What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

google redirect problem- "URLfraudchekc.com", please help

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have been infected somehow, i believe it's the TDSS rootkey or something like that, getting the typical random redirects/popups, tabs in forefox open but are blank and won't load etc. bar on the bottom usually says waiting for urlfraudchekc.com/lotsofnumbersandletters. THANK YOU in advance for any help.

using OTL as per the 'Are you infected?" tutorial

for some reason when i try to copy and past the OTL.txt and extras.txt files here it will not work, attempting to add the files as attachments to this post.

Please don't attach the scans / logs from these scans, use "copy/paste".

OTL logfile created on: 3/3/2011 11:43:44 AM - Run 1
OTL by OldTimer - Version 3.2.22.2 Folder = C:\Documents and Settings\jvandenend\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 25.00% Memory free
4.00 Gb Paging File | 2.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.86 Gb Total Space | 121.38 Gb Free Space | 81.54% Space Free | Partition Type: NTFS

Computer Name: LLFCSL0002081 | User Name: jvandenend | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\jvandenend\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\IObit\IObit Security 360\is360tray.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
PRC - C:\Program Files\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
PRC - c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
PRC - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
PRC - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
PRC - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
PRC - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - c:\drivers\audio\R213367\stacsv.exe (IDT, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\jvandenend\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Dell\Dell ControlPoint\System Manager\dadkeyb.dll (Dell Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll (Microsoft Corporation)
MOD - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\igfxdo.dll (Intel Corporation)


========== Win32 Services (SafeList) ==========

SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (ATTRcAppSvc) – C:\Program Files\AT&T;\Communication Manager\RcAppSvc.exe (SmithMicro Inc.)
SRV - (SMManager) – C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.)
SRV - (dcpsysmgrsvc) – c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.)
SRV - (Credential Vault Host Storage) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation)
SRV - (Credential Vault Host Control Service) – C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation)
SRV - (TdmService) – C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.)
SRV - (SecureStorageService) – C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.)
SRV - (buttonsvc32) – C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.)
SRV - (STacSV) – c:\drivers\audio\R213367\stacsv.exe (IDT, Inc.)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe ()
SRV - (ASFAgent) – C:\Program Files\Intel\ASF Agent\ASFAgent.exe (Intel Corporation)


========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (tcpipBM) – C:\WINDOWS\System32\drivers\tcpipBM.sys (Bytemobile, Inc.)
DRV - (PCTINDIS5) – C:\WINDOWS\system32\PCTINDIS5.sys (Smith Micro Inc.)
DRV - (PCASp50) – C:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (cvusbdrv) – C:\WINDOWS\system32\drivers\cvusbdrv.sys (Broadcom Corporation)
DRV - (WavxDMgr) – C:\WINDOWS\system32\drivers\WavxDMgr.sys (Wave Systems Corp.)
DRV - (USBCCID) – C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (SWUMXA3) Sierra Wireless USB MUX Driver (UMTSA3) – C:\WINDOWS\system32\drivers\swumxa3.sys (Sierra Wireless Inc.)
DRV - (rimmptsk) – C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (SWNC8UA3) Sierra Wireless MUX NDIS Driver (UMTSA3) – C:\WINDOWS\system32\drivers\swnc8ua3.sys (Sierra Wireless Inc.)
DRV - (SRS_PremiumSound_Service) – C:\WINDOWS\system32\drivers\SRS_PremiumSound_i386.sys ()
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (AESTAud) – C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (IntcHdmiAddService) Intel® – C:\WINDOWS\system32\drivers\IntcHdmi.sys (Intel® Corporation)
DRV - (e1yexpress) Intel® – C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (swmsflt) – C:\WINDOWS\System32\drivers\swmsflt.sys ()
DRV - (PBADRV) – C:\WINDOWS\system32\DRIVERS\PBADRV.sys (Dell Inc)
DRV - (NAL) – C:\WINDOWS\system32\drivers\iqvw32.sys (Intel Corporation )
DRV - (AsfAlrt) – C:\WINDOWS\system32\drivers\Asfalrt.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USREL/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://intranet.thellf.org/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1178
FF - prefs.js..extensions.enabledItems: avg@igeared:6.011.025.001
FF - prefs.js..extensions.enabledItems: [removed]:1.0.9
FF - prefs.js..network.proxy.ftp: ":0"
FF - prefs.js..network.proxy.gopher: ":0"
FF - prefs.js..network.proxy.http: ":0"
FF - prefs.js..network.proxy.no_proxies_on: ",localhost,127.0.0.1"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: ":0"
FF - prefs.js..network.proxy.ssl: ":0"

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/27 14:50:37 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011/01/12 01:48:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/17 18:55:42 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/17 18:55:42 | 000,000,000 | —D | M]

[2009/12/13 01:29:52 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\jvandenend\Application Data\Mozilla\Extensions
[2011/03/03 09:45:37 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\jvandenend\Application Data\Mozilla\Firefox\Profiles\784gvnbx.default\extensions
[2010/12/29 20:15:32 | 000,000,000 | —D | M] (cacaoweb) – C:\Documents and Settings\jvandenend\Application Data\Mozilla\Firefox\Profiles\784gvnbx.default\extensions\[removed]
[2010/10/23 19:34:56 | 000,001,504 | —- | M] () – C:\Documents and Settings\jvandenend\Application Data\Mozilla\Firefox\Profiles\784gvnbx.default\searchplugins\imdb.xml
[2009/12/13 01:29:41 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/27 14:50:37 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX
[2011/01/12 01:48:05 | 000,000,000 | —D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="6.011.025.001" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) – C:\PROGRAM FILES\AVG\AVG10\TOOLBAR\FIREFOX\AVG@IGEARED
[2009/12/01 03:22:35 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2008/04/14 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AT&T; Communication Manager] C:\Program Files\AT&T;\Communication Manager\ATTCM.exe (ATT)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
O4 - HKLM..\Run: [DellControlPoint] c:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe (IObit)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell ControlPoint System Manager.lnk = C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O15 - HKCU\..Trusted Domains: lifelogics.org ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: mdtransplant.org ([exchange] https in Trusted sites)
O15 - HKCU\..Trusted Domains: thellf.org ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: thellf.org ([intranet] https in Local intranet)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1290013897676 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mdtransplant.org
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\jvandenend\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\jvandenend\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (wvauth) - C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 16:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/03 11:42:48 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\Desktop\New Folder
[2011/03/03 11:22:14 | 000,581,120 | —- | C] (OldTimer Tools) – C:\Documents and Settings\jvandenend\Desktop\OTL.exe
[2011/03/03 11:18:49 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer
[2011/03/03 10:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/03/03 09:17:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\IObit Security 360
[2011/03/03 09:17:50 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\Application Data\IObit
[2011/03/03 09:17:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IObit
[2011/03/03 09:17:47 | 000,000,000 | —D | C] – C:\Program Files\IObit
[2011/03/02 21:46:46 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\Application Data\Malwarebytes
[2011/03/02 21:46:42 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/02 21:46:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/02 21:46:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/02 21:46:39 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/03/02 21:46:39 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/01 16:22:40 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/03/01 15:07:47 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\My Documents\cahill dell drivers
[2011/03/01 15:03:10 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\Start Menu\Programs\Dell Inc
[2011/03/01 15:02:55 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\Local Settings\Application Data\Deployment
[2011/02/25 16:51:49 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/02/25 16:51:46 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/02/25 16:41:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\fAdDeLe08200
[2011/02/22 11:21:37 | 000,000,000 | —D | C] – C:\Documents and Settings\jvandenend\My Documents\Seagull
[2011/02/17 19:01:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/02/17 19:00:59 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/02/17 19:00:57 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/02/17 18:55:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/02/17 18:55:24 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/02/16 16:47:26 | 000,000,000 | -HSD | C] – C:\Config.Msi
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/03 11:24:34 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/03 11:22:14 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jvandenend\Desktop\OTL.exe
[2011/03/03 10:49:50 | 000,000,000 | —- | M] () – C:\Documents and Settings\jvandenend\Local Settings\Application Data\WavXMapDrive.bat
[2011/03/03 10:49:02 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/03 10:49:00 | 2097,045,504 | -HS- | M] () – C:\hiberfil.sys
[2011/03/03 10:27:23 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/03/03 09:47:11 | 000,000,998 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2927259906-3181850627-1819614003-3637UA.job
[2011/03/02 22:00:54 | 000,494,680 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/02 22:00:54 | 000,093,464 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/02 20:30:24 | 107,590,699 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/03/02 20:26:42 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/01 17:47:00 | 000,000,946 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2927259906-3181850627-1819614003-3637Core.job
[2011/02/24 18:33:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/02/10 13:03:22 | 000,099,666 | —- | M] () – C:\Documents and Settings\jvandenend\My Documents\referral worksheet 2.pdf
[2011/02/09 15:47:15 | 000,049,233 | —- | M] () – C:\fat32format.exe
[2011/02/03 19:36:10 | 000,085,228 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/03 10:27:23 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/02/10 13:02:44 | 000,099,666 | —- | C] () – C:\Documents and Settings\jvandenend\My Documents\referral worksheet 2.pdf
[2011/02/09 15:51:33 | 000,049,233 | —- | C] () – C:\fat32format.exe
[2010/08/18 16:11:45 | 000,000,000 | —- | C] () – C:\Documents and Settings\jvandenend\Local Settings\Application Data\prvlcl.dat
[2010/08/10 15:16:00 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/12/13 01:29:47 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/12/10 11:30:51 | 000,028,288 | —- | C] () – C:\WINDOWS\System32\drivers\swmsflt.sys
[2009/12/10 10:46:07 | 000,000,000 | —- | C] () – C:\Documents and Settings\jvandenend\Local Settings\Application Data\WavXMapDrive.bat
[2009/12/09 13:38:59 | 000,000,400 | —- | C] () – C:\WINDOWS\ina32.ini
[2009/12/01 04:56:44 | 000,982,192 | —- | C] () – C:\WINDOWS\System32\igkrng500.bin
[2009/12/01 04:56:44 | 000,417,344 | —- | C] () – C:\WINDOWS\System32\igcompkrng500.bin
[2009/12/01 04:56:29 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2009/12/01 04:50:53 | 000,001,156 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2009/12/01 03:50:04 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/12/01 03:38:13 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/12/01 03:38:13 | 000,025,088 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/12/01 03:37:33 | 000,232,744 | R— | C] () – C:\WINDOWS\System32\drivers\SRS_PremiumSound_i386.sys
[2009/12/01 03:33:22 | 000,279,888 | —- | C] () – C:\WINDOWS\System32\brcmbsp.dll
[2009/12/01 03:30:58 | 000,080,368 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2009/07/22 19:03:06 | 000,143,360 | R— | C] () – C:\WINDOWS\System32\preflib.dll
[2009/06/05 16:41:18 | 000,557,056 | —- | C] () – C:\WINDOWS\System32\AmRes_fr.dll
[2009/06/05 16:41:18 | 000,528,384 | —- | C] () – C:\WINDOWS\System32\AmRes_en.dll
[2009/06/05 16:41:16 | 000,552,960 | —- | C] () – C:\WINDOWS\System32\AmRes_it.dll
[2009/06/05 16:41:16 | 000,552,960 | —- | C] () – C:\WINDOWS\System32\AmRes_es.dll
[2009/06/05 16:41:16 | 000,536,576 | —- | C] () – C:\WINDOWS\System32\AmRes_ja.dll
[2009/06/05 16:41:14 | 000,540,672 | —- | C] () – C:\WINDOWS\System32\AmRes_pt-BR.dll
[2009/06/05 16:41:14 | 000,520,192 | —- | C] () – C:\WINDOWS\System32\AmRes_ko.dll
[2009/06/05 16:41:12 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\AmRes_ru.dll
[2009/06/05 16:41:12 | 000,491,520 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHT.dll
[2009/06/05 16:41:12 | 000,491,520 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHS.dll
[2009/06/05 16:41:10 | 000,557,056 | —- | C] () – C:\WINDOWS\System32\AmRes_nl.dll
[2009/06/05 16:41:10 | 000,540,672 | —- | C] () – C:\WINDOWS\System32\AmRes_cs.dll
[2009/06/05 16:41:10 | 000,528,384 | —- | C] () – C:\WINDOWS\System32\AmRes_da.dll
[2009/06/05 16:41:08 | 000,544,768 | —- | C] () – C:\WINDOWS\System32\AmRes_pl.dll
[2009/06/05 16:41:08 | 000,532,480 | —- | C] () – C:\WINDOWS\System32\AmRes_sv.dll
[2009/06/05 16:41:08 | 000,528,384 | —- | C] () – C:\WINDOWS\System32\AmRes_no.dll
[2009/06/05 16:41:06 | 000,552,960 | —- | C] () – C:\WINDOWS\System32\AmRes_el.dll
[2009/06/05 16:41:06 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\AmRes_ar.dll
[2009/06/05 16:41:04 | 000,548,864 | —- | C] () – C:\WINDOWS\System32\AmRes_pt-PT.dll
[2009/06/05 16:41:04 | 000,544,768 | —- | C] () – C:\WINDOWS\System32\AmRes_hu.dll
[2009/06/05 16:41:04 | 000,536,576 | —- | C] () – C:\WINDOWS\System32\AmRes_fi.dll
[2009/06/05 16:41:04 | 000,516,096 | —- | C] () – C:\WINDOWS\System32\AmRes_he.dll
[2009/06/05 16:41:02 | 000,548,864 | —- | C] () – C:\WINDOWS\System32\AmRes_ro.dll
[2009/06/05 16:41:00 | 000,540,672 | —- | C] () – C:\WINDOWS\System32\AmRes_tr.dll
[2009/06/05 16:31:18 | 000,561,152 | —- | C] () – C:\WINDOWS\System32\AmRes_de.dll
[2009/06/03 14:08:48 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_tr.dll
[2009/06/03 14:08:46 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_ro.dll
[2009/06/03 14:08:46 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt-BR.dll
[2009/06/03 14:08:44 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_hu.dll
[2009/06/03 14:08:42 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_fi.dll
[2009/06/03 14:08:42 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_he.dll
[2009/06/03 14:08:40 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_el.dll
[2009/06/03 14:08:38 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_cs.dll
[2009/06/03 14:08:36 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\Internationalization_ar.dll
[2009/06/03 14:08:36 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2009/06/03 14:08:34 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2009/06/03 14:08:32 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_sv.dll
[2009/06/03 14:08:32 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2009/06/03 14:08:30 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2009/06/03 14:08:28 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_pl.dll
[2009/06/03 14:08:28 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\Internationalization_no.dll
[2009/06/03 14:08:26 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\Internationalization_nl.dll
[2009/06/03 14:08:24 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2009/06/03 14:08:24 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2009/06/03 14:08:22 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2009/06/03 14:08:20 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2009/06/03 14:08:20 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2009/06/03 14:08:16 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2009/06/03 14:08:16 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\Internationalization_da.dll
[2009/06/03 13:07:50 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\Wavx_ESC_Logging.dll
[2009/05/18 09:34:04 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2009/05/05 11:34:22 | 000,839,680 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 16:42:40 | 000,064,200 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2008/04/25 16:31:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 16:27:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 16:26:32 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 11:16:24 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 11:16:22 | 000,494,680 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 11:16:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 11:16:22 | 000,093,464 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 11:16:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 11:16:22 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 11:16:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 11:16:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 11:16:18 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 11:16:18 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 11:16:13 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 11:16:11 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 04:22:39 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 04:21:52 | 000,271,784 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/03/25 10:46:00 | 000,077,536 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/04/19 06:52:16 | 000,080,720 | —- | C] () – C:\WINDOWS\System32\AsfBios.dll
[2007/04/19 06:28:10 | 000,025,424 | —- | C] () – C:\WINDOWS\System32\drivers\netamsg.dll
[2006/06/30 13:58:44 | 000,176,128 | R— | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2006/06/30 13:58:44 | 000,126,976 | R— | C] () – C:\WINDOWS\System32\bioapi100.dll
[2006/06/12 09:01:16 | 000,348,160 | —- | C] () – C:\WINDOWS\tsp.dll
[2004/09/10 14:34:00 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2004/09/10 14:34:00 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ADsSecurity.dll

========== LOP Check ==========

[2009/12/10 11:30:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AT&T;
[2010/12/02 15:58:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/11/29 23:24:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2010/11/29 23:19:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/11/29 23:24:30 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/02/25 16:42:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fAdDeLe08200
[2011/03/03 10:26:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/03/03 09:17:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2010/11/29 23:17:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2009/12/01 03:40:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NTRU Cryptosystems
[2011/01/03 20:31:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/12/01 03:44:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uninstall
[2009/12/01 03:41:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Wave Systems Corp
[2010/09/16 17:45:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/10 11:35:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/12/10 11:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\AT&T;
[2010/11/30 00:03:11 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\AVG10
[2009/12/01 03:44:34 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\Broadcom
[2011/03/03 09:17:50 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\IObit
[2009/12/10 17:10:29 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\MessageLabs
[2011/01/03 20:30:11 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\Registry Mechanic
[2009/12/10 11:26:54 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\Sierra Wireless
[2009/12/01 03:41:12 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\Wave Systems Corp
[2009/12/01 03:20:19 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\Windows Desktop Search
[2009/12/10 08:19:36 | 000,000,000 | —D | M] – C:\Documents and Settings\jvandenend\Application Data\Windows Search

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/04/25 16:29:32 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/12/09 13:34:10 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2008/01/19 01:45:46 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2008/04/25 16:29:32 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2003/09/20 11:51:22 | 000,161,862 | —- | M] () – C:\Contacts 1.ico
[2004/01/31 21:51:42 | 000,118,574 | —- | M] () – C:\Crystal_Log.ico
[2009/12/01 05:00:17 | 000,006,135 | RH– | M] () – C:\dell.sdr
[2009/12/10 11:30:49 | 000,442,411 | —- | M] () – C:\drivers.log
[2011/02/09 15:47:15 | 000,049,233 | —- | M] () – C:\fat32format.exe
[2003/09/02 12:17:00 | 000,161,862 | —- | M] () – C:\Help 1.ico
[2011/03/03 10:49:00 | 2097,045,504 | -HS- | M] () – C:\hiberfil.sys
[2008/04/25 16:29:32 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2008/04/25 16:29:32 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2008/04/14 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 07:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/03/03 10:48:59 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2004/08/19 20:11:08 | 000,002,238 | —- | M] () – C:\portal.ico
[2011/03/03 11:04:48 | 000,241,656 | —- | M] () – C:\TDSSKiller.2.4.1.0_03.03.2011_11.03.43_log.txt
[2005/02/07 10:39:21 | 000,003,262 | —- | M] () – C:\telephone.ico
[2003/02/27 00:38:02 | 000,161,862 | —- | M] () – C:\training.ico

< %systemroot%\Fonts\*.com >
[2006/04/20 03:21:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/07/03 05:37:10 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/20 03:21:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/07/03 05:37:12 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/04/25 16:29:00 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/14 23:43:18 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2007/03/22 21:25:42 | 000,677,376 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/04/25 04:21:09 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/04/25 04:21:09 | 001,089,536 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/04/25 04:21:09 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/04/25 16:29:41 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/12/09 13:39:05 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\jvandenend\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/04/25 16:33:01 | 000,000,079 | —- | M] () – C:\Documents and Settings\jvandenend\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/03/03 11:22:14 | 000,581,120 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jvandenend\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoRebootWithLoggedOnUsers" = 1
"AutoInstallMinorUpdates" = 1
"NoAUShutdownOption" = 1
"RescheduleWaitTimeEnabled" = 1
"RescheduleWaitTime" = 15
"DetectionFrequencyEnabled" = 1
"DetectionFrequency" = 2
"RebootRelaunchTimeoutEnabled" = 1
"RebootRelaunchTimeout" = 5
"UseWUServer" = 1
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 11

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-29 01:43:23

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >

Attachments:

Post #2
Hello thedutchtouch and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Any underlined text in my posts indicates a clickable link.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • GMER log
Post #3
thank you so much for your help. gmer.txt copied below




GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-03-03 19:47:25
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\iaStor0 WDC_WD16 rev.11.0
Running: w2fiq2x2.exe; Driver: C:\DOCUME~1\JVANDE~1\LOCALS~1\Temp\awliiaod.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xA61FE6C0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xA61FE770]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xA61FE810]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xA61FE8B0]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 3038 805048D4 4 Bytes CALL CB58EEF8

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D2000A
.text C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D3000A
.text C:\WINDOWS\System32\svchost.exe[1508] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00D1000C
.text C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 0087000A
.text C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 0088000A
.text C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 0089000A
.text C:\WINDOWS\System32\svchost.exe[1508] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 0112000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2552] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\WINDOWS\Explorer.EXE[3208] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00FC000A
.text C:\WINDOWS\Explorer.EXE[3208] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00FD000A
.text C:\WINDOWS\Explorer.EXE[3208] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00FB000C
.text C:\WINDOWS\Explorer.EXE[3208] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\Explorer.EXE[3208] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3208] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E16001 2 Bytes [05, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3224] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\WINDOWS\system32\SearchIndexer.exe[3516] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\WINDOWS\system32\wuauclt.exe[4008] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BA000A
.text C:\WINDOWS\system32\wuauclt.exe[4008] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BB000A
.text C:\WINDOWS\system32\wuauclt.exe[4008] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B9000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[4308] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0172000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[4308] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0173000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[4308] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0171000C

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp tcpipBM.SYS (Bytemobile Kernel Network Provider/Bytemobile, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \FileSystem\Fastfat \Fat 91453D20

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

Device \Device\Ide\IAAStorageDevice-1 -> \??\IDE#DiskWDC_WD1600BEVT-75ZCT2___________________11.01A11#4&11fcf6bd&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 312581552 (+255): rootkit-like behavior;

—- EOF - GMER 1.0.15 —-
Post #4
thedutchtouch:

🖼Click to load external image (Posted Image) You have IObit Security 360 installed. IObit has been accused of stealing and incorporating Malwarebytes AntiMalware's proprietary database and intellectual property into their software. More information is available HERE and HERE. I strongly recommend that you unistall it.

🖼Click to load external image (Posted Image) Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
:Commands
[EmptyFlash]
[EmptyTemp]
[Purity]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, it will reboot when it is done and produce a log
🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • OTL Fix log
  • ComboFix log
Post #5
when i ran combofix, i got a message that AVG interferes with combofix and should be removed. for some reason service AVG watchdog cannot be stopped when i try to uninstall it. I have disabled all of it's functions, will simply disabling AVG allow combofix to work properly or must it be uninstalled?
Post #6
Sorry, I meant to warn you about that. Unfortunately, ComboFix will not run until AVG is uninstalled. This is because AVG falsely detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first. You may do this through Control Panel > Add/Remove Programs or you can use this tool for a more complete removal:

Download AppRemover from here saving it to your desktop.
  • Double click to run AppRemover
  • Follow the prompts to remove AVG
  • Reboot
Once you've removed AVG please continue with running ComboFix
Post #7
sorry for false alarm, AVG does not uninstall while it is disabled. i re-enabled everything and it self uninstalled correctly, will post logs shortly.
Post #9 last edited
OTL log:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\ deleted successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: brett
->Flash cache emptied: 405 bytes

User: Default User
->Flash cache emptied: 405 bytes

User: IT

User: jvandenend
->Flash cache emptied: 180700 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 19263 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: All Users

User: brett
->Temp folder emptied: 12335698 bytes
->Temporary Internet Files folder emptied: 219485 bytes
->Java cache emptied: 13696362 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 12332888 bytes
->Temporary Internet Files folder emptied: 161246 bytes
->Java cache emptied: 13689269 bytes
->Flash cache emptied: 0 bytes

User: IT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: jvandenend
->Temp folder emptied: 301347135 bytes
->Temporary Internet Files folder emptied: 10048865 bytes
->Java cache emptied: 50599878 bytes
->FireFox cache emptied: 100215080 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 66916073 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 24365142 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 9912512 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 154203 bytes

Total Files Cleaned = 588.00 mb

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\: LSP stack updated.

OTL by OldTimer - Version 3.2.22.2 log created on 03032011_220459

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…





Combofix log:


ComboFix 11-03-03.02 - jvandenend 03/03/2011 23:04:39.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2000.1590 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

—– BITS: Possible infected sites —–

hxxp://trcsweb1:8530
.
\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected
.
((((((((((((((((((((((((( Files Created from 2011-02-04 to 2011-03-04 )))))))))))))))))))))))))))))))
.

2011-03-04 03:04 . 2011-03-04 03:04 ——– d—–w- C:\_OTL
2011-03-03 16:18 . 2011-03-03 16:18 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-03-03 15:27 . 2011-03-03 15:27 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-03-03 15:26 . 2011-03-03 15:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-03-03 14:17 . 2011-03-03 14:17 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit
2011-03-03 14:17 . 2011-03-03 14:17 ——– d—–w- c:\program files\IObit
2011-03-03 02:46 . 2011-03-03 02:46 ——– d—–w- c:\documents and settings\jvandenend\Application Data\Malwarebytes
2011-03-03 02:46 . 2011-03-03 02:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-03-03 02:46 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-03 02:46 . 2011-03-03 02:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-03-03 02:46 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-03-01 21:22 . 2011-03-01 21:22 ——– d—–w- C:\$AVG
2011-03-01 20:02 . 2011-03-01 20:07 ——– d—–w- c:\documents and settings\jvandenend\Local Settings\Application Data\Deployment
2011-02-25 21:41 . 2011-02-25 21:42 ——– d—–w- c:\documents and settings\All Users\Application Data\fAdDeLe08200
2011-02-18 00:00 . 2011-02-18 00:00 ——– d—–w- c:\program files\iPod
2011-02-18 00:00 . 2011-02-18 00:01 ——– d—–w- c:\program files\iTunes
2011-02-09 20:51 . 2011-02-09 20:47 49233 —-a-w- C:\fat32format.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-04 04:27 . 2009-12-10 15:46 0 —-a-w- c:\documents and settings\jvandenend\Local Settings\Application Data\WavXMapDrive.bat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2009-06-12 00:41 49152 —-a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2009-06-12 00:41 49152 —-a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\jvandenend\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2011-01-16 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-22 200704]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-03-17 729088]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-26 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-26 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-26 134656]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-01 149280]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-12-01 2396160]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-06-12 656384]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2009-07-23 1796096]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2009-06-03 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2009-05-18 145920]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2009-07-05 15872]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"AT&T; Communication Manager"="c:\program files\AT&T;\Communication Manager\ATTCM.exe" [2009-10-09 883272]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-7-16 1253152]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\AT&T;\\Communication Manager\\SwiApiMux.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\jvandenend\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 6:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [4/27/2009 2:40 PM 293968]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [6/26/2009 10:26 AM 812392]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [6/26/2009 10:26 AM 26984]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [7/16/2009 1:04 PM 376096]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [7/22/2009 7:13 PM 76288]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [12/1/2009 4:56 AM 112512]
R3 cvusbdrv;Dell ControlVault;c:\windows\system32\drivers\cvusbdrv.sys [12/1/2009 4:56 AM 33832]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [12/1/2009 4:56 AM 244368]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [12/1/2009 4:56 AM 109568]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [12/1/2009 3:37 AM 232744]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [4/19/2007 6:28 AM 42832]
S3 ATTRcAppSvc;AT&T; RcAppSvc;c:\program files\AT&T;\Communication Manager\RcAppSvc.exe [10/9/2009 5:59 PM 121416]
S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys –> c:\windows\system32\Drivers\NvtSp50.sys [?]
S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [3/31/2009 2:45 PM 190080]
S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [5/4/2009 3:57 PM 148096]
.
Contents of the 'Scheduled Tasks' folder

2011-02-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2011-03-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2927259906-3181850627-1819614003-3637Core.job
- c:\documents and settings\jvandenend\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-16 22:42]

2011-03-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2927259906-3181850627-1819614003-3637UA.job
- c:\documents and settings\jvandenend\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-16 22:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://intranet.thellf.org/
uInternet Settings,ProxyOverride = ;
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
Trusted Zone: lifelogics.org
Trusted Zone: mdtransplant.org\exchange
Trusted Zone: thellf.org
FF - ProfilePath - c:\documents and settings\jvandenend\Application Data\Mozilla\Firefox\Profiles\784gvnbx.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: cacaoweb: [removed] - %profile%\extensions\[removed]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-03 23:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(916)
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(976)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1696)
c:\windows\system32\WININET.dll
c:\windows\system32\igfxdo.dll
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\drivers\audio\r213367\stacsv.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\IDT\WDM\sttray.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\DellTPad\Apntex.exe
c:\windows\system32\igfxext.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2011-03-03 23:32:48 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-04 04:32

Pre-Run: 129,609,424,896 bytes free
Post-Run: 129,476,112,384 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 63E4FA5C936D049992FF19B837ED1BC3
Post #11 last edited
thedutchtouch:

I apologize again for the delay. Please do this next:

Open notepad and copy/paste the text in the quotebox below into it:

@echo off
dir /a /s "c:\documents and settings\All Users\Application Data\fAdDeLe08200" > log.txt
notepad log.txt
del log.txt


Save this as peek.bat Choose to "Save type as - All Files"
It should look like this: [external image: Posted Image]
Double click on peek.bat & allow it to run. A notepad file will open. Copy that information into your next reply, please.

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Uncheck any entries from C:\System Volume Information or C:\Qoobox
  • Make sure that everything else is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:
  • peek.bat results
  • MBAM log
Post #12
it was my fault, i edited my last post to add the logs rather than adding a new post, i was trying to not bump my own thread so much. peek.bat log: Volume in drive C is OS Volume Serial Number is D05C-5801 Directory of c:\documents and settings\All Users\Application Data\fAdDeLe08200 02/25/2011 04:42 PM . 02/25/2011 04:42 PM .. 02/25/2011 04:41 PM 98 fAdDeLe08200 1 File(s) 98 bytes Total Files Listed: 1 File(s) 98 bytes 2 Dir(s) 128,978,345,984 bytes free MBAM log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5983 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 3/7/2011 6:35:26 PM mbam-log-2011-03-07 (18-35-26).txt Scan type: Quick scan Objects scanned: 196673 Time elapsed: 17 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Adware.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\Temp\explorer.exe (Adware.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\urvc\setup.exe (Adware.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\0.6121666347461963.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
Post #13 last edited
I now have a popup in my taskbar that appears to be genuine windows, saying that the file WLTRYSVC.exe (or something similar, the i did NOT click it/download anything, seems to be one of those fake antivirus prograns that installs itself.the fake antivirus program is called "System Tool". it has also changed my desktop background to a silly text image saying my computer is at risk. etc. this seems to be getting worse, not better. again, any help appreciated.
Post #15
My computer no longer turns on saying a sstem file has been corrupted. I have given up, and a friend at my companys IT department has agreed to help me, will probably have to reinstall windows. Thank you very much for your help, unfortunately this one just got too crazy. Mods: please feel free to lock this thread, I have given up attempting to fix my computer issues.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI