What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google Redirect Virus and Proxy settings virus

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello, I am a new member in this forum and I am desperate for help. A week ago my google chrome browser kept redirecting to qooqle.com as its homepage and after sometime I wasn't able to access the internet via google chrome because of my proxy settings. When I try to access my proxy settings it just ends up with a blank page. I read similar problems to mine right here in this forum and some have suggested to use ComboFix and GooredFix. I've tried GooredFIx and came up with this log: GooredFix by jpshortstuff (03.07.10.1) Log created at 00:41 on 31/03/2011 (imelda garde) Firefox version 3.6.13 (en-US) ========== GooredScan ========== ========== GooredLog ========== C:Program FilesMozilla Firefoxextensions {972ce4c6-7e08-4474-a285-3208198ce6fd} [08:23 22/12/2010] {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [08:26 29/12/2010] C:Documents and Settingsimelda gardeApplication DataMozillaFirefoxProfiles3zhitk1b.defaultextensions [removed] [08:47 12/12/2010] {20a82645-c095-46ed-80e3-08825760534b} [11:06 30/08/2010] {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} [13:58 08/01/2011] {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} [08:47 12/12/2010] [HKEY_LOCAL_MACHINESoftwareMozillaFirefoxExtensions] "{20a82645-c095-46ed-80e3-08825760534b}"="c:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension" [07:21 04/07/2010] "[removed]"="C:Program FilesJavajre6libdeployjqsff" [01:13 30/08/2010] "{cb84136f-9c44-433a-9048-c5cd9df1dc16}"="C:Program FilesPC Tools SecurityBDTFirefox" [11:56 27/03/2011] -=E.O.F=- I've tried malware bytes, hitman pro, super anti-spyware pro,pcsafe doctor and tdsskiller. None of them detect the malware. I tried spyware doctor and the scan came up with Trojan.sillyworm and Worm.IM.Sonahad but I have to buy the whole product to Remove the following malware and I don't have the money to buy it. Please help me with this, I've been searching for a solutiuon for weeks now so any help is HIGHLY appreciated. Thanks in advance to anyone who'll help. Here is a malware bytes log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6182 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 3/29/2011 10:48:04 PM mbam-log-2011-03-29 (22-48-04).txt Scan type: Quick scan Objects scanned: 140257 Time elapsed: 6 minute(s), 53 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #2
Hi,

Please do the following:


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Okay will do the DDS, in the meantime here is the OTL.txt:

OTL logfile created on: 3/31/2011 10:13:49 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\imelda garde\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 352.00 Mb Available Physical Memory | 35.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 141.05 Gb Total Space | 21.58 Gb Free Space | 15.30% Space Free | Partition Type: NTFS
Drive D: | 3.72 Gb Total Space | 2.19 Gb Free Space | 58.93% Space Free | Partition Type: FAT32

Computer Name: MELDSNETBOOK | User Name: imelda garde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\imelda garde\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools)
PRC - C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
PRC - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\PCSafeDoctor\pcsafedoctor.exe ()
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
PRC - C:\WINDOWS\system32\PersistenceThread.exe (Intel Corporation)
PRC - C:\Program Files\VideoWebCamera\VideoWebCamera.exe (Suyin)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\imelda garde\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\PC Tools Security\PCTGMhk.dll (PC Tools)
MOD - C:\Program Files\VideoWebCamera\Utility.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (Browser Defender Update Service) – C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (sdCoreService) – C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (sdAuxService) – C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (wampmysqld) – c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe ()
SRV - (wampapache) – c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe (Apache Software Foundation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (pctEFA) – C:\WINDOWS\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) – C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) – C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://rnd009.googlepages.com/google.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rnd009.googlepages.com/google.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://rnd009.googlepages.com/google.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://rnd009.googlepages.com/google.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACG…0110&m;=lt30
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid;=CT2405280
IE - HKCU\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSoft.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy8.up.edu.ph:8080

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Conduit Engine Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=ConduitEngine&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Conduit Engine Customized Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=&SearchSource;=13"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:3.2.5.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:[removed]
FF - prefs.js..extensions.enabledItems: {cb84136f-9c44-433a-9048-c5cd9df1dc16}:3.0.0.300
FF - prefs.js..network.proxy.backup.ftp: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy7.up.edu.ph"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011/03/27 20:56:42 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/27 18:27:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/27 18:27:47 | 000,000,000 | —D | M]

[2010/08/30 17:49:56 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Extensions
[2011/03/30 22:37:33 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\extensions
[2010/08/30 20:06:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/08 22:58:35 | 000,000,000 | —D | M] (Softonic-Eng7 Community Toolbar) – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
[2010/12/12 17:47:24 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2010/12/12 17:47:26 | 000,000,000 | —D | M] (Conduit Engine) – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\extensions\[removed]
[2010/09/12 01:40:49 | 000,002,424 | —- | M] () – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\searchplugins\askcom.xml
[2010/12/12 17:47:26 | 000,000,913 | —- | M] () – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\searchplugins\conduit.xml
[2011/03/27 18:18:13 | 000,001,860 | —- | M] () – C:\Documents and Settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\searchplugins\search.xml
[2011/03/30 22:37:33 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/29 17:26:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/08/30 10:13:55 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/03/27 20:56:42 | 000,000,000 | —D | M] (Browser Defender Toolbar) – C:\PROGRAM FILES\PC TOOLS SECURITY\BDT\FIREFOX
[2010/11/12 18:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

Hosts file not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\tbSoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AzMixerSel] C:\Program Files\Realtek\Audio\Drivers\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [pcsafedoctor.exe] C:\Program Files\PCSafeDoctor\pcsafedoctor.exe ()
O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
O4 - HKLM..\Run: [PersistenceThread] C:\WINDOWS\system32\PersistenceThread.exe (Intel Corporation)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PLFSetI] File not found
O4 - HKLM..\Run: [PLFSetL] C:\WINDOWS\PLFSetL.exe (sonix)
O4 - HKLM..\Run: [snp2uvc] C:\WINDOWS\System32\csnp2uvc.dll ( )
O4 - HKLM..\Run: [VideoWebCamera] C:\Program Files\VideoWebCamera\VideoWebCamera.exe (Suyin)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [PIS] C:\Documents and Settings\All Users\Application Data\c78e0a\PIc78_2209.exe ()
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
O4 - Startup: C:\Documents and Settings\imelda garde\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igdlogin: DllName - igdlogin.dll - C:\WINDOWS\System32\igdlogin.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\imelda garde\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\imelda garde\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/08 17:35:55 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{2d484840-8348-11df-9d89-0025565c0b5f}\Shell - "" = AutoRun
O33 - MountPoints2\{2d484840-8348-11df-9d89-0025565c0b5f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{2d484840-8348-11df-9d89-0025565c0b5f}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{42eddeba-8ce6-11df-9dc3-0025565c0b5f}\Shell\AutoRun\command - "" = wscript.exe xhv.vbs
O33 - MountPoints2\{42eddeba-8ce6-11df-9dc3-0025565c0b5f}\Shell\Open\Command - "" = wscript.exe xhv.vbs
O33 - MountPoints2\{6d2a32ba-87f4-11df-9da2-0025565c0b5f}\Shell - "" = AutoRun
O33 - MountPoints2\{6d2a32ba-87f4-11df-9da2-0025565c0b5f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{6d2a32ba-87f4-11df-9da2-0025565c0b5f}\Shell\AutoRun\command - "" = D:\iStudio.exe
O33 - MountPoints2\{935aa52a-8cf7-11df-9dc5-0025565c0b5f}\Shell\AutoRun\command - "" = E:\09lf.exe
O33 - MountPoints2\{935aa52a-8cf7-11df-9dc5-0025565c0b5f}\Shell\open\Command - "" = E:\09lf.exe
O33 - MountPoints2\{935aa52b-8cf7-11df-9dc5-0025565c0b5f}\Shell\AutoRun\command - "" = F:\09lf.exe
O33 - MountPoints2\{935aa52b-8cf7-11df-9dc5-0025565c0b5f}\Shell\open\Command - "" = F:\09lf.exe
O33 - MountPoints2\{9fa7e9f9-8385-11df-9d8b-0025565c0b5f}\Shell - "" = AutoRun
O33 - MountPoints2\{9fa7e9f9-8385-11df-9d8b-0025565c0b5f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{9fa7e9f9-8385-11df-9d8b-0025565c0b5f}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{d9f660ea-8d84-11df-9dcc-0025565c0b5f}\Shell\AutoRun\command - "" = wscript.exe xhv.vbs
O33 - MountPoints2\{d9f660ea-8d84-11df-9dcc-0025565c0b5f}\Shell\Open\Command - "" = wscript.exe xhv.vbs
O33 - MountPoints2\{edecca26-8983-11df-9dab-0025565c0b5f}\Shell\AutoRun\command - "" = wscript.exe xhv.vbs
O33 - MountPoints2\{edecca26-8983-11df-9dab-0025565c0b5f}\Shell\Open\Command - "" = wscript.exe xhv.vbs
O33 - MountPoints2\{ee66f27a-8e50-11df-9dd3-0025565c0b5f}\Shell - "" = AutoRun
O33 - MountPoints2\{ee66f27a-8e50-11df-9dd3-0025565c0b5f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{ee66f27a-8e50-11df-9dd3-0025565c0b5f}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (61656630650994688)

========== Files/Folders - Created Within 30 Days ==========

[2011/03/31 10:00:41 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\imelda garde\Desktop\OTL.exe
[2011/03/31 04:03:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/03/31 04:03:15 | 000,017,744 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/03/31 04:03:14 | 000,165,584 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2011/03/31 04:03:09 | 000,023,376 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/03/31 04:03:03 | 000,046,672 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/03/31 04:02:59 | 000,100,176 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/03/31 04:02:58 | 000,094,544 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2011/03/31 04:02:57 | 000,028,880 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/03/31 03:59:37 | 000,038,848 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2011/03/31 03:59:35 | 000,167,592 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2011/03/31 00:41:30 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Desktop\GooredFix Backups
[2011/03/31 00:37:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Sophos
[2011/03/31 00:37:38 | 000,000,000 | —D | C] – C:\Program Files\Sophos
[2011/03/30 23:46:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PCSafeDoctor
[2011/03/30 23:45:59 | 000,000,000 | —D | C] – C:\Program Files\PCSafeDoctor
[2011/03/29 05:38:13 | 000,000,000 | RH-D | C] – C:\Documents and Settings\imelda garde\Recent
[2011/03/27 21:17:08 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Application Data\SUPERAntiSpyware.com
[2011/03/27 21:17:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/03/27 20:56:40 | 002,000,848 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2011/03/27 20:56:40 | 001,533,904 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2011/03/27 20:56:40 | 000,149,456 | —- | C] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2011/03/27 20:56:14 | 000,656,320 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2011/03/27 20:56:14 | 000,338,880 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2011/03/27 20:56:13 | 000,251,560 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2011/03/27 20:56:09 | 000,239,168 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2011/03/27 20:56:09 | 000,160,448 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2011/03/27 20:56:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Security
[2011/03/27 20:56:00 | 000,070,536 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2011/03/27 20:55:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2011/03/27 20:55:44 | 000,000,000 | —D | C] – C:\Program Files\PC Tools Security
[2011/03/27 20:55:44 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Application Data\PC Tools
[2011/03/27 20:52:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2011/03/27 18:50:52 | 000,000,000 | —D | C] – C:\Program Files\Hitman Pro 3.5
[2011/03/27 18:44:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/03/27 18:42:15 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Application Data\Malwarebytes
[2011/03/27 18:42:08 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/27 18:42:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/27 18:42:03 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/03/27 18:28:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\GodsWar Online_Facebook
[2011/03/27 18:27:57 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Application Data\Kalydo
[2011/03/27 17:58:30 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Desktop\Anti-Malware
[2011/03/27 17:56:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/27 17:56:11 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/19 23:01:16 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Application Data\MOVAVI
[2011/03/15 22:55:00 | 000,000,000 | —D | C] – C:\Documents and Settings\imelda garde\Desktop\Acads Stuff
[2011/03/07 09:04:44 | 000,000,000 | —D | C] – C:\Program Files\GodsWar Online_Facebook
[2009/12/05 02:26:42 | 000,196,608 | —- | C] ( ) – C:\WINDOWS\System32\csnp2uvc.dll
[2009/12/05 02:26:39 | 000,172,032 | —- | C] ( ) – C:\WINDOWS\System32\rsnp2uvc.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/31 09:56:55 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/31 09:56:38 | 1063,510,016 | -HS- | M] () – C:\hiberfil.sys
[2011/03/31 08:52:32 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\imelda garde\Desktop\OTL.exe
[2011/03/31 04:03:18 | 000,001,702 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/03/31 04:03:00 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/03/31 03:03:27 | 000,579,302 | —- | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/03/31 00:46:50 | 000,022,895 | —- | M] () – C:\Documents and Settings\imelda garde\Desktop\ComboFix.exe.htm
[2011/03/31 00:21:48 | 004,309,203 | —- | M] () – C:\Documents and Settings\imelda garde\Desktop\ComboFix.exe
[2011/03/30 23:46:51 | 000,000,021 | —- | M] () – C:\WINDOWS\tpcsd
[2011/03/30 23:46:14 | 000,000,732 | —- | M] () – C:\Documents and Settings\imelda garde\Desktop\pcsafedoctor.lnk
[2011/03/30 22:28:19 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/03/27 20:56:07 | 000,001,666 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/03/27 18:42:08 | 000,000,786 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/27 18:13:40 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/19 23:01:07 | 000,004,916 | —- | M] () – C:\Documents and Settings\All Users\Application Data\ojobkspa.ako
[2011/03/17 13:37:35 | 000,048,202 | —- | M] () – C:\Documents and Settings\imelda garde\My Documents\CS 130 MP3.xml
[2011/03/12 15:59:34 | 000,002,385 | —- | M] () – C:\Documents and Settings\imelda garde\Desktop\Microsoft Office PowerPoint Viewer 2007.lnk
[2011/03/12 14:21:06 | 000,027,431 | —- | M] () – C:\Documents and Settings\imelda garde\My Documents\Walt Disney.odt
[2011/03/12 14:21:05 | 000,000,163 | -H– | M] () – C:\Documents and Settings\imelda garde\My Documents\.~lock.Walt Disney.odt#
[2011/03/08 21:54:26 | 000,012,830 | —- | M] () – C:\Documents and Settings\imelda garde\Desktop\Scott Pilgrim.xspf
[2011/03/02 04:50:11 | 000,025,190 | —- | M] () – C:\Documents and Settings\imelda garde\My Documents\Mama's Birthday.odt
[2011/03/01 17:58:45 | 000,017,115 | —- | M] () – C:\Documents and Settings\imelda garde\My Documents\MP2 CS 130.xml
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/31 09:56:38 | 1063,510,016 | -HS- | C] () – C:\hiberfil.sys
[2011/03/31 04:03:18 | 000,001,702 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/03/31 00:46:45 | 000,022,895 | —- | C] () – C:\Documents and Settings\imelda garde\Desktop\ComboFix.exe.htm
[2011/03/31 00:19:28 | 004,309,203 | —- | C] () – C:\Documents and Settings\imelda garde\Desktop\ComboFix.exe
[2011/03/30 23:46:51 | 000,000,021 | —- | C] () – C:\WINDOWS\tpcsd
[2011/03/30 23:46:14 | 000,000,732 | —- | C] () – C:\Documents and Settings\imelda garde\Desktop\pcsafedoctor.lnk
[2011/03/27 20:56:41 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2011/03/27 20:56:40 | 000,002,125 | —- | C] () – C:\WINDOWS\UDB.zip
[2011/03/27 20:56:40 | 000,000,882 | —- | C] () – C:\WINDOWS\RegSDImport.xml
[2011/03/27 20:56:40 | 000,000,879 | —- | C] () – C:\WINDOWS\RegISSImport.xml
[2011/03/27 20:56:40 | 000,000,131 | —- | C] () – C:\WINDOWS\IDB.zip
[2011/03/27 20:56:18 | 000,579,302 | —- | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/03/27 20:56:07 | 000,001,666 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2011/03/27 20:28:04 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/03/27 18:42:08 | 000,000,786 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/19 23:01:07 | 000,004,916 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ojobkspa.ako
[2011/03/17 13:35:08 | 000,048,202 | —- | C] () – C:\Documents and Settings\imelda garde\My Documents\CS 130 MP3.xml
[2011/03/12 11:45:28 | 000,000,163 | -H– | C] () – C:\Documents and Settings\imelda garde\My Documents\.~lock.Walt Disney.odt#
[2011/03/12 11:45:26 | 000,027,431 | —- | C] () – C:\Documents and Settings\imelda garde\My Documents\Walt Disney.odt
[2011/03/02 03:41:34 | 000,025,190 | —- | C] () – C:\Documents and Settings\imelda garde\My Documents\Mama's Birthday.odt
[2011/03/01 17:26:54 | 000,017,115 | —- | C] () – C:\Documents and Settings\imelda garde\My Documents\MP2 CS 130.xml
[2010/09/13 11:45:04 | 000,280,290 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/08/31 03:34:07 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/30 17:49:52 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/08/30 07:19:46 | 000,004,096 | —- | C] () – C:\WINDOWS\gcc.exe
[2010/07/13 16:49:13 | 000,000,096 | RHS- | C] () – C:\WINDOWS\System32\autorun.ini
[2010/07/07 18:50:36 | 000,091,648 | —- | C] () – C:\Documents and Settings\imelda garde\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/07 12:16:48 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/06/30 20:04:12 | 000,000,016 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2009/12/05 02:26:42 | 001,769,984 | —- | C] () – C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009/12/05 02:26:42 | 000,028,160 | —- | C] () – C:\WINDOWS\System32\drivers\sncduvc.sys
[2009/12/05 02:26:42 | 000,000,036 | —- | C] () – C:\WINDOWS\PidList.ini
[2009/04/08 20:32:22 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/04/08 19:13:16 | 000,000,169 | —- | C] () – C:\WINDOWS\FR-CA.INI
[2009/04/08 19:13:16 | 000,000,169 | —- | C] () – C:\WINDOWS\EN-CA.INI
[2009/04/08 19:13:16 | 000,000,168 | —- | C] () – C:\WINDOWS\ZH.INI
[2009/04/08 19:13:16 | 000,000,168 | —- | C] () – C:\WINDOWS\S3.INI
[2009/04/08 19:08:45 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\RtNicProp32.dll
[2009/04/08 19:07:54 | 000,090,772 | —- | C] () – C:\WINDOWS\System32\drivers\RtConvEQ.DAT
[2009/04/08 19:07:54 | 000,000,672 | —- | C] () – C:\WINDOWS\System32\drivers\SamSfPa.dat
[2009/04/08 19:07:54 | 000,000,536 | —- | C] () – C:\WINDOWS\System32\drivers\RtHdatEx.dat
[2009/04/08 19:07:54 | 000,000,520 | —- | C] () – C:\WINDOWS\System32\drivers\RTEQEX2.dat
[2009/04/08 19:07:54 | 000,000,520 | —- | C] () – C:\WINDOWS\System32\drivers\RTEQEX1.dat
[2009/04/08 19:07:54 | 000,000,520 | —- | C] () – C:\WINDOWS\System32\drivers\RTEQEX0.dat
[2009/04/08 19:07:54 | 000,000,016 | —- | C] () – C:\WINDOWS\System32\drivers\rtkhdaud.dat
[2009/04/08 19:06:30 | 000,004,343 | —- | C] () – C:\WINDOWS\System32\lpgun.ini
[2009/04/08 19:06:20 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\igdlogin.dll
[2009/04/08 18:11:53 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2009/04/08 18:11:51 | 000,655,694 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2009/04/08 18:11:51 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2009/04/08 18:11:51 | 000,172,592 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2009/04/08 18:11:51 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2009/04/08 18:11:50 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2009/04/08 18:11:50 | 000,004,524 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2009/04/08 18:11:49 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2009/04/08 18:11:45 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2009/04/08 18:11:45 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2009/04/08 18:11:39 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2009/04/08 18:11:37 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2009/04/08 17:39:35 | 000,032,768 | —- | C] () – C:\WINDOWS\AMove.exe
[2009/04/08 17:39:35 | 000,008,844 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2009/04/08 17:38:32 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/04/08 17:33:32 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/04/08 17:32:05 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2009/04/08 10:27:38 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/04/08 10:26:38 | 000,270,192 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2010/06/29 23:06:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2DBoy
[2011/03/31 03:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/12/28 17:23:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\c78e0a
[2010/10/06 01:25:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy2
[2011/03/27 18:44:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2010/06/29 23:56:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Playrix Entertainment
[2011/03/31 10:31:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Temp
[2010/07/17 23:12:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2011/02/13 03:41:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/06/29 23:33:20 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\iWin
[2011/03/27 18:27:57 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\Kalydo
[2011/03/19 23:01:16 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\MOVAVI
[2010/07/17 18:24:30 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\MSNInstaller
[2011/03/06 15:49:27 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\Notepad++
[2010/08/30 11:11:54 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\OpenOffice.org
[2011/03/27 18:40:12 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\PriceGong
[2010/09/05 00:04:19 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\Uniblue
[2011/03/31 10:50:07 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\uTorrent
[2010/06/29 23:00:20 | 000,000,000 | —D | M] – C:\Documents and Settings\imelda garde\Application Data\WildTangentv1001

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/04/08 17:35:55 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/01/11 04:20:29 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2009/04/08 17:35:55 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/03/31 09:56:38 | 1063,510,016 | -HS- | M] () – C:\hiberfil.sys
[2009/04/08 17:35:55 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/04/08 17:35:55 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 21:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 21:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/03/31 09:56:31 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2011/03/27 18:22:42 | 000,092,748 | —- | M] () – C:\TDSSKiller.2.4.21.0_27.03.2011_18.21.41_log.txt
[2011/03/27 18:37:33 | 000,047,454 | —- | M] () – C:\TDSSKiller.2.4.21.0_27.03.2011_18.36.49_log.txt
[2011/03/27 19:02:21 | 000,047,450 | —- | M] () – C:\TDSSKiller.2.4.21.0_27.03.2011_19.00.32_log.txt
[2011/03/27 20:43:16 | 000,047,710 | —- | M] () – C:\TDSSKiller.2.4.21.0_27.03.2011_20.41.13_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/19 04:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/30 03:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/19 04:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/30 03:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/04/08 17:35:21 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 21:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/27 11:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 19:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/08 00:12:17 | 000,038,848 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/03/17 10:10:56 | 000,001,666 | -H– | M] () – C:\Documents and Settings\imelda garde\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/04/08 10:26:18 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/04/08 10:26:18 | 001,064,960 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/04/08 10:26:18 | 000,888,832 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/04/08 17:36:03 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/01/11 04:21:11 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\imelda garde\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/04/08 17:39:56 | 000,000,079 | —- | M] () – C:\Documents and Settings\imelda garde\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/03/31 00:21:48 | 004,309,203 | —- | M] () – C:\Documents and Settings\imelda garde\Desktop\ComboFix.exe
[2011/03/31 08:52:32 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\imelda garde\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-30 18:03:35

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:430C6D84

< End of report >
Post #4
Here is the Extras.txt:

OTL Extras logfile created on: 3/31/2011 10:13:49 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\imelda garde\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 352.00 Mb Available Physical Memory | 35.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 141.05 Gb Total Space | 21.58 Gb Free Space | 15.30% Space Free | Partition Type: NTFS
Drive D: | 3.72 Gb Total Space | 2.19 Gb Free Space | 58.93% Space Free | Partition Type: FAT32

Computer Name: MELDSNETBOOK | User Name: imelda garde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe" = C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe:*:Enabled:Apache HTTP Server – (Apache Software Foundation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 23
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{307BFD68-0886-47AD-B461-5607F63B8B42}" = Microsoft Web Platform Installer 3.0
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{32A3A4F4-B792-11D6-A78A-00B0D0160000}" = Java™ SE Development Kit 6
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = WebCam
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Gateway Recovery Management
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Video Web Camera
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BE}" = WinZip 15.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Free Antivirus
"Browser Defender_is1" = Browser Defender 3.0
"CCleaner" = CCleaner
"CDisplay_is1" = CDisplay 1.8
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"conduitEngine" = Conduit Engine
"Gateway Screensaver" = Gateway ScreenSaver
"GodsWar Online_Facebook_is1" = GodsWar Online
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun
"LManager" = Launch Manager
"LPCO" = Intel® Graphics Media Accelerator 500
"Magic Workstation_is1" = Magic Workstation 0.94f
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MTG GamePack for Magic Workstation_is1" = MTG GamePack for Magic Workstation
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Notepad++" = Notepad++
"PCSafeDoctor_is1" = PCSafeDoctor
"Softonic-Eng7 Toolbar" = Softonic-Eng7 Toolbar
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.4
"Spyware Doctor" = Spyware Doctor 8.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"uTorrent" = µTorrent
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"VLC media player" = VLC media player 1.1.7
"WampServer 2_is1" = WampServer 2.0
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"KalydoPlayer" = Kalydo Player 3.09.00

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/30/2011 9:29:26 AM | Computer Name = MELDSNETBOOK | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/30/2011 9:40:52 AM | Computer Name = MELDSNETBOOK | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 3/30/2011 9:40:52 AM | Computer Name = MELDSNETBOOK | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 3/30/2011 9:42:06 AM | Computer Name = MELDSNETBOOK | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 3/30/2011 9:42:06 AM | Computer Name = MELDSNETBOOK | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 3/30/2011 11:26:29 AM | Computer Name = MELDSNETBOOK | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/30/2011 12:20:40 PM | Computer Name = MELDSNETBOOK | Source = Application Hang | ID = 1002
Description = Hanging application XoftSpySE.exe, version 7.0.1.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/30/2011 2:55:35 PM | Computer Name = MELDSNETBOOK | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 3/30/2011 2:55:53 PM | Computer Name = MELDSNETBOOK | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 3/30/2011 3:00:31 PM | Computer Name = MELDSNETBOOK | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3989, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 3/30/2011 10:00:28 AM | Computer Name = MELDSNETBOOK | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/30/2011 10:01:08 AM | Computer Name = MELDSNETBOOK | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Fips intelppm SASDIFSV SASKUTIL

Error - 3/30/2011 10:27:08 AM | Computer Name = MELDSNETBOOK | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/30/2011 12:21:40 PM | Computer Name = MELDSNETBOOK | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_SASDIFSV\0000 disappeared from the system without
first being prepared for removal.

Error - 3/30/2011 12:21:40 PM | Computer Name = MELDSNETBOOK | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_SASKUTIL\0000 disappeared from the system without
first being prepared for removal.

Error - 3/30/2011 12:26:38 PM | Computer Name = MELDSNETBOOK | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000043'
while processing the file 'resume.dat.new' on the volume 'HarddiskVolume2'. It
has stopped monitoring the volume.

Error - 3/30/2011 8:16:18 PM | Computer Name = MELDSNETBOOK | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/30/2011 8:17:21 PM | Computer Name = MELDSNETBOOK | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Aavmker4 aswSP aswTdi Fips intelppm

Error - 3/30/2011 8:52:55 PM | Computer Name = MELDSNETBOOK | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 3/30/2011 8:53:58 PM | Computer Name = MELDSNETBOOK | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}


< End of report >
Post #5
I'm sorry to be asking this but I'm not really good with computers, how can I disable script blocking protection in my computer?
Post #8
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #9
I cannot download the combofix onto my Desktop directly since I am no longer able to connect to the internet via my Computer. I think some kind of malware is responsible for this. Is it okay to download combofix from another PC and then copy paste it onto my Desktop or will this create some problems?
Post #12
Hi

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/index.php?showtopic=117826&view=findpost&p=721773

Collect::
c:\documents and settings\All Users\Application Data\c78e0a\PIc78_2209.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PIS"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT



Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Post #13 last edited
Here is the extra data you asked for.

Combofix:

ComboFix 11-03-31.01 - imelda garde 04/01/2011 12:29:31.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.496 [GMT 9:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\imelda garde\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
file zipped: c:\documents and settings\All Users\Application Data\c78e0a\PIc78_2209.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\c78e0a\PIc78_2209.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-01 to 2011-04-01 )))))))))))))))))))))))))))))))
.
.
2011-03-30 19:03 . 2010-09-07 14:47 17744 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-03-30 19:03 . 2010-09-07 14:52 165584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-03-30 19:03 . 2010-09-07 14:47 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-03-30 19:03 . 2010-09-07 14:52 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-03-30 19:02 . 2010-09-07 14:47 100176 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-03-30 19:02 . 2010-09-07 14:47 94544 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-03-30 19:02 . 2010-09-07 14:46 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-03-30 18:59 . 2010-09-07 15:12 38848 —-a-w- c:\windows\avastSS.scr
2011-03-30 18:59 . 2010-09-07 15:11 167592 —-a-w- c:\windows\system32\aswBoot.exe
2011-03-30 15:37 . 2011-03-30 15:37 ——– d—–w- c:\program files\Sophos
2011-03-27 12:17 . 2011-03-27 12:17 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-03-27 12:17 . 2011-03-27 12:17 ——– d—–w- c:\documents and settings\imelda garde\Application Data\SUPERAntiSpyware.com
2011-03-27 11:56 . 2011-01-07 05:54 767952 —-a-w- c:\windows\BDTSupport.dll
2011-03-27 11:56 . 2011-01-07 05:54 149456 —-a-w- c:\windows\SGDetectionTool.dll
2011-03-27 11:56 . 2011-01-07 05:54 1533904 —-a-w- c:\windows\PCTBDRes.dll
2011-03-27 11:56 . 2011-01-07 05:54 2000848 —-a-w- c:\windows\PCTBDCore.dll
2011-03-27 11:55 . 2011-03-31 13:22 ——– d—–w- c:\program files\PC Tools Security
2011-03-27 11:52 . 2011-03-31 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2011-03-27 11:28 . 2011-03-30 13:28 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-03-27 09:50 . 2011-03-27 09:50 ——– d—–w- c:\program files\Hitman Pro 3.5
2011-03-27 09:44 . 2011-03-27 09:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-03-27 09:42 . 2011-03-27 09:42 ——– d—–w- c:\documents and settings\imelda garde\Application Data\Malwarebytes
2011-03-27 09:42 . 2010-12-20 09:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-27 09:42 . 2010-12-20 09:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-03-27 09:30 . 2011-03-27 09:30 ——– d—–w- c:\windows\system32\wbem\Repository
2011-03-27 09:27 . 2011-03-27 09:27 ——– d—–w- c:\documents and settings\imelda garde\Application Data\Kalydo
2011-03-27 08:56 . 2011-03-27 08:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-03-27 08:56 . 2011-03-27 09:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-03-19 14:01 . 2011-03-19 14:01 ——– d—–w- c:\documents and settings\imelda garde\Application Data\MOVAVI
2011-03-07 00:04 . 2011-03-27 09:28 ——– d—–w- c:\program files\GodsWar Online_Facebook
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2009-04-08 09:11 270848 —-a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2009-04-08 09:11 186880 —-a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2009-04-08 08:32 2067456 —-a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2009-04-08 08:31 677888 —-a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2009-04-08 09:11 439296 —-a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2009-04-08 09:11 290048 —-a-w- c:\windows\system32\atmfd.dll
2011-01-06 02:54 . 2011-03-27 11:56 2125 —-a-w- c:\windows\UDB.zip
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-01_02.14.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-01 03:39 . 2011-04-01 03:39 16384 c:\windows\Temp\Perflib_Perfdata_5f4.dat
+ 2009-12-04 17:19 . 2011-04-01 03:21 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-04 17:19 . 2011-03-31 01:03 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-12-04 17:19 . 2011-04-01 03:21 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-12-04 17:19 . 2011-03-31 01:03 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2011-04-01 03:21 . 2011-04-01 03:21 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-12-04 17:19 . 2011-03-31 01:03 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSoft.dll" [2010-11-13 3913000]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-11-29 06:26 3908192 —-a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
2010-11-13 12:58 3913000 —-a-w- c:\program files\Softonic-Eng7\tbSoft.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-11-29 06:26 3908192 —-a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}"= "c:\program files\Softonic-Eng7\tbSoft.dll" [2010-11-13 3913000]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}"= "c:\program files\Softonic-Eng7\tbSoft.dll" [2010-11-13 3913000]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-12-12 395640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-28 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-28 348160]
"PersistenceThread"="c:\windows\system32\PersistenceThread.exe" [2009-03-28 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-24 17567744]
"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2006-07-17 53248]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-10-25 237568]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-27 1434920]
"snp2uvc"="c:\windows\system32\csnp2uvc.dll" [2008-11-04 196608]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-03-05 805384]
"VideoWebCamera"="c:\program files\VideoWebCamera\VideoWebCamera.exe" [2009-03-27 1552497]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-01-07 108496]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
.
c:\documents and settings\imelda garde\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-10-29 612168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igdlogin]
2009-03-28 22:43 65536 —-a-w- c:\windows\system32\igdlogin.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\wamp\\bin\\apache\\Apache2.2.11\\bin\\httpd.exe"=
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/31/2011 4:03 AM 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/31/2011 4:03 AM 17744]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [3/27/2011 8:56 PM 247760]
R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [4/8/2009 7:06 PM 5095360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/8/2009 7:07 PM 1684736]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys –> c:\windows\system32\DRIVERS\ewusbfake.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\54.tmp –> c:\windows\system32\54.tmp [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2405280
mStart Page = hxxp://rnd009.googlepages.com/google.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = proxy8.up.edu.ph:8080
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\imelda garde\Application Data\Mozilla\Firefox\Profiles\3zhitk1b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=ConduitEngine&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Conduit Engine Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=&SearchSource=13
FF - prefs.js: network.proxy.ftp - proxy7.up.edu.ph
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - proxy7.up.edu.ph
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - proxy7.up.edu.ph
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - proxy7.up.edu.ph
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - proxy7.up.edu.ph
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Browser Defender Toolbar: {cb84136f-9c44-433a-9048-c5cd9df1dc16} - c:\program files\PC Tools Security\BDT\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Conduit Engine : [removed] - %profile%\extensions\[removed]
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Softonic-Eng7 Community Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - %profile%\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-01 12:39
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\54.tmp"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1656)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\wscntfy.exe
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Completion time: 2011-04-01 12:49:12 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-01 03:49
ComboFix2.txt 2011-04-01 02:24
.
Pre-Run: 25,852,461,056 bytes free
Post-Run: 25,888,772,096 bytes free
.
- - End Of File - - 84AEA0D018682434CCD79A4A8D703F3A
Upload was successful

Attachments:

Post #14 last edited
Hi,

Please navigate to the following file and delete it. If you installed this program on your system, I suggest you uninstall it.

C:\Documents and Settings\imelda garde\My Documents\Downloads\PCSafeDoctor_Setup.exe


NEXT

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
  • Scroll down to where it says Java Runtime Environment (JRE) 6 Update 24 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
  • Click the Download button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
  • Click Continue The page will refresh.
  • Click on the link to download Windows Offline Installation and Save the file to your Desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java.
  • Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java™ SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u24-windows-i586-p.exe to install the newest version.
  • After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button.
    • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window. Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
  • Click OK to leave the Temporary Files Window.
  • Click OK to leave the Java Control Panel.
  • Delete jre-6u24-windows-i586-p.exe from your desktop.


NEXT


Please post a fresh DDS Log and advise how your computer is running now and if there are any outstanding issues.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI