What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Keylogger ?

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I know that the free 7 day trail of all in one keylogger v3.3 was installed onto this laptop but with 2 days left to purchase the licence it dissapeared. After reading about keyloggers online I opened the task manager and found csrss.exe and winlogon.exe in the processes, neither or which I can end. are these normal processes or am i infected with something? As you can probably tell i'm a real novice with this kind of thing.
these are the OTl scan results … I ran otl and got the otl and extra txt but i'd forgot to run as administrator so i ran it again as admin and only received the otl.txt.


OTL logfile created on: 26/1/2011 14:51:21 - Run 3
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\toshiba\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 0000041e | Country: ไทย | Language: THA | Date Format: d/M/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 55.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148.37 Gb Total Space | 117.22 Gb Free Space | 79.00% Space Free | Partition Type: NTFS
Drive D: | 149.44 Gb Total Space | 147.03 Gb Free Space | 98.39% Space Free | Partition Type: NTFS
Drive F: | 3.68 Gb Total Space | 3.45 Gb Free Space | 93.78% Space Free | Partition Type: FAT32

Computer Name: TOSHIBA-PC | User Name: toshiba | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/26 14:17:20 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\toshiba\Desktop\OTL.exe
PRC - [2011/01/08 10:35:52 | 000,991,800 | —- | M] (Google Inc.) – C:\Users\toshiba\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2010/10/18 06:43:20 | 000,134,808 | —- | M] (Google Inc.) – C:\Users\toshiba\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2009/10/31 12:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/09/03 15:06:32 | 000,304,496 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2009/08/10 19:55:46 | 000,185,712 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
PRC - [2009/08/07 04:47:46 | 000,354,640 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosHdpProc.exe
PRC - [2009/08/06 18:36:56 | 002,680,160 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2009/08/05 14:04:54 | 000,738,616 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
PRC - [2009/08/03 14:03:08 | 000,832,856 | —- | M] (TOSHIBA Corporation.) – C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
PRC - [2009/07/30 05:20:04 | 000,144,752 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2009/07/29 16:42:06 | 000,705,880 | —- | M] (TOSHIBA Corporation.) – C:\Program Files\TOSHIBA\HDMICtrlMan\HCMSoundChanger.exe
PRC - [2009/07/28 21:12:56 | 007,625,248 | —- | M] (Realtek Semiconductor) – C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
PRC - [2009/07/28 20:26:42 | 000,062,848 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/07/28 15:43:04 | 000,128,344 | —- | M] (TOSHIBA Corporation) – C:\Windows\System32\TODDSrv.exe
PRC - [2009/07/28 14:00:10 | 000,460,088 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
PRC - [2009/07/21 03:58:52 | 002,651,512 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe
PRC - [2009/07/14 08:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/07/14 08:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sppsvc.exe
PRC - [2009/07/06 18:44:22 | 000,341,320 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
PRC - [2009/06/07 22:34:58 | 000,660,808 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2009/06/02 23:33:14 | 000,308,552 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2009/04/24 11:40:38 | 000,176,128 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TECO\TecoService.exe
PRC - [2009/04/24 11:40:08 | 001,323,008 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TECO\TEco.exe
PRC - [2009/04/16 18:42:58 | 000,020,544 | —- | M] (TOSHIBA) – C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
PRC - [2009/04/11 00:29:08 | 000,037,888 | —- | M] () – C:\Program Files\Winamp\winampa.exe
PRC - [2009/04/03 02:17:42 | 000,447,816 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe
PRC - [2009/03/30 16:57:22 | 000,083,312 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2009/03/10 18:51:20 | 000,046,448 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2009/02/06 14:23:36 | 000,727,720 | —- | M] (ESET) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009/02/06 14:23:12 | 002,021,400 | —- | M] (ESET) – C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2009/01/26 15:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) – C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/07/23 19:24:24 | 000,083,272 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2008/07/16 19:13:42 | 000,184,320 | —- | M] () – C:\Program Files\EDGE CARD\EDGE MODEM\EdgeRun.exe
PRC - [2008/07/01 09:19:02 | 000,081,920 | —- | M] () – C:\Program Files\EDGE CARD\EDGE MODEM\EdgeRst.exe
PRC - [2007/03/12 13:49:46 | 001,209,904 | —- | M] (Nero AG) – C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/03/12 13:49:26 | 000,153,136 | —- | M] (Nero AG) – C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe


========== Modules (SafeList) ==========

MOD - [2011/01/26 14:17:20 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\toshiba\Desktop\OTL.exe
MOD - [2010/08/21 12:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/14 08:16:15 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sspicli.dll
MOD - [2009/07/14 08:16:13 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sechost.dll
MOD - [2009/07/14 08:16:13 | 000,050,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\samcli.dll
MOD - [2009/07/14 08:16:12 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\profapi.dll
MOD - [2009/07/14 08:16:03 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netutils.dll
MOD - [2009/07/14 08:15:35 | 000,288,256 | —- | M] (Microsoft Corporation) – C:\Windows\System32\KernelBase.dll
MOD - [2009/07/14 08:15:13 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dwmapi.dll
MOD - [2009/07/14 08:15:11 | 000,064,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\devobj.dll
MOD - [2009/07/14 08:15:07 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cryptbase.dll
MOD - [2009/07/14 08:15:02 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cfgmgr32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/02/24 18:08:05 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2009/08/17 10:48:42 | 000,051,512 | —- | M] (TOSHIBA Corporation) [On_Demand | Stopped] – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe – (TMachInfo)
SRV - [2009/08/10 19:55:46 | 000,185,712 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe – (cfWiMAXService)
SRV - [2009/07/30 05:20:04 | 000,144,752 | —- | M] (TOSHIBA CORPORATION) [On_Demand | Running] – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)
SRV - [2009/07/28 15:43:04 | 000,128,344 | —- | M] (TOSHIBA Corporation) [Auto | Running] – C:\Windows\System32\TODDSrv.exe – (TODDSrv)
SRV - [2009/07/14 08:16:21 | 000,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wwansvc.dll – (WwanSvc)
SRV - [2009/07/14 08:16:17 | 000,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbiosrvc.dll – (WbioSrvc)
SRV - [2009/07/14 08:16:17 | 000,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpo.dll – (Power)
SRV - [2009/07/14 08:16:16 | 000,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\themeservice.dll – (Themes)
SRV - [2009/07/14 08:16:15 | 000,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\sppuinotify.dll – (sppuinotify)
SRV - [2009/07/14 08:16:13 | 000,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\RpcEpMap.dll – (RpcEptMapper)
SRV - [2009/07/14 08:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/14 08:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/14 08:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpsvc.dll – (PNRPsvc)
SRV - [2009/07/14 08:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpsvc.dll – (p2pimsvc)
SRV - [2009/07/14 08:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/14 08:16:12 | 000,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpauto.dll – (PNRPAutoReg)
SRV - [2009/07/14 08:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/07/14 08:15:36 | 000,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\ListSvc.dll – (HomeGroupListener)
SRV - [2009/07/14 08:15:21 | 000,797,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2009/07/14 08:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dhcpcore.dll – (Dhcp)
SRV - [2009/07/14 08:15:10 | 000,218,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\defragsvc.dll – (defragsvc)
SRV - [2009/07/14 08:14:59 | 000,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\bdesvc.dll – (BDESVC)
SRV - [2009/07/14 08:14:58 | 000,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\AxInstSv.dll – (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/14 08:14:53 | 000,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\appidsvc.dll – (AppIDSvc)
SRV - [2009/07/14 08:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\sppsvc.exe – (sppsvc)
SRV - [2009/04/24 11:40:38 | 000,176,128 | —- | M] (TOSHIBA Corporation) [Auto | Running] – C:\Program Files\TOSHIBA\TECO\TecoService.exe – (TOSHIBA eco Utility Service)
SRV - [2009/04/16 18:42:58 | 000,020,544 | —- | M] (TOSHIBA) [Auto | Running] – C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe – (camsvc)
SRV - [2009/03/30 16:57:22 | 000,083,312 | —- | M] (TOSHIBA Corporation) [Auto | Running] – C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe – (TNaviSrv)
SRV - [2009/03/10 18:51:20 | 000,046,448 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe – (ConfigFree Service)
SRV - [2009/02/06 14:27:06 | 000,020,680 | —- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe – (EhttpSrv)
SRV - [2009/02/06 14:23:36 | 000,727,720 | —- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe – (ekrn)
SRV - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) [Auto | Running] – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe – (SBSDWSCService)


========== Driver Services (SafeList) ==========

DRV - [2009/12/11 14:44:02 | 000,133,720 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\ksecpkg.sys – (KSecPkg)
DRV - [2009/10/07 08:49:40 | 006,756,632 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lvuvc.sys – (LVUVC) Logitech QuickCam S5500(UVC)
DRV - [2009/10/07 08:47:56 | 000,266,008 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lvrs.sys – (LVRS)
DRV - [2009/08/05 19:04:04 | 000,171,520 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV - [2009/08/05 14:44:44 | 000,049,400 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfusb.sys – (Tosrfusb)
DRV - [2009/08/05 12:55:08 | 000,061,168 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TosRfSnd.sys – (TosRfSnd)
DRV - [2009/07/30 17:45:56 | 000,022,912 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tdcmdpst.sys – (tdcmdpst)
DRV - [2009/07/28 21:02:42 | 002,735,504 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RTKVHDA.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/07/28 20:01:26 | 000,069,480 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2009/07/24 11:31:58 | 000,021,608 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tosrfnds.sys – (tosrfnds)
DRV - [2009/07/14 15:28:42 | 000,023,512 | —- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\TVALZ_O.SYS – (TVALZ)
DRV - [2009/07/14 08:26:21 | 000,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\cmdide.sys – (cmdide)
DRV - [2009/07/14 08:26:17 | 000,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpahci.sys – (adpahci)
DRV - [2009/07/14 08:26:15 | 000,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adp94xx.sys – (adp94xx)
DRV - [2009/07/14 08:26:15 | 000,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsbs.sys – (amdsbs)
DRV - [2009/07/14 08:26:15 | 000,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpu320.sys – (adpu320)
DRV - [2009/07/14 08:26:15 | 000,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arcsas.sys – (arcsas)
DRV - [2009/07/14 08:26:15 | 000,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsata.sys – (amdsata)
DRV - [2009/07/14 08:26:15 | 000,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arc.sys – (arc)
DRV - [2009/07/14 08:26:15 | 000,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\amdxata.sys – (amdxata)
DRV - [2009/07/14 08:26:15 | 000,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\aliide.sys – (aliide)
DRV - [2009/07/14 08:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvstor.sys – (nvstor)
DRV - [2009/07/14 08:20:44 | 000,117,312 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvraid.sys – (nvraid)
DRV - [2009/07/14 08:20:44 | 000,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nfrd960.sys – (nfrd960)
DRV - [2009/07/14 08:20:37 | 000,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas.sys – (LSI_SAS)
DRV - [2009/07/14 08:20:36 | 000,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iaStorV.sys – (iaStorV)
DRV - [2009/07/14 08:20:36 | 000,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MegaSR.sys – (MegaSR)
DRV - [2009/07/14 08:20:36 | 000,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_scsi.sys – (LSI_SCSI)
DRV - [2009/07/14 08:20:36 | 000,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_fc.sys – (LSI_FC)
DRV - [2009/07/14 08:20:36 | 000,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas2.sys – (LSI_SAS2)
DRV - [2009/07/14 08:20:36 | 000,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iirsp.sys – (iirsp)
DRV - [2009/07/14 08:20:36 | 000,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\megasas.sys – (megasas)
DRV - [2009/07/14 08:20:36 | 000,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\hwpolicy.sys – (hwpolicy)
DRV - [2009/07/14 08:20:28 | 000,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\elxstor.sys – (elxstor)
DRV - [2009/07/14 08:20:28 | 000,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\djsvs.sys – (aic78xx)
DRV - [2009/07/14 08:20:28 | 000,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\HpSAMD.sys – (HpSAMD)
DRV - [2009/07/14 08:20:28 | 000,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\fsdepends.sys – (FsDepends)
DRV - [2009/07/14 08:19:11 | 000,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vsmraid.sys – (vsmraid)
DRV - [2009/07/14 08:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/14 08:19:10 | 000,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vhdmp.sys – (vhdmp)
DRV - [2009/07/14 08:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/14 08:19:10 | 000,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vdrvroot.sys – (vdrvroot)
DRV - [2009/07/14 08:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/14 08:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/14 08:19:10 | 000,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\viaide.sys – (viaide)
DRV - [2009/07/14 08:19:04 | 001,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql2300.sys – (ql2300)
DRV - [2009/07/14 08:19:04 | 000,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\rdyboost.sys – (rdyboost)
DRV - [2009/07/14 08:19:04 | 000,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql40xx.sys – (ql40xx)
DRV - [2009/07/14 08:19:04 | 000,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\sisraid4.sys – (SiSRaid4)
DRV - [2009/07/14 08:19:04 | 000,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pcw.sys – (pcw)
DRV - [2009/07/14 08:19:04 | 000,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\SiSRaid2.sys – (SiSRaid2)
DRV - [2009/07/14 08:19:04 | 000,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\stexstor.sys – (stexstor)
DRV - [2009/07/14 08:17:54 | 000,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\cng.sys – (CNG)
DRV - [2009/07/14 07:57:25 | 000,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\Brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/14 07:02:41 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rdpbus.sys – (rdpbus)
DRV - [2009/07/14 07:01:41 | 000,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPREFMP.sys – (RDPREFMP)
DRV - [2009/07/14 06:55:00 | 000,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/14 06:53:51 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\wfplwf.sys – (WfpLwf)
DRV - [2009/07/14 06:52:44 | 000,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ndiscap.sys – (NdisCap)
DRV - [2009/07/14 06:52:02 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\vwifibus.sys – (vwifibus)
DRV - [2009/07/14 06:52:00 | 000,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\1394ohci.sys – (1394ohci)
DRV - [2009/07/14 06:51:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\umpass.sys – (UmPass)
DRV - [2009/07/14 06:51:23 | 000,080,640 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2009/07/14 06:51:08 | 000,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mshidkmdf.sys – (mshidkmdf)
DRV - [2009/07/14 06:46:55 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MTConfig.sys – (MTConfig)
DRV - [2009/07/14 06:45:26 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CompositeBus.sys – (CompositeBus)
DRV - [2009/07/14 06:36:52 | 000,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\appid.sys – (AppID)
DRV - [2009/07/14 06:33:50 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] – C:\Windows\System32\drivers\scfilter.sys – (scfilter)
DRV - [2009/07/14 06:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/14 06:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/14 06:24:05 | 000,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\discache.sys – (discache)
DRV - [2009/07/14 06:16:36 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\acpipmi.sys – (AcpiPmi)
DRV - [2009/07/14 06:11:04 | 000,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdppm.sys – (AmdPPM)
DRV - [2009/07/14 05:54:14 | 000,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/14 05:53:33 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2009/07/14 05:53:33 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2009/07/14 05:53:32 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrSerWdm.sys – (BrSerWdm)
DRV - [2009/07/14 05:53:28 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltLo.sys – (BrFiltLo)
DRV - [2009/07/14 05:53:28 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltUp.sys – (BrFiltUp)
DRV - [2009/07/14 05:13:48 | 001,035,776 | —- | M] (LSI Corp) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2009/07/14 05:09:17 | 004,194,816 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2009/07/14 05:02:53 | 000,347,136 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RTL8187B.sys – (RTL8187B)
DRV - [2009/07/14 05:02:52 | 000,139,776 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Rt86win7.sys – (RTL8167)
DRV - [2009/07/14 05:02:51 | 004,231,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\netw5v32.sys – (netw5v32) Intel®
DRV - [2009/07/14 05:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2009/07/14 05:02:48 | 003,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\evbdx.sys – (ebdrv)
DRV - [2009/07/14 05:02:48 | 000,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\bxvbdx.sys – (b06bdrv)
DRV - [2009/07/13 22:13:10 | 000,015,216 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfec.sys – (tosrfec)
DRV - [2009/07/07 21:38:34 | 000,168,936 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbd.sys – (tosrfbd)
DRV - [2009/06/24 18:23:12 | 000,159,776 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\RtHDMIV.sys – (RTHDMIAzAudService)
DRV - [2009/06/19 09:57:20 | 000,079,872 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Tosrfhid.sys – (Tosrfhid)
DRV - [2009/06/19 09:56:48 | 000,042,472 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tosrfbnp.sys – (tosrfbnp)
DRV - [2009/06/17 11:59:46 | 000,046,984 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosporte.sys – (tosporte)
DRV - [2009/06/11 04:19:30 | 004,756,480 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2009/04/23 15:42:44 | 000,014,856 | —- | M] () [Kernel | System | Running] – C:\Windows\System32\drivers\PMCF.sys – (PMCF)
DRV - [2009/03/18 11:44:54 | 000,022,272 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\PGEffect.sys – (PGEffect)
DRV - [2009/02/06 14:24:26 | 000,092,800 | —- | M] (ESET) [Kernel | Auto | Running] – C:\Windows\System32\drivers\epfwwfpr.sys – (epfwwfpr)
DRV - [2009/02/06 14:23:18 | 000,106,208 | —- | M] (ESET) [Kernel | System | Running] – C:\Windows\System32\drivers\ehdrv.sys – (ehdrv)
DRV - [2009/02/06 14:19:52 | 000,113,448 | —- | M] (ESET) [File_System | Auto | Running] – C:\Windows\System32\drivers\eamon.sys – (eamon)
DRV - [2009/01/27 19:12:14 | 000,279,376 | —- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\tos_sps32.sys – (tos_sps32)
DRV - [2008/07/16 19:13:42 | 000,028,160 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbmdm.sys – (usbser)
DRV - [2006/11/19 23:11:14 | 000,007,168 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\FwLnk.sys – (FwLnk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=13170&l;=dis
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - HKLM\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010/07/22 17:21:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/08 13:54:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/08 13:54:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009/11/22 16:46:05 | 000,000,000 | —D | M]

[2009/12/30 20:25:55 | 000,000,000 | —D | M] (No name found) – C:\Users\toshiba\AppData\Roaming\Mozilla\Extensions
[2009/12/30 22:26:37 | 000,000,000 | —D | M] (No name found) – C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\g3x9t35j.default\extensions
[2010/10/11 20:36:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/10/11 20:36:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/11 20:36:10 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/11/08 13:54:09 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/11/08 13:54:09 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/11/08 13:54:09 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/11/08 13:54:09 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/01/26 02:34:10 | 000,428,727 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14759 more lines…
O2 - BHO: (revenuestreaming browser enhancer) - {081598D0-0B8D-6FCC-0647-C70E4ADFB284} - Reg Error: Value error. File not found
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [HDMICtrlMan] C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.)
O4 - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [lennkdepesdeypqxn] File not found
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TUSBSleepChargeSrv] C:\Program Files\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [TWebCamera] C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Wireless] C:\Program Files\EDGE CARD\EDGE MODEM\EdgeRst.exe ()
O4 - HKLM..\Run: [WirelessZeroTouch] C:\Program Files\EDGE CARD\EDGE MODEM\EdgeRun.exe ()
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 04:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{4112c98e-f518-11de-9a75-001e33d7f9e9}\Shell - "" = AutoRun
O33 - MountPoints2\{4112c98e-f518-11de-9a75-001e33d7f9e9}\Shell\AutoRun\command - "" = F:\Windows\CHECK\DriveNavigator.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: msacm.divxa32 - C:\Windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/01/26 14:16:46 | 000,602,624 | —- | C] (OldTimer Tools) – C:\Users\toshiba\Desktop\OTL.exe
[2011/01/26 01:37:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/01/26 01:37:21 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2011/01/26 01:37:21 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/01/26 01:27:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/01/26 01:27:29 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/01/26 00:58:56 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2011/01/26 00:58:43 | 000,212,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RICHTX32.OCX
[2011/01/26 00:58:43 | 000,124,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSWINSCK.OCX
[2011/01/25 23:47:53 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2011/01/25 23:46:21 | 000,000,000 | —D | C] – C:\Users\toshiba\AppData\Roaming\uTorrent
[2011/01/19 12:54:51 | 000,372,736 | —- | C] (Intel Corporation) – C:\Windows\System32\IJL_11.DLL
[2011/01/19 12:31:04 | 000,000,000 | —D | C] – C:\history
[2011/01/15 01:44:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2011/01/12 19:22:00 | 000,573,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbc32.dll
[2011/01/01 19:01:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameTop.com
[2011/01/01 19:01:26 | 000,000,000 | —D | C] – C:\Program Files\GameTop.com
[2011/01/01 11:48:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Mario World
[2011/01/01 11:10:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Softendo.com

========== Files - Modified Within 30 Days ==========

[2011/01/26 14:48:00 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1543904055-3440033713-1824406636-1000UA.job
[2011/01/26 14:25:31 | 000,014,416 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/26 14:25:31 | 000,014,416 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/26 14:24:00 | 000,000,874 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/26 14:17:20 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\toshiba\Desktop\OTL.exe
[2011/01/26 10:55:34 | 000,000,870 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/26 10:55:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/01/26 10:55:15 | 1610,305,536 | -HS- | M] () – C:\hiberfil.sys
[2011/01/26 02:34:10 | 000,428,727 | R— | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/01/26 01:37:26 | 000,001,220 | —- | M] () – C:\Users\toshiba\Desktop\Spybot - Search & Destroy.lnk
[2011/01/26 01:27:36 | 000,000,969 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/01/26 00:55:19 | 000,061,305 | —- | M] () – C:\Windows\System32\tnxktyxycsd.exe
[2011/01/25 11:09:08 | 000,030,720 | —- | M] () – C:\Users\toshiba\Desktop\Mark's Resume.doc
[2011/01/24 23:25:11 | 000,013,986 | —- | M] () – C:\Users\toshiba\Desktop\Mark's Resume.docx
[2011/01/14 11:50:44 | 000,002,373 | —- | M] () – C:\Users\toshiba\Desktop\Google Chrome.lnk
[2011/01/06 13:11:09 | 000,000,850 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1543904055-3440033713-1824406636-1000Core.job
[2011/01/01 19:01:30 | 000,001,225 | —- | M] () – C:\Users\toshiba\Desktop\Super Mario Forever.lnk

========== Files Created - No Company Name ==========

[2011/01/26 01:37:26 | 000,001,220 | —- | C] () – C:\Users\toshiba\Desktop\Spybot - Search & Destroy.lnk
[2011/01/26 01:27:36 | 000,000,969 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/01/26 00:55:19 | 000,061,305 | —- | C] () – C:\Windows\System32\tnxktyxycsd.exe
[2011/01/25 11:09:07 | 000,030,720 | —- | C] () – C:\Users\toshiba\Desktop\Mark's Resume.doc
[2011/01/24 21:03:00 | 000,013,986 | —- | C] () – C:\Users\toshiba\Desktop\Mark's Resume.docx
[2011/01/01 19:01:30 | 000,001,225 | —- | C] () – C:\Users\toshiba\Desktop\Super Mario Forever.lnk
[2010/02/15 12:45:53 | 000,135,168 | —- | C] () – C:\Windows\System32\msshcbo-d.dll
[2009/11/22 17:06:17 | 000,014,856 | —- | C] () – C:\Windows\System32\drivers\PMCF.sys
[2009/10/07 08:24:22 | 000,082,289 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2009/07/14 06:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 06:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/04/27 01:58:23 | 000,009,849 | —- | C] () – C:\Windows\System32\mswhnbo-e.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/11/22 17:03:55 | 000,006,129 | —- | M] () – C:\0x0409.ini
[2009/11/22 17:03:55 | 000,011,264 | —- | M] () – C:\1033.MST
[2009/06/11 04:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/06/11 04:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/01/26 10:55:15 | 1610,305,536 | -HS- | M] () – C:\hiberfil.sys
[2011/01/26 10:55:19 | 2147,078,144 | -HS- | M] () – C:\pagefile.sys
[2009/11/22 17:03:59 | 005,632,512 | —- | M] () – C:\Teco.msi

< %systemroot%\Fonts\*.com >
[2009/07/14 11:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 11:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 11:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 11:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 04:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 08:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/14 08:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 11:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/22 16:41:59 | 000,000,221 | -HS- | M] () – C:\Users\toshiba\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/01/26 14:17:20 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\toshiba\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-25 19:35:10

========== Alternate Data Streams ==========

@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:8927A071

< End of report >
Post #2
Hi mcfirth,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

uTorrent
You have uTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm


I would recommend that you uninstall uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Submit a file to VirusTotal for analysis
  • Use the browse button on that page to navigate to the location of the file to be scanned.
  • In the right hand panel,
  • click on the file C:\Windows\System32\tnxktyxycsd.exe
  • then click the open button.
  • The file will now be displayed in the submit box.
  • Scroll down a bit and click "send file", wait for the results
  • If you get a message saying File has already been analyzed: click Reanalyze file now
  • Once scanned, copy and paste the link to the results page in your next reply.
Post #4
mcfirth,

It never hurts to be a little paranoid when dealing with technology. ;)

That file smells hinky to me… but it scanned OK. Let's carry on.

Double click on OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Processes

:OTL
O2 - BHO: (revenuestreaming browser enhancer) - {081598D0-0B8D-6FCC-0647-C70E4ADFB284} - Reg Error: Value error. File not found
O4 - HKLM..\Run: [lennkdepesdeypqxn] File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL log.

Then,

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean

Then

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also please describe how your computer behaves at the moment.
Post #5
This is the otl you requested. I'll be back with the next stage soon. All processes killed ========== PROCESSES ========== ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{081598D0-0B8D-6FCC-0647-C70E4ADFB284}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{081598D0-0B8D-6FCC-0647-C70E4ADFB284}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\lennkdepesdeypqxn deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41044 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public User: toshiba ->Temp folder emptied: 2775937 bytes ->Temporary Internet Files folder emptied: 16834739 bytes ->Java cache emptied: 79009 bytes ->FireFox cache emptied: 39531388 bytes ->Google Chrome cache emptied: 178162947 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 48517 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 66016 bytes RecycleBin emptied: 30720 bytes Total Files Cleaned = 227.00 mb OTL by OldTimer - Version 3.2.20.6 log created on 01282011_033740 Files\Folders moved on Reboot… Registry entries deleted on Reboot…
Post #6
Hi TONK, The only connection option I have here with this laptop is through a mobile phone via Bluetooth so as far as internet running speed and connection stability are concerned, it's performing at it's blood pressure raising optimum(modem failure… turn phone off then on, restart laptop.. get connection….. lost connection RECONNECT? AARRGGH!!!) But just recently, the last 3 or 4 days i've been getting an error message while trying to connect something about adobe and adobe reader. It doesn't happen all the time maybe once every 4 connection attempts. The box doesn't stay long enough for me to read the exact error message but it's there long enough to see adobe and adobe reader in the title. Also when I try to restart or shutdown it tells me that a program in the background is preventing windows from closing, asks about forcing it even when I have nothing open or running. i've had a small error box while trying to shutdown that had lots of numbers in it and it wouldn't let me close the error box by clicking on okay(just made the dink, dink sound), I had to force shutdown, this hasn't happened for a few days though. i'm on the last stage now, see above about blood pressure as to why it's taking so long. (if you need anymore more expertise on the, what the tech team… consider this technical description as my c.v)
Post #8
Here is the malwarebytes log Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5623 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 28/1/2554 5:14:22 mbam-log-2554-01-28 (05-14-22).txt Scan type: Quick scan Objects scanned: 139403 Time elapsed: 3 minute(s), 24 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\$Recycle.Bin\s-1-5-21-1543904055-3440033713-1824406636-1000\$RIRA6Y2\CW.eXe (Hacktool.ChewWGA) -> Quarantined and deleted successfully. c:\Windows\System32\tnxktyxycsd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Post #9
Download the diagnostic tool MGADiag and save it to your desktop.

  • Double-click on MGADiag.exe.
  • Click Run.
  • Click Continue, then Copy.
  • Paste the report in your next reply.
Post #10
I followed the steps and copied at the end, I don't know where they were copied to though. Only thing I can find is a folder called MGAdiagTooloutput but the files inside are winrar. Could you please tell me exactly what you want me to paste, thanks.
Post #11
It should look something like this:

Diagnostic Report (1.9.0027.0):
—————————————–
Windows Validation Data–>

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-BJD6C-K3YVH-DVQJG
Windows Product Key Hash: WFqPPaNJ0hrc3E/8MgITJa2Xf0M=
Windows Product ID: 00359-OEM-8992687-00118
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {86FEE77C-3826-41AB-B614-C0F5CB5526A9}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7600.win7_gdr.100618-1621
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data–>
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data–>
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data–>
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data–>
Office Status: 103 Blocked VLK
Microsoft Office Enterprise 2007 - 103 Blocked VLK
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data–>
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data–>
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe


File Mismatch: C:\Windows\system32\wat\npwatweb.dll

File Mismatch: C:\Windows\system32\wat\watux.exe

File Mismatch: C:\Windows\system32\wat\watweb.dll

File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100

Other data–>
Office Details: {86FEE77C-3826-41AB-B614-C0F5CB5526A9}1.9.0027.06.1.7600.2.00010300.0.0.003x32*****-*****-*****-*****-DVQJG00359-OEM-8992687-001182S-1-5-21-4237152153-1231085273-1120153137System manufacturerSystem Product NameAmerican Megatrends Inc.0506 20090527000000.000000+00089BA3607018400F804090409Taipei Standard Time(GMT+08:00)03ACRSYSACRPRDCT103

Spsys.log Content: 0x80070002

Licensing Data–>
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426

Windows Activation Technologies–>
HrOffline: 0x00000000
HrOnline: 0x80072EE2
HealthStatus: 0x0000000000000000
Event Time Stamp: 2:24:2010 17:50
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data–>
HWID Hash Current: MAAAAAEABAABAAEAAAABAAAAAQABAAEAJJSwUAhQqnZI5B4dWv8W3pZe4lwcJUbK

OEM Activation 1.0 Data–>
N/A

OEM Activation 2.0 Data–>
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes


This program makes no changes so it is OK to run it again… then you can just highlight, copy, and paste the report.
Post #13
Cool… they've updated the program since the last time I've personally ran it.

When you click on copy… the information is copied to your clipboard. You won't see anything.

Start a reply here… right click in the reply window and select paste.
Post #14
Diagnostic Report (1.9.0027.0): —————————————– Windows Validation Data–> Validation Code: 0x8004FE22 Cached Online Validation Code: 0xc004c4ab Windows Product Key: *****-*****-GJY49-VJBQ7-HYRR2 Windows Product Key Hash: W5/6nm6F2UPXrCkY5xUhXb/+21g= Windows Product ID: 00426-OEM-8992662-00006 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 6.1.7600.2.00010100.0.0.001 ID: {29C73007-21C1-423E-B517-84DA8B715CDA}(3) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: N/A, hr = 0x80070002 Signed By: N/A, hr = 0x80070002 Product Name: Windows 7 Ultimate Architecture: 0x00000000 Build lab: 7600.win7_gdr.100618-1621 TTS Error: Validation Diagnostic: Resolution Status: N/A Vista WgaER Data–> ThreatID(s): N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 Windows XP Notifications Data–> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data–> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data–> Office Status: 103 Blocked VLK Microsoft Office Enterprise 2007 - 103 Blocked VLK OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3 Browser Data–> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Default Browser: C:\Users\toshiba\AppData\Local\Google\Chrome\Application\chrome.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data–> File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100 File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100 Other data–> Office Details: {29C73007-21C1-423E-B517-84DA8B715CDA}1.9.0027.06.1.7600.2.00010100.0.0.001x32*****-*****-*****-*****-HYRR200426-OEM-8992662-000062S-1-5-21-1543904055-3440033713-1824406636TOSHIBASatellite L510INSYDE1.2020090703000000.000000+00097B83607018400F8041E0409SE Asia Standard Time(GMT+07:00)03ACRSYSACRPRDCT103 Spsys.log Content: 0x80070002 Licensing Data–> Software licensing service version: 6.1.7600.16385 Name: Windows® 7, Ultimate edition Description: Windows Operating System - Windows® 7, OEM_SLP channel Activation ID: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f Extended PID: 00426-00178-926-600006-02-1054-7600.0000-3642009 Installation ID: 001851931221859043948566023332724184376516102634099400 Partial Product Key: HYRR2 License Status: Licensed Windows Activation Technologies–> HrOffline: 0x8004FE22 HrOnline: N/A HealthStatus: 0x0000000000002000 Event Time Stamp: N/A ActiveX: Registered, Version: 7.1.7600.16395 Admin Service: Registered, Version: 7.1.7600.16395 HealthStatus Bitmask Output: Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui HWID Data–> HWID Hash Current: MAAAAAEAAgABAAIAAAABAAAAAgABAAEAJJQiq8hjen8wBv7bEoXI4nyKppbPykbK OEM Activation 1.0 Data–> N/A OEM Activation 2.0 Data–> BIOS valid for OA 2.0: yes Windows marker version: 0x20001 OEMID and OEMTableID Consistent: yes BIOS Information: ACPI Table Name OEMID Value OEMTableID Value APIC TOSINV TOSINV00 FACP TOSINV TOSINV00 HPET TOSINV TOSINV00 BOOT TOSINV TOSINV00 MCFG TOSINV TOSINV00 ASF! TOSINV TOSINV00 SLIC ACRSYS ACRPRDCT SSDT PmRef CpuPm
Post #15
Ok… couple problems there….. Apparently the validation key for your operating system has been "tampered" with. This appears to have been done with the help of this program: CW.eXe I guess the "good" news would be that I'm not (at least at this point) seeing any signs of Virut, which is a "game over" scenario. It can't be cleaned. It is fairly common for cw.exe to be infected with Virut. The next problem showing there is that apparently the version of Windows 7 is a RTM build that got "leaked" and then pirated. Therefore it cannot be validated. How/where did you get your operating system?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI