,274 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/20 18:50:20 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/20 18:50:19 | 258,527,232 | -HS- | M] () – C:\hiberfil.sys
[2010/12/20 18:37:32 | 000,070,298 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\Scan.png
[2010/12/20 09:15:02 | 000,000,302 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-500.job
[2010/12/20 05:16:02 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/20 03:27:20 | 000,443,444 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/12/20 03:27:20 | 000,072,498 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/12/19 04:49:52 | 000,117,360 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/18 06:30:17 | 079,105,860 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Swingers.mp4
[2010/12/18 06:19:40 | 039,059,106 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Bi Sex.mp4
[2010/12/17 03:16:49 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/12/15 23:36:31 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2010/12/15 22:41:30 | 000,008,192 | —- | M] () – C:\WINDOWS\REGLOCS.OLD
[2010/12/15 06:27:05 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/15 05:33:56 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\OTL.exe
[2010/12/14 23:11:53 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/14 18:15:01 | 000,000,300 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1007.job
[2010/12/14 04:25:32 | 000,015,560 | —- | M] () – C:\WINDOWS\System32\333.js
[2010/12/14 02:57:28 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2010/12/13 20:01:32 | 013,063,352 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\mssefullinstall-x86fre-en-us-xp.exe
[2010/12/13 19:21:43 | 000,029,696 | —- | M] () – C:\Normal.dot
[2010/12/13 19:10:34 | 000,426,903 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/13 12:24:51 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/13 10:59:00 | 000,000,734 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20101213-191034.backup
[2010/12/13 09:16:13 | 000,025,600 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\https.doc
[2010/11/30 19:43:44 | 001,660,789 | —- | M] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\nuvi750-GPS-Atl_OwnersManual.pdf

========== Files Created - No Company Name ==========

[2010/12/20 18:37:32 | 000,070,298 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\Desktop\Scan.png
[2010/12/18 06:03:26 | 039,059,106 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Bi Sex.mp4
[2010/12/18 05:56:12 | 079,105,860 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\Swingers.mp4
[2010/12/17 02:28:37 | 000,000,296 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/17 02:28:34 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1010.job
[2010/12/16 06:48:30 | 000,005,773 | R— | C] () – C:\WINDOWS\System32\WIAUISTR.loc
[2010/12/16 06:48:29 | 000,081,920 | R— | C] () – C:\WINDOWS\System32\WIAEH.dll
[2010/12/16 06:48:29 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\WIAIPH.dll
[2010/12/16 06:48:29 | 000,053,315 | R— | C] () – C:\WINDOWS\System32\Sswiadrv.dll
[2010/12/16 06:48:29 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\WIASTIIO.dll
[2010/12/16 06:46:19 | 000,024,576 | —- | C] () – C:\WINDOWS\SvcCon.exe
[2010/12/15 22:41:30 | 000,008,192 | —- | C] () – C:\WINDOWS\REGLOCS.OLD
[2010/12/14 22:21:08 | 000,000,274 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/14 22:21:04 | 000,000,282 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1008.job
[2010/12/14 02:57:30 | 000,001,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/12/14 02:57:30 | 000,001,421 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Panasonic Hand Writing.lnk
[2010/12/13 21:13:06 | 258,527,232 | -HS- | C] () – C:\hiberfil.sys
[2010/12/13 19:21:42 | 000,029,696 | —- | C] () – C:\Normal.dot
[2010/12/13 12:25:10 | 000,015,560 | —- | C] () – C:\WINDOWS\System32\333.js
[2010/12/13 09:38:00 | 001,660,789 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\nuvi750-GPS-Atl_OwnersManual.pdf
[2010/12/13 09:31:07 | 000,000,276 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/13 09:30:57 | 000,000,284 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3567374001-2965300985-4089366920-1009.job
[2010/12/13 09:18:19 | 000,000,779 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/13 09:18:19 | 000,000,079 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/12/13 09:16:12 | 000,025,600 | —- | C] () – C:\Documents and Settings\Tony.USER-05BGTB89GT\My Documents\https.doc
[2010/12/08 22:04:49 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/08 17:23:19 | 000,000,294 | —- | C] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3567374001-2965300985-4089366920-500.job
[2010/10/22 14:38:54 | 000,000,372 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/10/21 23:54:08 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/10/10 02:38:35 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2010/10/09 08:19:00 | 000,257,536 | —- | C] () – C:\WINDOWS\System32\biimg.dll
[2010/10/09 08:19:00 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\bieresnt.dll
[2004/05/06 16:32:44 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/04/06 12:04:29 | 000,000,711 | —- | C] () – C:\WINDOWS\chgdisp.ini
[2004/04/06 12:00:42 | 000,000,072 | —- | C] () – C:\WINDOWS\AcrobatSetupStatus.ini
[2004/04/06 11:48:03 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/04/06 11:46:00 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/06 11:37:58 | 000,000,052 | —- | C] () – C:\WINDOWS\DMIVIEW.INI
[2004/04/06 03:52:13 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/04/06 02:26:57 | 000,003,767 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/04/17 11:35:00 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2003/04/17 11:35:00 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll

< End of report >

Conspire

Post #21December 21, 2010, 8:39 AM UTC

Hi,

Looking good! One final check

Re-run Malwarebytes' Anti-Malware

Double-click MalwareBytes' (Note to Vista users, please right-click and select Run as Administrator.)
- Go to Update tab to update Malwarebytes' Anti-Malware
Then click Check for Updates.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please copy and paste the log back into your next reply

Note:

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Or via the Logs tab when Malwarebytes' Anti-Malware is started.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

===================================================

On your next reply please post :
MBAM log
ESET report

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Tiki_Dood

Post #22December 22, 2010, 5:06 AM UTC

Malwarebytes' Anti-Malware 1.50 www.malwarebytes.org Database version: 5366 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 12/21/2010 7:52:23 AM mbam-log-2010-12-21 (07-52-23).txt Scan type: Quick scan Objects scanned: 170657 Time elapsed: 1 hour(s), 34 minute(s), 6 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————————– ESETScan C:\Documents and Settings\NetworkService\Application Data\Sun(3)\Java(2)\Deployment(2)\cache(2)\6(2).0\59(2)\72a437bb-6facc046 multiple threats C:\Documents and Settings\NetworkService\Application Data\Sun(3)\Java(2)\Deployment(2)\cache(2)\6(2).0\62(2)\588b6b3e-7579322c a variant of Java/TrojanDownloader.OpenStream.NAS trojan

Conspire

Post #23December 22, 2010, 1:41 PM UTC

Hi,

Go into the Control Panel and double-click the Java Icon.

Under Temporary Internet Files, click the Settings… button
Click the Delete Files button.
There are two options in the window to clear the cache - Leave both Checked
- Applications and Applets
- Trace and log files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

I'm pleased to let you know that your log is clean!

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

Go to Start > Programs > Accessories > System Tools and click "System Restore".
Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Then go to Start > Run and type: Cleanmgr
Click "OK".
Click the "More Options" Tab.
Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Here are some tips to reduce the potential for spyware infection in the future:

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Also, support is ending for some versions of Windows > http://windows.microsoft.com/en-us/w…ce-packs?os=xp

Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved.

oldman960

Post #24December 27, 2010, 8:22 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Possible Alureon.h Tojan?

✨ Ask AI

Ask AI