Spyware / Malware / Virus Removal

TR/Crypt.ZPACK.Gen

16 min read

Looking for the outcome? Ask AI

Dr. Chowbox Topic Starter

Post #1January 5, 2011, 2:24 PM UTC last edited January 5, 2011, 10:43 PM UTC

Hello my wise and talented friends, I need your help. My Avira is catching it but I am not able to quarentine it. It keeps popping up. My spybot and Malware Bytes are not seeing it. I tried to post my HiJack This log but was prevented because it's an outdated version and although I downloaded the updated version This virus is preventing me from installing it "The System Administrator Has Set Policies To Prevent This Installation" Where do we go from here? OK, I was able to INSTALL the updated version of HiJack This and OTL.

Attachments:

Dr. Chowbox

Post #2January 6, 2011, 6:20 PM UTC

Anything? Anyone? Is there more information needed?

oldman960

Post #3January 6, 2011, 6:55 PM UTC

Hi Dr. Chowbox, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

You appear to be running 2 antivirus programs. This will cause conflicts and less protection. What is the status of Norton (Symantec)? Is it current?

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Ensure all Firefox windows are closed.
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
When prompted to run the scan, click Yes.
GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O4 - HKLM..\Run: [Bxesigego] C:\WINDOWS\oregecaguhim.DLL ()
O4 - HKCU..\Run: [Qkigoxi] C:\WINDOWS\somlig.DLL (ArcSoft Inc.)
O4 - HKCU..\Run: [tnjpHMjVwEJfO.exe] C:\Documents and Settings\All Users.WINDOWS\Application Data\tnjpHMjVwEJfO.exe (Uint Corp)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

:Files
ipconfig /flushdns /c

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log log.

Next

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UnCheck the boxes beside LOP Check and Purity Check.
In the Extra Registry section change it to All
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

No need for a Hijackthis log this time.

Please post back with

Goorefix log
OTL fix log
Both new OTL logs

Please describe how thw computer is now.

Thanks

Dr. Chowbox

Post #4January 7, 2011, 1:26 PM UTC

No, The symantec is messed up. I tried to remove/uninstall it a long time ago but it left some kind of tail that we can't get rid of.

Here is my GooredFix log:

GooredFix by jpshortstuff (03.07.10.1)
Log created at 07:52 on 07/01/2011 (help desk)
Firefox version 3.6.13 (en-US)

========== GooredScan ==========

(none)
Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{23D1159E-DC62-48EE-8C57-8C932FBE2A25} -> Success!
Deleting C:\Documents and Settings\help desk\Local Settings\Application Data\{23D1159E-DC62-48EE-8C57-8C932FBE2A25} -> Success!

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [18:59 06/09/2006]
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [14:27 01/12/2008]
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [21:45 05/03/2010]
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [12:59 22/03/2010]

C:\Documents and Settings\help desk\Application Data\Mozilla\Firefox\Profiles\1mop2ata.default\extensions\
(none)

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [21:44 05/03/2010]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [11:40 23/07/2010]

-=E.O.F=-

And this is my OTL FIX log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Bxesigego deleted successfully.
C:\WINDOWS\oregecaguhim.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Qkigoxi deleted successfully.
C:\WINDOWS\somlig.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\tnjpHMjVwEJfO.exe deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\tnjpHMjVwEJfO.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\help desk\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\help desk\My Documents\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
Unable to start service SrService!

[EMPTYTEMP]

User: Administrator.GEORGE01
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: All Users.WINDOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 12118713 bytes
->Flash cache emptied: 41620 bytes

User: evon
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: help desk
->Temp folder emptied: 1142590 bytes
->Temporary Internet Files folder emptied: 63863 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 56257632 bytes
->Flash cache emptied: 47331 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Owner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 268 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3242504 bytes
%systemroot%\System32 .tmp files removed: 183377 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 284678 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 70.00 mb

OTL by OldTimer - Version 3.2.20.1 log created on 01072011_075740

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

NEW OTL log:

OTL logfile created on: 1/7/2011 8:15:10 AM - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\help desk\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.08 Gb Total Space | 4.25 Gb Free Space | 22.30% Space Free | Partition Type: NTFS

Computer Name: HELPDESK | User Name: help desk | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\help desk\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\Crypserv.exe (Kenonic Controls Ltd.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\help desk\My Documents\Downloads\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccPwdSvc) – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (Crypkey License) – C:\WINDOWS\System32\Crypserv.exe (Kenonic Controls Ltd.)

========== Driver Services (SafeList) ==========

DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MSHUSBVideo) – C:\WINDOWS\system32\drivers\nx6000.sys (Microsoft Corporation)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (AW_HOST) – C:\WINDOWS\system32\drivers\AW_HOST5.sys (Symantec Corporation)
DRV - (awlegacy) – C:\WINDOWS\System32\Drivers\awlegacy.sys (Symantec Corporation)
DRV - (awecho) – C:\WINDOWS\system32\drivers\awechomd.sys (Symantec Corporation)
DRV - (Gernuwa) – C:\WINDOWS\System32\drivers\GERNUWA.sys (Symantec Corporation)
DRV - (hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (A3AB) D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB) – C:\WINDOWS\system32\drivers\A3AB.sys (D-Link Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (NetworkX) – C:\WINDOWS\system32\ckldrv.sys ()
DRV - (DM9102) DAVICOM 9102(A) – C:\WINDOWS\system32\drivers\DM9PCI5.SYS (CNet Technology, Inc. )
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.BAK (Adaptec)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/15 11:19:31 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/13 11:51:18 | 000,000,000 | —D | M]

[2010/01/29 18:02:10 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\help desk\Application Data\Mozilla\Extensions
[2010/11/12 14:15:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\help desk\Application Data\Mozilla\Firefox\Profiles\1mop2ata.default\extensions
[2011/01/06 10:05:38 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/03/05 16:44:37 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/04/02 13:34:30 | 001,283,584 | —- | M] (Cartesian Products, Inc. For more information, visit http://www.cartesianinc.com) – C:\Program Files\Mozilla Firefox\plugins\NPCPC32.dll

O1 HOSTS File: ([2011/01/04 13:12:09 | 000,427,830 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14756 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [Qkigoxi] C:\WINDOWS\somlig.DLL File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} http://download.games.yahoo.com/games/web_…nx.1.0.0.55.cab (CPlayFirstTriJinxControl Object)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Value error.)
O16 - DPF: {4A026B12-94F3-4D2F-A468-96AA55DE20A5} http://192.168.1.102/img/NetCamPlayerWeb11g.ocx (NetCamPlayerWeb11g Control)
O16 - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} http://download.tvants.com/pub/tvants/tvan…TvantsSetup.EXE (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1229728026359 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} http://download.games.yahoo.com/games/web_…loadControl.cab (DVCDownloadControl)
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} http://download.games.yahoo.com/games/web_…itched/main.cab (BewitchedGameClass Control)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\System32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O20 - Winlogon\Notify\PCANotify: DllName - PCANotify.dll - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\help desk\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\help desk\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/03/27 14:19:04 | 000,000,050 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2002/03/25 15:59:02 | 000,000,043 | —- | M] () - C:\AUTOEXEC.QB – [ NTFS ]
O33 - MountPoints2\{059dc3a4-01f7-11de-aea1-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{059dc3a4-01f7-11de-aea1-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{2d16d038-465a-11df-aec1-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{2d16d038-465a-11df-aec1-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell\AutoRun\command - "" = E:\TL-Bootstrap.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/07 07:57:40 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/07 07:52:02 | 000,000,000 | —D | C] – C:\Documents and Settings\help desk\Desktop\GooredFix Backups
[2011/01/05 15:26:25 | 000,000,000 | RH-D | C] – C:\Documents and Settings\help desk\Recent
[2011/01/05 08:05:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\HijackThis
[2006/03/18 21:03:22 | 000,032,768 | —- | C] ( ) – C:\WINDOWS\System32\ShellLnk.dll

========== Files - Modified Within 30 Days ==========

[2011/01/07 08:00:47 | 000,013,668 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/07 07:59:59 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/07 07:56:20 | 000,000,120 | —- | M] () – C:\WINDOWS\Anofebewa.dat
[2011/01/07 07:56:20 | 000,000,000 | —- | M] () – C:\WINDOWS\Dgekama.bin
[2011/01/06 10:06:19 | 000,000,185 | —- | M] () – C:\WINDOWS\hpbafd.ini
[2011/01/05 20:38:24 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/01/05 08:05:42 | 000,001,734 | —- | M] () – C:\Documents and Settings\help desk\Desktop\HijackThis.lnk
[2011/01/05 07:17:28 | 000,017,408 | —- | M] () – C:\Documents and Settings\help desk\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/04 13:12:09 | 000,427,830 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/01/04 10:51:39 | 000,427,830 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20110104-131209.backup
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/20 06:52:50 | 000,135,096 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/12/13 18:44:26 | 000,024,576 | —- | M] () – C:\Documents and Settings\help desk\My Documents\Laurel RFQ.doc
[2010/12/08 13:39:36 | 000,001,090 | —- | M] () – C:\WINDOWS\Brpfx04a.ini

========== Files Created - No Company Name ==========

[2011/01/05 08:05:42 | 000,001,734 | —- | C] () – C:\Documents and Settings\help desk\Desktop\HijackThis.lnk
[2011/01/04 10:13:06 | 000,000,120 | —- | C] () – C:\WINDOWS\Anofebewa.dat
[2011/01/04 10:13:06 | 000,000,000 | —- | C] () – C:\WINDOWS\Dgekama.bin
[2010/12/13 18:44:26 | 000,024,576 | —- | C] () – C:\Documents and Settings\help desk\My Documents\Laurel RFQ.doc
[2010/10/20 16:00:17 | 000,000,077 | —- | C] () – C:\Documents and Settings\help desk\Application Data\Rim.Desktop.Exception.log
[2010/10/20 15:57:13 | 000,000,759 | —- | C] () – C:\Documents and Settings\help desk\Application Data\Rim.Desktop.HttpServerSetup.log
[2008/12/02 08:59:33 | 000,000,446 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/05/23 08:11:33 | 000,017,408 | —- | C] () – C:\Documents and Settings\help desk\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/21 13:28:44 | 000,000,067 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/11/12 08:31:18 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/11/12 08:31:16 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/11/12 08:27:52 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/03/12 14:51:48 | 000,000,185 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2007/02/09 11:56:25 | 000,000,057 | —- | C] () – C:\WINDOWS\Crypkey.ini
[2007/02/09 11:56:16 | 000,029,414 | —- | C] () – C:\WINDOWS\System32\Ckldrv.sys
[2007/02/09 11:56:16 | 000,018,432 | —- | C] () – C:\WINDOWS\Setup_ck.dll
[2007/01/15 12:31:37 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2006/11/20 10:57:46 | 000,000,000 | —- | C] () – C:\WINDOWS\eDrawingOfficeAutomator.INI
[2006/06/08 09:01:39 | 000,007,279 | —- | C] () – C:\WINDOWS\hpdj5700.ini
[2006/06/08 09:01:08 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/12/21 16:57:36 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\nsldap32v50.dll
[2005/12/21 16:57:04 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\nsldappr32v50.dll
[2005/12/21 16:54:34 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\nsldapssl32v50.dll
[2005/05/19 11:12:03 | 000,000,049 | —- | C] () – C:\WINDOWS\opt_2460.ini
[2005/05/19 07:23:59 | 000,000,055 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2005/05/19 07:08:14 | 000,001,090 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2005/05/19 07:08:14 | 000,000,426 | —- | C] () – C:\WINDOWS\brwmark.ini
[2005/05/19 07:08:14 | 000,000,153 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2005/05/19 07:08:14 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2005/05/19 07:07:25 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2005/01/11 12:15:21 | 000,000,066 | —- | C] () – C:\WINDOWS\BLSDATA.INI
[2005/01/10 19:24:28 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2004/12/21 09:40:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/07/29 13:55:57 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\LFKODAK.DLL
[2004/07/29 13:55:56 | 000,338,944 | —- | C] () – C:\WINDOWS\System32\lffpx7.dll
[2004/07/29 13:55:56 | 000,017,920 | —- | C] () – C:\WINDOWS\System32\IMPLODE.DLL
[2004/05/20 14:37:16 | 000,000,007 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\DirectCDUserName.txt
[2004/05/20 13:09:25 | 000,000,062 | —- | C] () – C:\WINDOWS\tcw.ini
[2004/05/20 08:46:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/04 10:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll
[2000/01/07 08:15:51 | 000,280,064 | —- | C] () – C:\WINDOWS\System32\CNCS232.DLL
[1997/06/25 14:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\regobj.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:CF778051
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:679ABA25

< End of report >

OTL Extras log:

OTL Extras logfile created on: 1/7/2011 8:15:10 AM - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\help desk\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.08 Gb Total Space | 4.25 Gb Free Space | 22.30% Space Free | Partition Type: NTFS

Computer Name: HELPDESK | User Name: help desk | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (All) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – C:\WINDOWS\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] – C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\WINDOWS\System32\mshta.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.inf [@ = inffile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)
.js [@ = JSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.reg [@ = regfile] – C:\WINDOWS\regedit.exe (Microsoft Corporation)
.txt [@ = txtfile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – winhlp32.exe %1 (Microsoft Corporation)
hlpfile [open] – %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
inffile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – rundll32.exe C:\WINDOWS\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
jsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
vbsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wsffile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
wsffile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
wsffile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wshfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"4481:TCP" = 4481:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software music sync service data transfer
"4481:UDP" = 4481:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software music sync service discovery
"4482:TCP" = 4482:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software music sync service data transfer
"4482:UDP" = 4482:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software music sync service discovery

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\TVAnts\Tvants.exe" = C:\Program Files\TVAnts\Tvants.exe:*:Disabled:TVAnts – File not found
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\WINDOWS\system32\ftp.exe" = C:\WINDOWS\system32\ftp.exe:*:Enabled:File Transfer Program – (Microsoft Corporation)
"C:\Program Files\FileZilla Server\FileZilla server.exe" = C:\Program Files\FileZilla Server\FileZilla server.exe:*:Enabled:FileZilla server.exe – File not found
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager – File not found
"C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe" = C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe:*:Enabled:BlackBerry Desktop Software – (Research In Motion)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 17
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{BF2B125A-358E-448B-86B0-6429935464BA}" = FileOpen Plug-in for Adobe Acrobat® and Acrobat Reader®
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D25F26E6-7F37-4580-9E83-2BDD9BE9E0CE}" = BlackBerry Desktop Software 6.0
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"2003 SAE Fluid Conductors and Connectors Standards" = 2003 SAE Fluid Conductors and Connectors Standards
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.0
"CCleaner" = CCleaner (remove only)
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"Free Registry Defrag_is1" = Free Registry Defrag
"HijackThis" = HijackThis 2.0.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"The E2 Shop System 7.1" = The E2 Shop System 7.1
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime

========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 1/5/2011 9:47:56 PM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7000
Description = The ASCTRM service failed to start due to the following error: %%2

Error - 1/5/2011 9:47:56 PM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7000
Description = The Aspi32 service failed to start due to the following error: %%2

Error - 1/7/2011 8:57:41 AM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7034
Description = The Crypkey License service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/7/2011 8:57:41 AM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/7/2011 8:57:42 AM | Computer Name = HELPDESK | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 1/7/2011 8:57:42 AM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 1/7/2011 9:00:29 AM | Computer Name = HELPDESK | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 1/7/2011 9:00:32 AM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7000
Description = The ASCTRM service failed to start due to the following error: %%2

Error - 1/7/2011 9:00:32 AM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7000
Description = The Aspi32 service failed to start due to the following error: %%2

Error - 1/7/2011 9:00:32 AM | Computer Name = HELPDESK | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

< End of report >

As far as the way it's running, Avira hasn't popped up anything. Seems to be in order.

oldman960

Post #5January 7, 2011, 8:34 PM UTC last edited January 7, 2011, 8:35 PM UTC

Hi Dr. Chowbox,

Let's tidy things up a bit and see if we can get the rest of Norton removed for you.

First check to make sure System Restore is enabled.

Please

Click Start, right-click My Computer, and then click Properties
In the System Properties dialog box, click the System Restore tab
Make sure there isn't a check mark in the Turn off System Restore check box. Or, the Turn off System Restore on all drives check box
If there is click to clear the Turn off System Restore check box. Or, click the Turn off System Restore on all drives check box
Click OK

After a few moments, the System Properties dialog box will close. Please wait for it to close as it is creating a restore point.

Your java is out of date. Click your start button, open Control panel.

Locate the Java icon (it looks like a coffee cup)
double click it to open it
click the Update tab
Click update now

After the java is updated, reboot your computer if not prompted to.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O4 - HKCU..\Run: [Qkigoxi] C:\WINDOWS\somlig.DLL File not found
2011/01/04 10:13:06 | 000,000,120 | —- | C] () – C:\WINDOWS\Anofebewa.dat
[2011/01/04 10:13:06 | 000,000,000 | —- | C] () – C:\WINDOWS\Dgekama.bin

:Commands
[emptytemp]
[createrestorepoint]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTLfix log

Next
Download the Norton Removal Tool from HERE and save it to your desktop.

Next Double click on Norton_Removal_Tool.exe to run the tool.

Follow the on-screen instructions.
Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.

Next

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt, no Extras.Txt this time.

Please post back with

OTL fix log
new OTL.txt

Computer still ok?

Thanks

Dr. Chowbox

Post #6January 7, 2011, 10:02 PM UTC

Hi, First problem I ran into was while trying to update JAVA, a notice popped up WINDOWS INSTALLER The System Administrator Has Set Policies To Prevent This Installation. Then I decided to RESTART the computer and another notice popped up upon restart RUNDLL Error Loading C:\WINDOWS\Somlig.dll This Specified Module Could Not Be Found I had restarted to see if my JAVA would now take the update and the same notice popped up. So I didn't go forward with any scans/fixes yet.

Dr. Chowbox

Post #7January 10, 2011, 2:49 PM UTC

Waiting on your instructions. Thanks

oldman960

Post #8January 10, 2011, 5:25 PM UTC

Hi Dr. Chowbox, Sorry I didn't recieve notification that you had replied. Leave the java for now and continue with the rest of the instructions. Thanks

Dr. Chowbox

Post #9January 10, 2011, 10:00 PM UTC

Computer has been running well. Thank you.

Norton ran through the Removal cleanly.

Here are the logs,

OLT FIX:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Qkigoxi deleted successfully.
C:\WINDOWS\Dgekama.bin moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator.GEORGE01
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: All Users.WINDOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: evon
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: help desk
->Temp folder emptied: 1348735 bytes
->Temporary Internet Files folder emptied: 287179 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 42014378 bytes
->Flash cache emptied: 659 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Owner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 42.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.20.1 log created on 01102011_161007

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

OTL:

OTL logfile created on: 1/10/2011 4:36:12 PM - Run 3
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\help desk\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.08 Gb Total Space | 4.09 Gb Free Space | 21.44% Space Free | Partition Type: NTFS

Computer Name: HELPDESK | User Name: help desk | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\help desk\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\Crypserv.exe (Kenonic Controls Ltd.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\help desk\My Documents\Downloads\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Crypkey License) – C:\WINDOWS\System32\Crypserv.exe (Kenonic Controls Ltd.)

========== Driver Services (SafeList) ==========

DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MSHUSBVideo) – C:\WINDOWS\system32\drivers\nx6000.sys (Microsoft Corporation)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (AW_HOST) – C:\WINDOWS\system32\drivers\AW_HOST5.sys (Symantec Corporation)
DRV - (awlegacy) – C:\WINDOWS\System32\Drivers\awlegacy.sys (Symantec Corporation)
DRV - (awecho) – C:\WINDOWS\system32\drivers\awechomd.sys (Symantec Corporation)
DRV - (Gernuwa) – C:\WINDOWS\System32\drivers\GERNUWA.sys (Symantec Corporation)
DRV - (hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (A3AB) D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB) – C:\WINDOWS\system32\drivers\A3AB.sys (D-Link Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (NetworkX) – C:\WINDOWS\system32\ckldrv.sys ()
DRV - (DM9102) DAVICOM 9102(A) – C:\WINDOWS\system32\drivers\DM9PCI5.SYS (CNet Technology, Inc. )
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.BAK (Adaptec)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/15 11:19:31 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/13 11:51:18 | 000,000,000 | —D | M]

[2010/01/29 18:02:10 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\help desk\Application Data\Mozilla\Extensions
[2010/11/12 14:15:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\help desk\Application Data\Mozilla\Firefox\Profiles\1mop2ata.default\extensions
[2011/01/10 09:36:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/03/05 16:44:37 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/04/02 13:34:30 | 001,283,584 | —- | M] (Cartesian Products, Inc. For more information, visit http://www.cartesianinc.com) – C:\Program Files\Mozilla Firefox\plugins\NPCPC32.dll

O1 HOSTS File: ([2011/01/04 13:12:09 | 000,427,830 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14756 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} http://download.games.yahoo.com/games/web_…nx.1.0.0.55.cab (CPlayFirstTriJinxControl Object)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Value error.)
O16 - DPF: {4A026B12-94F3-4D2F-A468-96AA55DE20A5} http://192.168.1.102/img/NetCamPlayerWeb11g.ocx (NetCamPlayerWeb11g Control)
O16 - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} http://download.tvants.com/pub/tvants/tvan…TvantsSetup.EXE (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1229728026359 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} http://download.games.yahoo.com/games/web_…loadControl.cab (DVCDownloadControl)
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} http://download.games.yahoo.com/games/web_…itched/main.cab (BewitchedGameClass Control)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\System32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O20 - Winlogon\Notify\PCANotify: DllName - PCANotify.dll - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\help desk\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\help desk\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/03/27 14:19:04 | 000,000,050 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2002/03/25 15:59:02 | 000,000,043 | —- | M] () - C:\AUTOEXEC.QB – [ NTFS ]
O33 - MountPoints2\{059dc3a4-01f7-11de-aea1-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{059dc3a4-01f7-11de-aea1-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{2d16d038-465a-11df-aec1-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{2d16d038-465a-11df-aec1-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell\AutoRun\command - "" = E:\TL-Bootstrap.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/07 16:48:51 | 000,000,000 | RH-D | C] – C:\Documents and Settings\help desk\Recent
[2011/01/07 07:57:40 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/07 07:52:02 | 000,000,000 | —D | C] – C:\Documents and Settings\help desk\Desktop\GooredFix Backups
[2011/01/05 08:05:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\HijackThis
[2006/03/18 21:03:22 | 000,032,768 | —- | C] ( ) – C:\WINDOWS\System32\ShellLnk.dll

========== Files - Modified Within 30 Days ==========

[2011/01/10 16:35:45 | 000,000,369 | —- | M] () – C:\WINDOWS\hpbafd.ini
[2011/01/10 16:30:22 | 000,013,668 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/10 16:29:09 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/07 16:53:13 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/01/07 07:56:20 | 000,000,120 | —- | M] () – C:\WINDOWS\Anofebewa.dat
[2011/01/05 08:05:42 | 000,001,734 | —- | M] () – C:\Documents and Settings\help desk\Desktop\HijackThis.lnk
[2011/01/05 07:17:28 | 000,017,408 | —- | M] () – C:\Documents and Settings\help desk\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/04 13:12:09 | 000,427,830 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/01/04 10:51:39 | 000,427,830 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20110104-131209.backup
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/20 06:52:50 | 000,135,096 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/12/13 18:44:26 | 000,024,576 | —- | M] () – C:\Documents and Settings\help desk\My Documents\Laurel RFQ.doc

========== Files Created - No Company Name ==========

[2011/01/05 08:05:42 | 000,001,734 | —- | C] () – C:\Documents and Settings\help desk\Desktop\HijackThis.lnk
[2011/01/04 10:13:06 | 000,000,120 | —- | C] () – C:\WINDOWS\Anofebewa.dat
[2010/12/13 18:44:26 | 000,024,576 | —- | C] () – C:\Documents and Settings\help desk\My Documents\Laurel RFQ.doc
[2010/10/20 16:00:17 | 000,000,077 | —- | C] () – C:\Documents and Settings\help desk\Application Data\Rim.Desktop.Exception.log
[2010/10/20 15:57:13 | 000,000,759 | —- | C] () – C:\Documents and Settings\help desk\Application Data\Rim.Desktop.HttpServerSetup.log
[2008/12/02 08:59:33 | 000,000,446 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/05/23 08:11:33 | 000,017,408 | —- | C] () – C:\Documents and Settings\help desk\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/21 13:28:44 | 000,000,067 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/11/12 08:31:18 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/11/12 08:31:16 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/11/12 08:27:52 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/03/12 14:51:48 | 000,000,369 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2007/02/09 11:56:25 | 000,000,057 | —- | C] () – C:\WINDOWS\Crypkey.ini
[2007/02/09 11:56:16 | 000,029,414 | —- | C] () – C:\WINDOWS\System32\Ckldrv.sys
[2007/02/09 11:56:16 | 000,018,432 | —- | C] () – C:\WINDOWS\Setup_ck.dll
[2007/01/15 12:31:37 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2006/11/20 10:57:46 | 000,000,000 | —- | C] () – C:\WINDOWS\eDrawingOfficeAutomator.INI
[2006/06/08 09:01:39 | 000,007,279 | —- | C] () – C:\WINDOWS\hpdj5700.ini
[2006/06/08 09:01:08 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/12/21 16:57:36 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\nsldap32v50.dll
[2005/12/21 16:57:04 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\nsldappr32v50.dll
[2005/12/21 16:54:34 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\nsldapssl32v50.dll
[2005/05/19 11:12:03 | 000,000,049 | —- | C] () – C:\WINDOWS\opt_2460.ini
[2005/05/19 07:23:59 | 000,000,055 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2005/05/19 07:08:14 | 000,001,090 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2005/05/19 07:08:14 | 000,000,426 | —- | C] () – C:\WINDOWS\brwmark.ini
[2005/05/19 07:08:14 | 000,000,153 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2005/05/19 07:08:14 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2005/05/19 07:07:25 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2005/01/11 12:15:21 | 000,000,066 | —- | C] () – C:\WINDOWS\BLSDATA.INI
[2005/01/10 19:24:28 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2004/12/21 09:40:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/07/29 13:55:57 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\LFKODAK.DLL
[2004/07/29 13:55:56 | 000,338,944 | —- | C] () – C:\WINDOWS\System32\lffpx7.dll
[2004/07/29 13:55:56 | 000,017,920 | —- | C] () – C:\WINDOWS\System32\IMPLODE.DLL
[2004/05/20 14:37:16 | 000,000,007 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\DirectCDUserName.txt
[2004/05/20 13:09:25 | 000,000,062 | —- | C] () – C:\WINDOWS\tcw.ini
[2004/05/20 08:46:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/04 10:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll
[2000/01/07 08:15:51 | 000,280,064 | —- | C] () – C:\WINDOWS\System32\CNCS232.DLL
[1997/06/25 14:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\regobj.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:CF778051
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:679ABA25

< End of report >

oldman960

Post #10January 11, 2011, 9:20 AM UTC last edited January 11, 2011, 10:05 AM UTC

Hi Dr. Chowbox,

Looks pretty good, some stray Norton that we will get to. First let's see if we can find out what's going on with with Windows Installer.

Next

Please open OTL

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, click the None button near the top (it may looked greyed out)
In the window under Custom Scans/Fixes copy and paste the following

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer /s
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer /s
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

Thanks

Dr. Chowbox

Post #11January 11, 2011, 1:18 PM UTC

OTL log:

OTL logfile created on: 1/11/2011 8:16:33 AM - Run 4
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\help desk\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 71.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.08 Gb Total Space | 4.08 Gb Free Space | 21.39% Space Free | Partition Type: NTFS

Computer Name: HELPDESK | User Name: help desk | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer /s >
"EnableAdminTSRemote" = 1
"LimitSystemRestoreCheckpointing" = 1
"DisableMSI" = 2

< HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer /s >

< End of report >

oldman960

Post #12January 11, 2011, 6:54 PM UTC last edited January 13, 2011, 7:52 PM UTC

Hi Dr. Chowbox,

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
DRV - (awlegacy) – C:\WINDOWS\System32\Drivers\awlegacy.sys (Symantec Corporation)
DRV - (awecho) – C:\WINDOWS\system32\drivers\awechomd.sys (Symantec Corporation)
DRV - (Gernuwa) – C:\WINDOWS\System32\drivers\GERNUWA.sys (Symantec Corporation)

:reg
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer]
"LimitSystemRestoreCheckpointing"=dword:00000000
"DisableMSI"=dword:00000000

:Files
C:\WINDOWS\Anofebewa.dat

:Commands
[createrestorepoint]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log log.

Next

Try updating java again.

Click your start button, open Control panel.

Locate the Java icon (it looks like a coffee cup)
double click it to open it
click the Update tab
Click update now

If you were able to update the java please continue.

Next, clear the java cache

Still in Control Panel.

Double-click the Java icon in the control panel.
On the General tab, Click Settings under Temporary Internet Files.
On the Temporary Files Settings screen, Click Delete Files.
check all boxes
Click OK

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

OTL fix log
MBAM log

Thanks

Dr. Chowbox

Post #13January 11, 2011, 11:15 PM UTC

I like the way it's running. No problems so far. How's it look to you? OTL FIX LOG: ========== SERVICES/DRIVERS ========== ========== OTL ========== Error: Unable to stop service awlegacy! Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\awlegacy deleted successfully. C:\WINDOWS\system32\drivers\AWLEGACY.sys moved successfully. Error: Unable to stop service awecho! Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\awecho deleted successfully. C:\WINDOWS\system32\drivers\awechomd.sys moved successfully. Service Gernuwa stopped successfully! Service Gernuwa deleted successfully! C:\WINDOWS\system32\drivers\GERNUWA.sys moved successfully. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer\\"LimitSystemRestoreCheckpointing"|dword:00000000 /E : value set successfully! HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer\\"DisableMSI"|dword:00000000 /E : value set successfully! ========== FILES ========== C:\WINDOWS\Anofebewa.dat moved successfully. ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) OTL by OldTimer - Version 3.2.20.1 log created on 01112011_173044 MBAM LOG: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5505 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 1/11/2011 5:54:12 PM mbam-log-2011-01-11 (17-54-12).txt Scan type: Quick scan Objects scanned: 199752 Time elapsed: 8 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

oldman960

Post #14January 12, 2011, 9:37 AM UTC last edited January 12, 2011, 9:38 AM UTC

Hi Dr. Chowbox,

Looks good so far.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or Firefox for this scan. If you use Firefox you will be asked to install an aditional component, please allow this)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
Re-enable your Antivirus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.

After the ESET scan is complete.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad windows. OTL.Txt

Please post back with

ESET log
OTL.txt

If all looks well we'll clean up the tools and send you on your way after you post back.

Thanks

Dr. Chowbox

Post #15January 12, 2011, 9:49 PM UTC

Hello Wise One,

Here the logs.

ESET:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=57e2cef197772346ac8f905cf694f46f
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-01-12 03:20:10
# local_time=2011-01-12 10:20:10 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 64573021 64573021 0 0
# compatibility_mode=1797 16775141 100 93 0 31245253 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=73829
# found=5
# cleaned=0
# scan_time=3875
C:\burn4free_setup.exe probably a variant of Win32/Agent.NWJXFXO trojan (unable to clean) 00000000000000000000000000000000 I
C:\WINNT\NDNuninstall4_80.exe probably a variant of Win32/Agent.BVCDDQS trojan (unable to clean) 00000000000000000000000000000000 I
C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll Win32/Adware.Toolbar.Yahoo.A application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\01072011_075740\C_WINDOWS\oregecaguhim.dll a variant of Win32/Cimag.FO trojan (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\01072011_075740\C_WINDOWS\somlig.dll a variant of Win32/Kryptik.JJY trojan (unable to clean) 00000000000000000000000000000000 I

OTL:

OTL logfile created on: 1/12/2011 10:31:58 AM - Run 5
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\help desk\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.08 Gb Total Space | 3.82 Gb Free Space | 20.02% Space Free | Partition Type: NTFS

Computer Name: HELPDESK | User Name: help desk | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\help desk\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\Crypserv.exe (Kenonic Controls Ltd.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\help desk\My Documents\Downloads\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Crypkey License) – C:\WINDOWS\System32\Crypserv.exe (Kenonic Controls Ltd.)

========== Driver Services (SafeList) ==========

DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MSHUSBVideo) – C:\WINDOWS\system32\drivers\nx6000.sys (Microsoft Corporation)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (AW_HOST) – C:\WINDOWS\system32\drivers\AW_HOST5.sys (Symantec Corporation)
DRV - (hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (A3AB) D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB) – C:\WINDOWS\system32\drivers\A3AB.sys (D-Link Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (NetworkX) – C:\WINDOWS\system32\ckldrv.sys ()
DRV - (DM9102) DAVICOM 9102(A) – C:\WINDOWS\system32\drivers\DM9PCI5.SYS (CNet Technology, Inc. )
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.BAK (Adaptec)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/15 11:19:31 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/11 17:42:00 | 000,000,000 | —D | M]

[2010/01/29 18:02:10 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\help desk\Application Data\Mozilla\Extensions
[2010/11/12 14:15:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\help desk\Application Data\Mozilla\Firefox\Profiles\1mop2ata.default\extensions
[2011/01/11 17:56:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/01/11 17:42:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/03/05 16:44:37 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/04/02 13:34:30 | 001,283,584 | —- | M] (Cartesian Products, Inc. For more information, visit http://www.cartesianinc.com) – C:\Program Files\Mozilla Firefox\plugins\NPCPC32.dll
[2010/11/12 18:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/01/04 13:12:09 | 000,427,830 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14756 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} http://download.games.yahoo.com/games/web_…nx.1.0.0.55.cab (CPlayFirstTriJinxControl Object)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Value error.)
O16 - DPF: {4A026B12-94F3-4D2F-A468-96AA55DE20A5} http://192.168.1.102/img/NetCamPlayerWeb11g.ocx (NetCamPlayerWeb11g Control)
O16 - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} http://download.tvants.com/pub/tvants/tvan…TvantsSetup.EXE (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1229728026359 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} http://download.games.yahoo.com/games/web_…loadControl.cab (DVCDownloadControl)
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} http://download.games.yahoo.com/games/web_…itched/main.cab (BewitchedGameClass Control)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\System32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O20 - Winlogon\Notify\PCANotify: DllName - PCANotify.dll - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\help desk\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\help desk\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/03/27 14:19:04 | 000,000,050 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2002/03/25 15:59:02 | 000,000,043 | —- | M] () - C:\AUTOEXEC.QB – [ NTFS ]
O33 - MountPoints2\{059dc3a4-01f7-11de-aea1-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{059dc3a4-01f7-11de-aea1-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{2d16d038-465a-11df-aec1-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{2d16d038-465a-11df-aec1-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell - "" = AutoRun
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{eb161377-aec9-11df-aed6-000347dc3672}\Shell\AutoRun\command - "" = E:\TL-Bootstrap.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/12 09:09:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/11 17:42:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Sun
[2011/01/11 17:41:59 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2011/01/11 17:41:59 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/01/11 17:41:59 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/01/11 17:41:59 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/01/07 16:48:51 | 000,000,000 | RH-D | C] – C:\Documents and Settings\help desk\Recent
[2011/01/07 07:57:40 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/07 07:52:02 | 000,000,000 | —D | C] – C:\Documents and Settings\help desk\Desktop\GooredFix Backups
[2011/01/05 08:05:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\HijackThis
[2006/03/18 21:03:22 | 000,032,768 | —- | C] ( ) – C:\WINDOWS\System32\ShellLnk.dll

========== Files - Modified Within 30 Days ==========

[2011/01/12 09:01:42 | 000,000,198 | —- | M] () – C:\WINDOWS\hpbafd.ini
[2011/01/11 17:44:40 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/01/11 17:36:23 | 000,013,668 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/11 17:34:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/05 08:05:42 | 000,001,734 | —- | M] () – C:\Documents and Settings\help desk\Desktop\HijackThis.lnk
[2011/01/05 07:17:28 | 000,017,408 | —- | M] () – C:\Documents and Settings\help desk\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/04 13:12:09 | 000,427,830 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/01/04 10:51:39 | 000,427,830 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20110104-131209.backup
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/20 06:52:50 | 000,135,096 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2010/12/13 18:44:26 | 000,024,576 | —- | M] () – C:\Documents and Settings\help desk\My Documents\Laurel RFQ.doc

========== Files Created - No Company Name ==========

[2011/01/05 08:05:42 | 000,001,734 | —- | C] () – C:\Documents and Settings\help desk\Desktop\HijackThis.lnk
[2010/12/13 18:44:26 | 000,024,576 | —- | C] () – C:\Documents and Settings\help desk\My Documents\Laurel RFQ.doc
[2010/10/20 16:00:17 | 000,000,077 | —- | C] () – C:\Documents and Settings\help desk\Application Data\Rim.Desktop.Exception.log
[2010/10/20 15:57:13 | 000,000,759 | —- | C] () – C:\Documents and Settings\help desk\Application Data\Rim.Desktop.HttpServerSetup.log
[2008/12/02 08:59:33 | 000,000,446 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/05/23 08:11:33 | 000,017,408 | —- | C] () – C:\Documents and Settings\help desk\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/21 13:28:44 | 000,000,067 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/11/12 08:31:18 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/11/12 08:31:16 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/11/12 08:27:52 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/03/12 14:51:48 | 000,000,198 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2007/02/09 11:56:25 | 000,000,057 | —- | C] () – C:\WINDOWS\Crypkey.ini
[2007/02/09 11:56:16 | 000,029,414 | —- | C] () – C:\WINDOWS\System32\Ckldrv.sys
[2007/02/09 11:56:16 | 000,018,432 | —- | C] () – C:\WINDOWS\Setup_ck.dll
[2007/01/15 12:31:37 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2006/11/20 10:57:46 | 000,000,000 | —- | C] () – C:\WINDOWS\eDrawingOfficeAutomator.INI
[2006/06/08 09:01:39 | 000,007,279 | —- | C] () – C:\WINDOWS\hpdj5700.ini
[2006/06/08 09:01:08 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/12/21 16:57:36 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\nsldap32v50.dll
[2005/12/21 16:57:04 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\nsldappr32v50.dll
[2005/12/21 16:54:34 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\nsldapssl32v50.dll
[2005/05/19 11:12:03 | 000,000,049 | —- | C] () – C:\WINDOWS\opt_2460.ini
[2005/05/19 07:23:59 | 000,000,055 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2005/05/19 07:08:14 | 000,001,090 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2005/05/19 07:08:14 | 000,000,426 | —- | C] () – C:\WINDOWS\brwmark.ini
[2005/05/19 07:08:14 | 000,000,153 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2005/05/19 07:08:14 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2005/05/19 07:07:25 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2005/01/11 12:15:21 | 000,000,066 | —- | C] () – C:\WINDOWS\BLSDATA.INI
[2005/01/10 19:24:28 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2004/12/21 09:40:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/07/29 13:55:57 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\LFKODAK.DLL
[2004/07/29 13:55:56 | 000,338,944 | —- | C] () – C:\WINDOWS\System32\lffpx7.dll
[2004/07/29 13:55:56 | 000,017,920 | —- | C] () – C:\WINDOWS\System32\IMPLODE.DLL
[2004/05/20 14:37:16 | 000,000,007 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\DirectCDUserName.txt
[2004/05/20 13:09:25 | 000,000,062 | —- | C] () – C:\WINDOWS\tcw.ini
[2004/05/20 08:46:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/04 10:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll
[2000/01/07 08:15:51 | 000,280,064 | —- | C] () – C:\WINDOWS\System32\CNCS232.DLL
[1997/06/25 14:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\regobj.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:CF778051
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:679ABA25

< End of report >

Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

TR/Crypt.ZPACK.Gen

✨ Ask AI

Ask AI