What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware - "Congratulations visitor..." popup, malwarebytes s

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #32
Thanks oldman,
The GMER and OTL reports are below. I don't see the Extra.txt report…Where would that be.
Unfortunately, the laptop is still running very slow.
For, example - MSE timed out before it could turn on.
And the scratchy audio is still there.


GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-03-24 16:05:56
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK8009GAH rev.BQ001G
Running: v8gq1wxb.exe; Driver: C:\DOCUME~1\SOLITA~1\LOCALS~1\Temp\kwxdipob.sys


—- Devices - GMER 1.0.15 —-

Device \Driver\BTHUSB \Device\0000009b bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\0000009b bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\0000009d bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\0000009d bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6b318d94
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001a6b318d94 (not active ControlSet)

—- EOF - GMER 1.0.15 —-


OTL logfile created on: 3/24/2011 4:08:05 PM - Run 6
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\solitario\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 482.00 Mb Available Physical Memory | 48.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.46 Gb Total Space | 1.48 Gb Free Space | 1.98% Space Free | Partition Type: NTFS
Drive E: | 232.83 Gb Total Space | 161.21 Gb Free Space | 69.24% Space Free | Partition Type: FAT32

Computer Name: SOLITAR-14P7WC1 | User Name: solitario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\solitario\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Essentials Codec Pack\WECPUpdate.exe (MediaCodec.Org)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\Common Files\Teleca Shared\Generic.exe (Teleca AB)
PRC - C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\dbgout.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe (Teleca AB)
PRC - C:\Program Files\Common Files\Teleca Shared\logger.exe (Popwire AB)
PRC - C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe (Teleca Sweden AB)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\solitario\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\hccutils.dll (Intel Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (FolderSize) – C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (WLANKEEPER) Intel® – C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
SRV - (S24EventMonitor) Intel® – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)


========== Driver Services (SafeList) ==========

DRV - (MpKsl2470c25f) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D53F3820-CB69-4871-B1D9-CA25577D0FCF}\MpKsl2470c25f.sys (Microsoft Corporation)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (HTCAND32) – C:\WINDOWS\system32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (guardian2) – C:\WINDOWS\system32\drivers\oz776.sys (O2Micro)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {7C7F5C11-4ACD-4CDB-9293-2E3F46654E2A}:0.28
FF - prefs.js..keyword.URL: "http://www.google.com/search?sourceid=navclient&hl;=en&q;="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/10 11:11:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/10 11:11:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 7\components [2011/03/22 12:01:24 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 7\plugins [2011/02/16 09:44:48 | 000,000,000 | —D | M]

[2010/09/07 20:38:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\solitario\Application Data\Mozilla\Extensions
[2011/03/21 22:34:00 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions
[2010/09/10 11:22:14 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/13 21:41:05 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/03/16 14:29:31 | 000,000,000 | —D | M] (TableTools (T2F3)) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{7C7F5C11-4ACD-4CDB-9293-2E3F46654E2A}
[2010/12/20 14:39:20 | 000,002,523 | —- | M] () – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\searchplugins\google-ssl.xml
[2011/03/16 14:29:47 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/06 06:41:11 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) –
[2010/11/06 06:40:19 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/11/06 06:40:15 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/03/23 08:50:43 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\solitario\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\solitario\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/06 15:35:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/03/24 11:57:43 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\solitario\Desktop\OTL.exe
[2011/03/23 09:16:34 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/03/22 14:44:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/03/22 14:30:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/03/22 14:30:02 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/03/22 14:30:02 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/03/22 14:30:02 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/03/22 14:29:45 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/03/22 14:29:17 | 000,000,000 | —D | C] – C:\Qoobox
[2011/03/21 22:18:44 | 000,000,000 | —D | C] – C:\_OTL
[2011/03/19 19:43:31 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/03/15 15:15:57 | 000,000,000 | —D | C] – C:\Documents and Settings\solitario\My Documents\TJS Consulting

========== Files - Modified Within 30 Days ==========

[2011/03/24 16:03:00 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-790525478-725345543-1003UA.job
[2011/03/24 15:22:00 | 000,000,613 | —- | M] () – C:\WINDOWS\tasks\OnlineBackupManager.job
[2011/03/24 15:03:00 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-790525478-725345543-1003Core.job
[2011/03/24 12:13:12 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\Windows Codec Update Service.job
[2011/03/24 11:57:58 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\solitario\Desktop\OTL.exe
[2011/03/24 11:55:27 | 000,301,568 | —- | M] () – C:\Documents and Settings\solitario\Desktop\v8gq1wxb.exe
[2011/03/24 11:30:02 | 000,012,800 | —- | M] () – C:\Documents and Settings\solitario\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/24 09:11:39 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/24 09:08:02 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/23 08:50:43 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/03/23 08:24:57 | 004,300,354 | R— | M] () – C:\Documents and Settings\solitario\Desktop\ComboFix.exe
[2011/03/22 14:44:25 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/03/20 20:15:55 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/03/20 20:05:16 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/19 15:23:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/19 12:08:23 | 000,002,316 | —- | M] () – C:\Documents and Settings\solitario\Desktop\Google Chrome.lnk
[2011/03/19 12:08:23 | 000,002,294 | —- | M] () – C:\Documents and Settings\solitario\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/18 20:45:48 | 000,436,704 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/18 20:45:48 | 000,069,076 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/12 18:48:44 | 000,130,315 | —- | M] () – C:\Documents and Settings\solitario\Desktop\PTI-ENERGY+ for Fuel Oil.pdf
[2011/03/11 16:41:58 | 000,002,291 | —- | M] () – C:\Documents and Settings\All Users\Desktop\LinkedIn Contacts Manager.lnk
[2011/03/10 04:09:02 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/02/25 01:29:31 | 000,000,000 | —- | M] () – C:\WINDOWS\DbgOut.INI

========== Files Created - No Company Name ==========

[2011/03/24 11:55:12 | 000,301,568 | —- | C] () – C:\Documents and Settings\solitario\Desktop\v8gq1wxb.exe
[2011/03/22 14:44:25 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/03/22 14:44:19 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/03/22 14:30:02 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/03/22 14:30:02 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/03/22 14:30:02 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/03/22 14:30:02 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/03/22 14:30:02 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/03/22 14:26:11 | 004,300,354 | R— | C] () – C:\Documents and Settings\solitario\Desktop\ComboFix.exe
[2011/03/22 12:01:50 | 000,000,811 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox
[2011/03/19 19:48:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/12 18:48:39 | 000,130,315 | —- | C] () – C:\Documents and Settings\solitario\Desktop\PTI-ENERGY+ for Fuel Oil.pdf
[2011/02/25 01:29:31 | 000,000,000 | —- | C] () – C:\WINDOWS\DbgOut.INI
[2011/01/06 18:37:14 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\adistres.dll
[2010/12/08 11:31:11 | 000,074,752 | —- | C] () – C:\WINDOWS\System32\jst.dll
[2010/12/08 11:31:10 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\PMLJNI.dll
[2010/12/08 11:29:14 | 000,000,841 | —- | C] () – C:\WINDOWS\hpbvnstp.ini
[2010/12/08 11:27:23 | 000,012,299 | —- | C] () – C:\WINDOWS\hplj1320.ini
[2010/09/15 10:47:25 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/10 20:26:34 | 000,012,800 | —- | C] () – C:\Documents and Settings\solitario\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/09 20:53:18 | 000,127,264 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/09/09 16:30:09 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2010/09/09 11:28:13 | 000,068,270 | —- | C] () – C:\WINDOWS\hpoins05.dat
[2010/09/09 11:28:12 | 000,019,696 | —- | C] () – C:\WINDOWS\hpomdl05.dat
[2010/09/08 19:39:24 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/09/07 20:38:20 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/09/07 12:13:18 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2010/09/07 12:13:17 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2010/09/07 12:13:17 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/09/06 20:39:40 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4814.dll
[2010/09/06 15:39:01 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/09/06 15:31:34 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/09/06 10:43:11 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/09/06 10:41:49 | 000,282,928 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/06 10:20:02 | 000,065,344 | —- | C] () – C:\WINDOWS\System32\PDFreDirectMonNT.dll
[2009/12/20 21:42:18 | 000,000,314 | —- | C] () – C:\WINDOWS\primopdf.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC Remove.exe
[2008/04/13 20:12:36 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\spdwnwxp.exe
[2005/03/21 19:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,436,704 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,069,076 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/04/02 07:01:22 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\HPB1320V.DLL
[2004/02/09 11:21:38 | 000,000,319 | —- | C] () – C:\WINDOWS\System32\HPB1320V.DAT
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/31 04:17:12 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL

========== LOP Check ==========

[2010/10/05 14:51:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DigiData
[2010/12/06 19:08:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GoldMine
[2010/12/31 15:17:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HTC
[2010/12/06 18:30:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PDF reDirect
[2010/12/31 15:17:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Teleca
[2011/02/07 12:54:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/12/01 21:07:24 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\Auslogics
[2010/10/05 14:51:56 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\DigiData
[2011/01/06 18:35:06 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\InterTrust
[2010/12/06 18:30:15 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\PDF reDirect
[2010/12/06 17:46:31 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\PrimoPDF
[2010/12/31 15:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\Teleca
[2011/02/07 14:53:42 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\webex
[2011/03/24 15:22:00 | 000,000,613 | —- | M] () – C:\WINDOWS\Tasks\OnlineBackupManager.job
[2011/03/24 12:13:12 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\Windows Codec Update Service.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/09/06 15:35:19 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/03/20 20:15:55 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/03/22 14:44:25 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2011/03/23 08:56:09 | 000,013,739 | —- | M] () – C:\ComboFix.txt
[2010/09/06 15:35:19 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/09/06 15:35:19 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/09/06 15:35:19 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/09/07 18:51:57 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/03/24 09:07:03 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2010/12/08 11:54:17 | 000,000,007 | —- | M] () – C:\statusclient.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/09/06 15:34:45 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/10/23 13:51:42 | 000,273,408 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpcpp6de.DLL
[2004/04/15 13:43:08 | 000,061,952 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\HPZPP041.DLL
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:04 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/02/08 14:31:07 | 000,001,666 | -H– | M] () – C:\Documents and Settings\solitario\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/09/06 10:40:51 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/09/06 10:40:51 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/09/06 10:40:51 | 000,913,408 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2010/10/19 10:31:10 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2010/10/19 10:31:10 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2010/09/06 15:35:29 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2011/02/13 14:17:41 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-24 12:03:00


< MD5 for: EXPLORER.EXE >
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2011/03/24 09:11:06 | 000,067,038 | —- | M] () MD5=CC4B43D50BBB3A6038F3179904B5E8C5 – C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.SCF >
[2004/08/04 06:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.CHW >
[2010/09/07 20:30:11 | 000,153,185 | —- | M] () MD5=AB7F4DE8306C27B6ADE27390AA73CE82 – C:\WINDOWS\Help\iexplore.chw

< MD5 for: IEXPLORE.EXE >
[2008/04/13 20:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie8\iexplore.exe
[2008/04/13 20:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\ERDNT\cache\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.HLP >
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EXE >
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< End of report >
Post #33
Hi solo58,

The Extra.txt will only be produced the first time we ran OTL.

So far nothing is showing. Ran this quick scan.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

[external image: Posted Image]
Click the "Scan" button to start scan

[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply.
Post #34
Here's the aswMBR Log aswMBR version 0.9.4 Copyright© 2011 AVAST Software Run date: 2011-03-24 20:22:00 —————————– 20:22:00.718 OS Version: Windows 5.1.2600 Service Pack 3 20:22:00.718 Number of processors: 2 586 0xE0C 20:22:00.718 ComputerName: SOLITAR-14P7WC1 UserName: solitario 20:22:05.593 Initialize success 20:22:23.281 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 20:22:23.281 Disk 0 Vendor: TOSHIBA_MK8009GAH BQ001G Size: 76319MB BusType: 3 20:22:23.281 Disk 0 MBR read successfully 20:22:23.281 Disk 0 MBR scan 20:22:23.312 Disk 0 scanning sectors +156296385 20:22:23.406 Disk 0 scanning C:\WINDOWS\system32\drivers 20:22:48.546 Service scanning 20:22:53.578 Disk 0 trace - called modules: 20:22:53.593 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 20:22:53.593 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x865d1ab8] 20:22:53.593 3 CLASSPNP.SYS[f761efd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x865cf940] 20:22:53.593 Scan finished successfully
Post #36
Hi solo58,

These logs are not showing anything, but we have other tools.

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan
On the first tab check all elements down to Computer and then select start scan
Once it has finished select report and post that.

[external image: Posted Image]

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan
Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

[external image: Posted Image]

Please post back with both logs.

Thanks
Post #40
It stopped…but then closed. A new folder has been created on the desktop: Virus Removal Tool. there's a log.bat file, but I can't open it. I reopen the application. There's a report There's a shortcut file: "Scan", with the K symbol. It opens the application. There's a "report" button, which simply states that a scan was run.
Post #41
Hi solo58,

there's a log.bat file, but I can't open it.

Is that .bat or .dat? Can you zip the file and attach it?

I reopen the application. There's a report

That may be it.

Now an analysis scan
Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

Did you get this far?

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI