Spyware / Malware / Virus Removal

Maybe not a viirus, unsure

15 min read

Looking for the outcome? Ask AI

scudo Topic Starter

Post #1April 23, 2011, 8:30 PM UTC last edited April 24, 2011, 11:19 AM UTC

Let me explain..
PC on the way out and in between houses so using a dongle at the moment (probably irrelevent)
I am using my laptop which is only for backup and hasnt been used for around 6 months.

If I google something, say a website and click on one of the links it redirects me to similar named links, eg

I want to access `turkish living forum` below is what google brings up…..

Turkish Living ForumThis is a discussion forum about Turkey, the country and the people and places like Altinkum, Alanya, Akbuk, Kusadasi, Bodrum, Fethiye Calis and Living in …
www.turkishliving.com/ - Cached - Similar
Forums
Altinkum Forum
Yalikavak Forum Bodrum Forum
134
More results from turkishliving.com »

Now normally if I click on say `altinkum forum` I would be take straight to it, but on this particular one I am redirected to `search pro` and it gives me all sorts of links for turkish related items. It is similar with other google searches. If I copy/paste the web address it does take me to the turkish living website.

I am not sure if this is some type of virus or just a setting I need to change somewhere. I have no other issues with laptop, I did run malwarebytes and it found 2 threats which were removed.

I have used the self help for `google redirect` but didnt change anything. Run ATF cleaner / Goored fix / TDS killer.

Any help appreciated.
thanks

oldman960

Post #2April 24, 2011, 9:50 PM UTC

Hi scudo,

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Do these redirects occur in any particular browser or all browsers?

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
/md5stop
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

scudo

Post #3April 25, 2011, 7:34 AM UTC

Do these redirects occur in any particular browser or all browsers?

I only use Internet Explorer.

OTL logfile created on: 25/04/2011 08:16:47 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Stan\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

759.00 Mb Total Physical Memory | 272.00 Mb Available Physical Memory | 36.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.17 Gb Total Space | 18.09 Gb Free Space | 52.95% Space Free | Partition Type: NTFS
Drive E: | 44.14 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: STANSLAPTOP | User Name: Stan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Stan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe (Affinegy, Inc.)
PRC - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe (Affinegy, Inc.)
PRC - C:\Program Files\Virgin Broadband Wireless\wpa_supplicant.exe ()
PRC - C:\Program Files\Virgin Broadband Wireless\ndis_events.exe ()
PRC - C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\WINDOWS\Dit.exe (ICSI Technology Ltd.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Stan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (VmbService) – C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AffinegyService) – C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe (Affinegy, Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (CardReaderFilter) – C:\WINDOWS\system32\drivers\USBCRFT.SYS (ICSI Technology Ltd.)
DRV - (ZTEusbnet) – C:\WINDOWS\system32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbvoice) – C:\WINDOWS\system32\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (vodafone_K380x-z_dc_enum) – C:\WINDOWS\system32\drivers\vodafone_K380x-z_dc_enum.sys (Vodafone)
DRV - (windrvNT) – C:\WINDOWS\system32\windrvNT.sys ()
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (iegdmini) – C:\WINDOWS\system32\drivers\iegdmini.sys (Intel Corporation)
DRV - (sdvo) – C:\WINDOWS\system32\drivers\sdvo.sys ()
DRV - (analog) – C:\WINDOWS\system32\drivers\analog.sys ()
DRV - (lvds) – C:\WINDOWS\system32\drivers\lvds.sys ()
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (AFGSp50) – C:\WINDOWS\system32\drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (tapvpn) – C:\WINDOWS\system32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (pgfilter) – C:\Program Files\PeerGuardian2\pgfilter.sys ()
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"

[2010/04/21 11:49:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stan\Application Data\Mozilla\Firefox\Profiles\70a1kru4.default\extensions
[2006/01/03 17:18:31 | 000,000,000 | —D | M] (Firefox (default)) – C:\Documents and Settings\Stan\Application Data\Mozilla\Firefox\Profiles\70a1kru4.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/07/19 11:58:04 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stan\Application Data\Mozilla\Firefox\Profiles\70a1kru4.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2006/01/03 17:18:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2004/08/04 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKCU\..\Toolbar\ShellBrowser: (Stumble&Upon) - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1934.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Stumble&Upon) - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1934.dll ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Dit] C:\WINDOWS\Dit.exe (ICSI Technology Ltd.)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [Wireless Manager] C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe (Affinegy, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled [2009/04/20 16:03:42 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: stumbleupon.com ([]* in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {556EEC63-31E2-47C3-BF29-DFF799D2FE04} https://secure.logmein.com/activex/RACtrl.cab (Remote Access ActiveX Client)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/09/13 23:45:26 | 000,000,120 | R— | M] () - E:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{62ff00d9-6755-11e0-9405-0014228efae2}\Shell - "" = AutoRun
O33 - MountPoints2\{62ff00d9-6755-11e0-9405-0014228efae2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{62ff00d9-6755-11e0-9405-0014228efae2}\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe – [2010/07/08 12:14:50 | 000,274,432 | R— | M] (Vodafone)
O33 - MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\Shell\AutoRun\command - "" = k8jc.exe
O33 - MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\Shell\open\Command - "" = k8jc.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe – [2010/07/08 12:14:50 | 000,274,432 | R— | M] (Vodafone)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2011/04/24 23:50:05 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Stan\Desktop\OTL.exe
[2011/04/23 22:16:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Desktop\bikes
[2011/04/21 16:09:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Desktop\Boness
[2011/04/18 23:01:00 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/04/18 23:00:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/04/18 22:57:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\Temp
[2011/04/18 22:56:54 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/04/18 20:57:42 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/04/18 20:57:36 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/04/18 20:57:25 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/04/18 20:56:40 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/04/18 20:56:40 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/04/18 20:56:40 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2011/04/18 20:56:40 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/04/18 20:56:39 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2011/04/18 20:56:39 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/04/18 20:56:39 | 000,000,000 | —D | C] – C:\0042a3789f6a7c5940
[2011/04/17 13:32:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Desktop\Pictures
[2011/04/16 22:52:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\My Documents\My Albums
[2011/04/16 22:52:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\IsolatedStorage
[2011/04/16 22:52:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\HP
[2011/04/16 22:52:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\My Documents\My Scans
[2011/04/16 22:39:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2011/04/16 22:37:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2011/04/16 22:37:46 | 000,626,960 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hpvaut32.dll
[2011/04/16 22:37:46 | 000,487,424 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hpvcp70.dll
[2011/04/16 22:37:46 | 000,344,064 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hpvcr70.dll
[2011/04/16 22:37:46 | 000,044,544 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSXML4a.dll
[2011/04/16 22:37:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Start Menu\Programs\HP
[2011/04/16 22:36:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\HP
[2011/04/16 22:26:47 | 000,061,440 | —- | C] (HP) – C:\WINDOWS\System32\HPZinw12.exe
[2011/04/16 22:26:46 | 000,278,584 | —- | C] (HP) – C:\WINDOWS\System32\HPZidr12.dll
[2011/04/16 22:26:46 | 000,204,800 | —- | C] (HP) – C:\WINDOWS\System32\HPZipr12.dll
[2011/04/16 22:26:46 | 000,094,208 | —- | C] (HP) – C:\WINDOWS\System32\HPZipt12.dll
[2011/04/16 22:26:46 | 000,065,536 | —- | C] (HP) – C:\WINDOWS\System32\HPZipm12.exe
[2011/04/16 22:26:46 | 000,057,344 | —- | C] (HP) – C:\WINDOWS\System32\HPZisn12.dll
[2011/04/16 22:23:47 | 000,000,000 | —D | C] – C:\Program Files\HP
[2011/04/16 22:17:23 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2011/04/16 22:11:26 | 000,581,632 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hpotscl.dll
[2011/04/16 22:11:26 | 000,270,336 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\HPZc3212.dll
[2011/04/16 22:11:26 | 000,090,112 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hpovst08.dll
[2011/04/16 22:11:09 | 000,180,315 | —- | C] (HP) – C:\WINDOWS\System32\hpzsnt10.dll
[2011/04/16 22:11:08 | 000,344,064 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\hpzcon10.dll
[2011/04/16 22:11:08 | 000,196,608 | —- | C] (HP) – C:\WINDOWS\System32\hpzcoi10.dll
[2011/04/16 18:31:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Application Data\Hewlett-Packard
[2011/04/16 17:27:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Hewlett-Packard
[2011/04/16 17:24:42 | 000,000,000 | —D | C] – C:\Program Files\Hewlett-Packard
[2011/04/16 17:12:04 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2011/04/16 16:40:39 | 000,009,216 | R— | C] (MBB Incorporated) – C:\WINDOWS\System32\drivers\massfilter.sys
[2011/04/16 16:04:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Application Data\FLEXnet
[2011/04/16 15:58:56 | 000,114,688 | R— | C] (ZTE Corporation) – C:\WINDOWS\System32\drivers\ZTEusbnet.sys
[2011/04/16 15:58:30 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys
[2011/04/16 15:58:26 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zteusbvoice.sys
[2011/04/16 15:58:21 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys
[2011/04/16 15:58:17 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys
[2011/04/16 15:58:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Application Data\Vodafone
[2011/04/16 15:57:15 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsgXP_2k3.dll
[2011/04/16 15:56:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Vodafone
[2011/04/16 15:56:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2011/04/16 15:56:24 | 000,000,000 | —D | C] – C:\Program Files\Vodafone
[2011/04/16 15:56:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\FLEXnet
[2011/04/16 15:55:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\{F3E8BCCE-24B6-4737-920E-0D6073630E2A}
[2006/02/12 12:35:35 | 028,863,189 | —- | C] (eBay ) – C:\Program Files\setupUS.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/25 08:06:25 | 000,013,568 | —- | M] (ICSI Technology Ltd.) – C:\WINDOWS\System32\drivers\USBCRFT.SYS
[2011/04/25 08:01:57 | 000,443,034 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/25 08:01:57 | 000,072,134 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/04/25 08:01:05 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/25 07:58:16 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/25 07:58:14 | 000,000,278 | -H– | M] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2011/04/25 07:57:49 | 000,000,306 | —- | M] () – C:\WINDOWS\tasks\iwiuzeq.job
[2011/04/25 07:57:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/25 07:57:39 | 796,327,936 | -HS- | M] () – C:\hiberfil.sys
[2011/04/24 23:50:06 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Stan\Desktop\OTL.exe
[2011/04/24 23:13:29 | 002,589,189 | —- | M] () – C:\Documents and Settings\Stan\Desktop\Lynda licence.jpg
[2011/04/23 22:56:52 | 001,165,598 | —- | M] () – C:\Documents and Settings\Stan\Desktop\scan0003.jpg
[2011/04/18 23:00:39 | 000,001,915 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/04/18 21:10:33 | 000,250,288 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/17 16:03:53 | 000,209,920 | —- | M] () – C:\Documents and Settings\Stan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/16 23:40:42 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/16 22:52:25 | 000,000,127 | —- | M] () – C:\Documents and Settings\Stan\Local Settings\Application Data\fusioncache.dat
[2011/04/16 22:43:28 | 000,104,156 | —- | M] () – C:\WINDOWS\hpoins04.dat
[2011/04/16 22:41:14 | 000,000,798 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
[2011/04/16 22:38:07 | 000,001,808 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2011/04/16 17:06:52 | 000,002,515 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SMS.lnk
[2011/04/16 15:57:23 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K380x-z_dc_enum_01009.Wdf
[2011/04/16 15:57:21 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011/04/16 15:56:50 | 000,001,911 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Broadband.lnk
[2011/04/14 20:39:52 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/24 23:09:10 | 001,165,598 | —- | C] () – C:\Documents and Settings\Stan\Desktop\scan0003.jpg
[2011/04/20 20:49:36 | 002,589,189 | —- | C] () – C:\Documents and Settings\Stan\Desktop\Lynda licence.jpg
[2011/04/18 23:00:39 | 000,001,915 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/04/18 22:56:47 | 000,000,882 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/18 22:56:46 | 000,000,878 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/16 22:52:25 | 000,000,127 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\fusioncache.dat
[2011/04/16 22:41:14 | 000,000,798 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
[2011/04/16 22:39:36 | 000,000,731 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\I.R.I.S. OCR Registration.lnk
[2011/04/16 22:38:07 | 000,001,808 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2011/04/16 22:11:42 | 000,104,156 | —- | C] () – C:\WINDOWS\hpoins04.dat
[2011/04/16 22:11:42 | 000,017,176 | —- | C] () – C:\WINDOWS\hpomdl04.dat
[2011/04/16 15:57:23 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K380x-z_dc_enum_01009.Wdf
[2011/04/16 15:57:21 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011/04/16 15:56:50 | 000,002,515 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SMS.lnk
[2011/04/16 15:56:50 | 000,001,911 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Broadband.lnk
[2010/08/11 11:43:50 | 000,159,464 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4
[2010/07/20 08:17:13 | 000,184,832 | —- | C] () – C:\WINDOWS\Mqoqeb.exe
[2010/07/19 19:57:28 | 000,184,832 | —- | C] () – C:\WINDOWS\Mqoqea.exe
[2010/07/19 19:56:49 | 000,045,056 | —- | C] () – C:\Documents and Settings\Stan\Application Data\b07a1ef2.exe
[2010/07/17 20:11:45 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/04/20 07:58:32 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/04/18 21:47:25 | 000,033,792 | —- | C] () – C:\WINDOWS\System32\drivers\tv.sys.BAK.sys
[2009/04/18 21:47:25 | 000,033,152 | —- | C] () – C:\WINDOWS\System32\drivers\sdvo.sys
[2009/04/18 21:47:24 | 000,367,488 | —- | C] () – C:\WINDOWS\System32\iegd3dg3.dll
[2009/04/18 21:47:24 | 000,007,424 | —- | C] () – C:\WINDOWS\System32\drivers\analog.sys
[2009/04/18 21:47:24 | 000,007,296 | —- | C] () – C:\WINDOWS\System32\drivers\lvds.sys
[2009/04/18 09:22:42 | 002,545,152 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\cooliris-win-ie-release-1.10.0.24532.en-US.msi
[2009/03/09 22:37:40 | 002,351,616 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\cooliris-win-ie-release-1.9.1.17582.msi
[2008/10/31 22:27:25 | 000,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/10/31 22:27:23 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/03/08 10:39:54 | 000,035,363 | —- | C] () – C:\WINDOWS\System32\windrvNT.sys
[2008/03/08 10:39:53 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\suppdll.dll
[2007/10/04 10:49:46 | 000,000,260 | R— | C] () – C:\WINDOWS\Dit.INI
[2007/10/04 10:49:44 | 000,024,576 | —- | C] () – C:\WINDOWS\CICache.exe
[2006/05/14 07:57:45 | 000,209,920 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/21 23:13:15 | 000,348,160 | —- | C] () – C:\WINDOWS\System32\s1940.dll
[2006/04/10 12:18:12 | 000,007,920 | —- | C] () – C:\WINDOWS\System32\ractrlkeyhook.dll
[2006/03/15 07:53:43 | 000,434,176 | —- | C] () – C:\WINDOWS\System32\s1939.dll
[2006/03/06 07:30:22 | 000,434,176 | —- | C] () – C:\WINDOWS\System32\s1938.dll
[2006/02/21 07:55:03 | 000,409,600 | —- | C] () – C:\WINDOWS\System32\s1937.dll
[2006/02/16 00:49:35 | 000,409,600 | —- | C] () – C:\WINDOWS\System32\s1936.dll
[2006/01/29 22:41:41 | 000,610,304 | —- | C] () – C:\WINDOWS\System32\s1934.dll
[2006/01/08 21:28:33 | 000,051,733 | —- | C] () – C:\WINDOWS\System32\hippy.dat
[2006/01/03 17:39:59 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/02 18:38:00 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/01/01 22:20:07 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2005/12/15 18:23:18 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/12/15 18:17:43 | 000,003,137 | —- | C] () – C:\WINDOWS\mozver.dat
[2005/12/15 18:16:21 | 000,000,354 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/12/15 18:10:38 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/12/15 18:08:51 | 000,000,004 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2005/12/15 18:08:11 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2005/12/15 18:08:11 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2005/12/15 17:45:06 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2005/12/15 17:44:28 | 000,000,401 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/05/04 20:58:54 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/10 14:12:05 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 14:07:31 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 14:02:15 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 14:01:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 13:57:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 13:57:15 | 000,250,288 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 13:51:21 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 13:51:20 | 000,443,034 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 13:51:20 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 13:51:20 | 000,072,134 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 13:51:20 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 13:51:18 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 13:51:17 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/10 13:51:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 13:51:12 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 13:51:11 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 13:51:05 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 13:50:56 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2010/07/17 20:11:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Affinegy
[2008/10/26 13:42:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2008/04/27 20:08:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Transparent
[2005/12/15 18:12:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/04/16 15:56:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2011/04/25 08:21:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\Affinegy
[2010/05/25 14:11:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\Azureus
[2010/08/03 14:59:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\BitTorrent
[2010/07/20 14:25:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\uTorrent
[2011/04/16 15:58:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\Vodafone
[2010/01/07 21:20:48 | 000,000,310 | —- | M] () – C:\WINDOWS\Tasks\Install_NSS.job
[2011/04/25 07:57:49 | 000,000,306 | —- | M] () – C:\WINDOWS\Tasks\iwiuzeq.job
[2011/02/10 10:45:09 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/04/25 07:58:14 | 000,000,278 | -H– | M] () – C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/01 18:33:50 | 000,000,735 | —- | M] () – C:\892.cin
[2004/08/10 14:04:08 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/06/29 02:58:24 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2004/08/10 14:04:08 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2005/12/15 17:48:44 | 000,004,609 | RH– | M] () – C:\dell.sdr
[2011/04/25 07:57:39 | 796,327,936 | -HS- | M] () – C:\hiberfil.sys
[2011/04/22 11:04:22 | 000,005,472 | —- | M] () – C:\hook.log
[2003/12/08 13:15:56 | 000,028,672 | R— | M] ( ) – C:\hpqimgrc.resources.dll
[2006/01/02 00:19:54 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2010/07/20 23:44:56 | 000,001,806 | —- | M] () – C:\InstallHelper.log
[2004/08/10 14:04:08 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2005/12/15 18:12:27 | 000,000,884 | -H– | M] () – C:\IPH.PH
[2011/04/22 14:46:37 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2004/08/10 14:04:08 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/07/15 13:45:19 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/25 07:57:37 | 1194,389,504 | -HS- | M] () – C:\pagefile.sys
[2005/10/31 16:56:00 | 000,700,416 | —- | M] (LimeWire) – C:\StubInstaller.exe
[2011/04/24 11:51:20 | 000,055,996 | —- | M] () – C:\TDSSKiller.2.4.21.0_24.04.2011_11.47.33_log.txt
[2011/04/16 22:53:06 | 000,001,167 | —- | M] () – C:\_Sid.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 14:03:42 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2006/02/12 12:36:34 | 028,863,189 | —- | M] (eBay ) – C:\Program Files\setupUS.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 13:56:48 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/10 13:56:46 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/10 13:56:46 | 000,872,448 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2010/07/15 13:53:35 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2011/04/16 22:41:14 | 000,000,902 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\HP Image Zone.lnk
[2011/04/16 22:36:52 | 000,000,804 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\HP Director.lnk
[2006/01/03 17:39:09 | 000,001,992 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\New Office Document.lnk
[2006/01/03 17:39:09 | 000,002,002 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Open Office Document.lnk
[2010/07/15 13:53:35 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2004/08/10 14:04:12 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2007/09/29 08:38:53 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-19 14:48:54

< MD5 for: EXPLORER.EX_ >
[2004/08/04 06:00:00 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\i386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/14 01:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 01:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 12:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 11:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 06:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: EXPLORER.EXE-02121B1A.PF >
[2011/04/24 18:39:43 | 000,070,950 | —- | M] () MD5=C9645FFA8817D3D104D1809B18FFFA74 – C:\WINDOWS\Prefetch\EXPLORER.EXE-02121B1A.pf

< MD5 for: EXPLORER.SC_ >
[2004/08/04 06:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\i386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2004/08/04 06:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\i386\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2004/08/04 06:00:00 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\i386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2008/04/14 01:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2004/08/04 06:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ie8\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-2D97EBE6.PF >
[2011/04/25 08:13:55 | 000,106,590 | —- | M] () MD5=6F62B79E46F94D5065C66A0037C7DC27 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf

< MD5 for: IEXPLORE.HLP >
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\i386\iexplore.hlp
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EXE >
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\i386\winlogon.exe
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/14 01:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 01:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< End of report >

scudo

Post #4April 25, 2011, 7:48 AM UTC

Extras report…

OTL Extras logfile created on: 25/04/2011 08:16:47 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Stan\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

759.00 Mb Total Physical Memory | 272.00 Mb Available Physical Memory | 36.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.17 Gb Total Space | 18.09 Gb Free Space | 52.95% Space Free | Partition Type: NTFS
Drive E: | 44.14 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: STANSLAPTOP | User Name: Stan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Lock folder with Folder Lock] – C:\Program Files\Folder Lock\Folder Lock.exe %1 (NewSoftwares.net Inc.)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"65000:TCP" = 65000:TCP:*:Enabled:Azureus

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" = C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe:LocalSubNet:Enabled:Wireless Manager – (Affinegy, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Vuze\Azureus.exe" = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze
"C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" = C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe:LocalSubNet:Enabled:Wireless Manager – (Affinegy, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent, Inc.)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth – (Google)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.3
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Internal Network Card Power Management
"{1F63ED0B-EDD2-4037-B6AB-1358C624AF48}" = Scan
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{21E75254-410E-49C4-8981-2E1A2A2221F2}" = HP Diagnostic Assistant
"{2405665A-16C9-4D3A-B70E-F006220E1472}" = Overland
"{258FA656-8E9A-4A62-98A4-CAF798913B5A}" = Before You Know It 3.6
"{267868CE-6DFF-40F7-9C58-C01119B7B117}" = Fax
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 13
"{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" = Broadcom Management Programs
"{2BBC9458-07CA-4843-848B-5C8146E5EFA8}" = CreativeProjects
"{2F71F2BA-B513-4113-969C-18A84D238E27}" = 1310
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{34A59AC3-6C5C-4A09-A7F5-369A37176C8A}" = AiOSoftware
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3AE681E0-4E8D-453F-950A-48534D3C0724}" = Copy
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{41254D7B-EADF-4078-AE4A-BD73B300EE86}" = Unload
"{457791C5-D702-4143-A7B2-2744BE9573F2}" = HP Software Update
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{597D73A8-5FDB-4bc1-9893-40B54459F1BC}" = ProductContext
"{5ADA9741-0570-4096-B5FE-1D55E57537D4}" = Camera Window
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband Lite
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{755D3B4E-D3A3-4D05-99D8-FC35E26A331C}" = File Viewer Utility 1.2.2
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{80413011-029C-4D6B-B3AD-725DDE60B81C}" = 1310Trb
"{83F3EED2-DDE2-4434-8FBE-9D2A1E7C2BC8}" = Multi-Card Reader & Flash Disk
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver for Mobile
"{90190409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Publisher 2003
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{981FB376-8418-4EA8-BBED-9DE5AA63E7D5}" = SkinsHP1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CB2512B-3EC4-43DF-8002-46BDAB5EDD1B}" = QuickProjects
"{9EEBF8D5-8712-4D1D-88F4-4CDC2D270BC3}" = PrintScreen
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A1DCC235-DACC-4E1F-8D11-D630634B4AEF}" = PhotoGallery
"{A2500497-FD32-493e-B8E5-28D6728DBEF5}" = Readme
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB3AC39D-9915-435D-ACC4-9881E75326BC}" = RemoteCapture 2.7.2
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B32C75F2-7495-4D01-9431-C11E97D66F8C}" = DocProc
"{B3D5D4E0-E965-41C4-ABFD-A7B1AD0663C2}" = Director
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B45D9FEE-1AF4-46F3-9A83-2545F81547F5}" = CreativeProjectsTemplates
"{B56D5B09-C4FB-4EA0-8EAD-7BC3E2715A2D}" = DocumentViewer
"{B754C893-6177-4061-9B2F-88F58C1C5166}" = CIG
"{BCC992E5-5C81-4066-9B55-03DC10B24D21}" = InstantShare
"{BE06114F-559D-11E0-B5A1-001D0926B1BF}" = Google Earth
"{BF018D2F-C788-4AB1-AB95-1280EAB8F13E}" = TrayApp
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon Utilities ZoomBrowser EX
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{E21658D0-8C83-4ADD-937B-6ED07F335ABA}" = 1310Tour
"{E7559288-223B-453C-9F06-340E3BE21E39}" = MyWay Search Assistant
"{E90BEB5B-CFA0-418E-9ABB-4C4A7B0D9483}" = 1310_Help
"{EC8673DA-F96B-497E-B2DB-BC7B029FD680}" = BufferChm
"{F11A403B-0DE9-4953-B790-7A2F014FBB2B}" = PhotoStitch
"{F4F47155-5B4D-42AA-97F8-490BC52EA7F3}" = Destinations
"{F65787F3-B356-45EC-8DD0-0E6758EDBCEE}" = WebReg
"{FF26F7EA-BCEE-478C-9A1B-6B4F88717D73}" = CueTour
"2B0D8F3C-18AD-4D8E-879A-74A867C5C3CB_is1" = Wireless Manager
"7-Zip" = 7-Zip 4.57
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BitTorrent" = BitTorrent
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"Browser Mouse Browser Mouse" = Browser Mouse
"CCleaner" = CCleaner (remove only)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"Folder Lock" = Folder Lock
"Free Hide Folder" = Free Hide Folder
"HijackThis" = HijackThis 1.99.1
"HP Photo & Imaging" = HP Image Zone 4.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{5ADA9741-0570-4096-B5FE-1D55E57537D4}" = Canon Camera Window for ZoomBrowser EX
"InstallShield_{755D3B4E-D3A3-4D05-99D8-FC35E26A331C}" = Canon Utilities File Viewer Utility 1.2
"InstallShield_{AB3AC39D-9915-435D-ACC4-9881E75326BC}" = Canon Utilities RemoteCapture 2.7
"InstallShield_{B754C893-6177-4061-9B2F-88F58C1C5166}" = Canon Internet Library for ZoomBrowser EX
"InstallShield_{F11A403B-0DE9-4953-B790-7A2F014FBB2B}" = Canon Utilities PhotoStitch 3.1
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"MWSnap 3" = MWSnap 3
"PeerGuardian_is1" = PeerGuardian 2.0
"PhotoRecord" = Canon PhotoRecord
"RealPlayer 6.0" = RealPlayer Basic
"Secunia PSI" = Secunia PSI
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 0.9.8a
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 22/04/2011 02:58:33 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 23/04/2011 02:20:45 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 23/04/2011 11:01:49 | Computer Name = STANSLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application vlc.exe, version 0.9.8.1, faulting module libvlccore.dll,
version 0.9.8.1, fault address 0x00016140.

Error - 23/04/2011 11:02:52 | Computer Name = STANSLAPTOP | Source = Application Error | ID = 1000
Description = Faulting application vlc.exe, version 0.9.8.1, faulting module libvout_directx_plugin.dll,
version 0.0.0.0, fault address 0x00005826.

Error - 23/04/2011 13:43:04 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 24/04/2011 04:27:11 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 24/04/2011 06:53:45 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 24/04/2011 09:36:03 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 24/04/2011 13:32:21 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 25/04/2011 02:57:52 | Computer Name = STANSLAPTOP | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

[ System Events ]
Error - 24/04/2011 13:24:02 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.73.124.124 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.70.80.129 (The DHCP Server
sent a DHCPNACK message).

Error - 24/04/2011 14:19:42 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.73.170.212 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.70.160.110 (The DHCP
Server sent a DHCPNACK message).

Error - 24/04/2011 15:15:47 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.70.160.109 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.72.211.253 (The DHCP
Server sent a DHCPNACK message).

Error - 24/04/2011 15:55:02 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.72.211.252 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.70.145.225 (The DHCP
Server sent a DHCPNACK message).

Error - 24/04/2011 16:45:47 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.70.145.231 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.70.230.185 (The DHCP
Server sent a DHCPNACK message).

Error - 24/04/2011 17:27:12 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.70.230.184 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.73.47.142 (The DHCP Server
sent a DHCPNACK message).

Error - 24/04/2011 18:38:02 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.73.47.141 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.73.217.25 (The DHCP Server
sent a DHCPNACK message).

Error - 24/04/2011 18:41:08 | Computer Name = STANSLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 10.73.217.27 for the Network Card with network
address 00A0C6000000 has been denied by the DHCP server 10.72.107.93 (The DHCP Server
sent a DHCPNACK message).

Error - 25/04/2011 03:17:29 | Computer Name = STANSLAPTOP | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 25/04/2011 03:17:29 | Computer Name = STANSLAPTOP | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

< End of report >

oldman960

Post #5April 25, 2011, 8:13 PM UTC last edited April 25, 2011, 8:16 PM UTC

Hi scudo,

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

copy and paste the following into the upload a file box (one at a time if more than one file is listed)

C:\WINDOWS\Mqoqeb.exe
C:\WINDOWS\Mqoqea.exe
C:\Documents and Settings\Stan\Application Data\b07a1ef2.exe

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O33 - MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\Shell\AutoRun\command - "" = k8jc.exe
O33 - MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\Shell\open\Command - "" = k8jc.exe

:Files

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log .

Please post back with

OTL fix log
VirusTotal results

Thanks

scudo

Post #6April 25, 2011, 9:40 PM UTC

Mqoqeb.exe log….

File name: Mqoqeb.exe
Submission date: 2011-04-25 20:36:13 (UTC)
Current status: finished
Result: 37 /42 (88.1%)
VT Community

not reviewed
Safety score: -
Compact Print results

There is a more up-to-date report (37/42) for this file.

Antivirus Version Last Update Result
AhnLab-V3 2011.04.26.00 2011.04.25 Win-Trojan/Downloader.184832.R
AntiVir 7.11.7.7 2011.04.25 TR/Agent.184832
Antiy-AVL 2.0.3.7 2011.04.25 Packed/Win32.Katusha.gen
Avast 4.8.1351.0 2011.04.25 Win32:MalOb-BR
Avast5 5.0.677.0 2011.04.25 Win32:MalOb-BR
AVG 10.0.0.1190 2011.04.25 Crypt.XWM
BitDefender 7.2 2011.04.25 Gen:Variant.Renos.38
CAT-QuickHeal 11.00 2011.04.25 Trojan.Renos.MJ
ClamAV 0.97.0.0 2011.04.25 Trojan.Agent-165989
Commtouch 5.3.2.6 2011.04.25 W32/FakeAlert.HL.gen!Eldorado
Comodo 8470 2011.04.25 MalCrypt.Indus!
DrWeb 5.0.2.03300 2011.04.25 Trojan.Siggen.64461
Emsisoft 5.1.0.5 2011.04.25 -
eSafe 7.0.17.0 2011.04.25 -
eTrust-Vet 36.1.8290 2011.04.25 Win32/Wardunlo.IP
F-Prot 4.6.2.117 2011.04.25 W32/FakeAlert.HL.gen!Eldorado
F-Secure 9.0.16440.0 2011.04.25 Trojan-Downloader:W32/Renos.GRS
Fortinet 4.2.257.0 2011.04.25 W32/PackedKatusha.B!tr.dldr
GData 22 2011.04.25 Gen:Variant.Renos.38
Ikarus T3.1.1.103.0 2011.04.25 -
Jiangmin 13.0.900 2011.04.25 Packed.Katusha.nuw
K7AntiVirus 9.98.4474 2011.04.25 Riskware
Kaspersky 9.0.0.837 2011.04.25 Packed.Win32.Katusha.o
McAfee 5.400.0.1158 2011.04.25 Downloader-CEW.b
McAfee-GW-Edition 2010.1D 2011.04.25 Heuristic.BehavesLike.Win32.Downloader.H
Microsoft 1.6802 2011.04.25 TrojanDownloader:Win32/Renos.LF
NOD32 6070 2011.04.25 Win32/TrojanDownloader.FakeAlert.AQI
Norman 6.07.07 2011.04.25 W32/Suspicious_Gen2.BTEFQ
Panda 10.0.3.5 2011.04.25 Trj/Katusha.AK
PCTools 7.0.3.5 2011.04.21 Trojan.FakeAV
Prevx 3.0 2011.04.25 High Risk Cloaked Malware
Rising 23.55.00.05 2011.04.25 Trojan.Win32.Generic.1231B721
Sophos 4.64.0 2011.04.25 Mal/FakeAV-BW
SUPERAntiSpyware 4.40.0.1006 2011.04.25 Trojan.Agent/Gen-CDesc[Gen]
Symantec 20101.3.2.89 2011.04.25 Trojan.FakeAV!gen29
TheHacker 6.7.0.1.182 2011.04.25 -
TrendMicro 9.200.0.1012 2011.04.25 TROJ_FAKEAV.SMA2
TrendMicro-HouseCall 9.200.0.1012 2011.04.25 TROJ_FAKEAV.SMA2
VBA32 3.12.16.0 2011.04.25 -
VIPRE 9118 2011.04.25 VirTool.Win32.Obfuscator.hg!b1 (v)
ViRobot 2011.4.25.4428 2011.04.25 Trojan.Win32.Itsproc.184832
VirusBuster 13.6.320.0 2011.04.25 Trojan.DL.FakeAlert!kzBBIEXz0lA
Additional informationShow all
MD5 : 941bfa021c02f0de1efaab869b45554e
SHA1 : 976ffcb2e5e9f28d0e48d49da85ba0c91cfb0254
SHA256: 92bd13a6ddbccc5451b7c7358a3523ce65d658f42b75f02465f57a248ffadae2
ssdeep: 3072:gZcGg12z4ICBRHCm35Zq4nvhAHkrqKsBoUay946h7MHKQidPcmwI:IqwvCBRHCe5Z95AEx
sB2y9nUiUmw
File size : 184832 bytes
First seen: 2011-04-25 20:36:13
Last seen : 2011-04-25 20:44:31
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

PEiD: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x6A70
timedatestamp….: 0x4AAF7D7A (Tue Sep 15 11:41:46 2009)
machinetype……: 0x14C (Intel I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
CODE, 0x1000, 0x9F7D, 0xA000, 3.48, 1c8e6be96706ed2bad8e15199b48d6a5
.rdata, 0xB000, 0x348B8, 0x21A00, 7.31, c2f6847dc3aa2a6b4038306ce5c19f66
.tls, 0x40000, 0x1058, 0x1200, 0.08, 0c8bc74f3ddcf6eb97d9c4f1e0e8818f

[[ 5 import(s) ]]
gdi32.dll: CreateDIBSection
kernel32.dll: ExitProcess, VirtualAlloc, GetModuleHandleA, SetEndOfFile, LocalAlloc, GetStringTypeW, GetLocalTime, GetProcAddress, CloseHandle, SizeofResource, GetCommandLineA, GetFileType, GlobalAlloc, GetOEMCP, SetFilePointer, lstrcmpA, GetFileAttributesA
oleaut32.dll: SafeArrayUnaccessData, SafeArrayPtrOfIndex, SysFreeString, SafeArrayGetUBound, OleLoadPicture, GetErrorInfo, SysStringLen
shell32.dll: SHGetFolderPathA, SHGetSpecialFolderLocation, SHGetDesktopFolder
version.dll: VerQueryValueA

Prevx Info:
http://info.prevx.com/aboutprogramtext.asp…8009F00D3E5B8DC
ExifTool:
file metadata
CodeSize: 40960
EntryPoint: 0x6a70
FileSize: 180 kB
FileType: Win32 EXE
ImageVersion: 0.0
InitializedDataSize: 142336
LinkerVersion: 2.6
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2009:09:15 13:41:46+02:00
UninitializedDataSize: 77824

Mqoqea.exe log…

File name: Mqoqea.exe
Submission date: 2011-04-25 20:44:31 (UTC)
Current status: queued queued analysing finished

Result: 37/ 42 (88.1%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.04.26.00 2011.04.25 Win-Trojan/Downloader.184832.R
AntiVir 7.11.7.7 2011.04.25 TR/Agent.184832
Antiy-AVL 2.0.3.7 2011.04.25 Packed/Win32.Katusha.gen
Avast 4.8.1351.0 2011.04.25 Win32:MalOb-BR
Avast5 5.0.677.0 2011.04.25 Win32:MalOb-BR
AVG 10.0.0.1190 2011.04.25 Crypt.XWM
BitDefender 7.2 2011.04.25 Gen:Variant.Renos.38
CAT-QuickHeal 11.00 2011.04.25 Trojan.Renos.MJ
ClamAV 0.97.0.0 2011.04.25 Trojan.Agent-165989
Commtouch 5.3.2.6 2011.04.25 W32/FakeAlert.HL.gen!Eldorado
Comodo 8470 2011.04.25 MalCrypt.Indus!
DrWeb 5.0.2.03300 2011.04.25 Trojan.Siggen.64461
Emsisoft 5.1.0.5 2011.04.25 -
eSafe 7.0.17.0 2011.04.25 -
eTrust-Vet 36.1.8290 2011.04.25 Win32/Wardunlo.IP
F-Prot 4.6.2.117 2011.04.25 W32/FakeAlert.HL.gen!Eldorado
F-Secure 9.0.16440.0 2011.04.25 Trojan-Downloader:W32/Renos.GRS
Fortinet 4.2.257.0 2011.04.25 W32/PackedKatusha.B!tr.dldr
GData 22 2011.04.25 Gen:Variant.Renos.38
Ikarus T3.1.1.103.0 2011.04.25 -
Jiangmin 13.0.900 2011.04.25 Packed.Katusha.nuw
K7AntiVirus 9.98.4474 2011.04.25 Riskware
Kaspersky 9.0.0.837 2011.04.25 Packed.Win32.Katusha.o
McAfee 5.400.0.1158 2011.04.25 Downloader-CEW.b
McAfee-GW-Edition 2010.1D 2011.04.25 Heuristic.BehavesLike.Win32.Downloader.H
Microsoft 1.6802 2011.04.25 TrojanDownloader:Win32/Renos.LF
NOD32 6070 2011.04.25 Win32/TrojanDownloader.FakeAlert.AQI
Norman 6.07.07 2011.04.25 W32/Suspicious_Gen2.BTEFQ
Panda 10.0.3.5 2011.04.25 Trj/Katusha.AK
PCTools 7.0.3.5 2011.04.21 Trojan.FakeAV
Prevx 3.0 2011.04.25 High Risk Cloaked Malware
Rising 23.55.00.05 2011.04.25 Trojan.Win32.Generic.1231B721
Sophos 4.64.0 2011.04.25 Mal/FakeAV-BW
SUPERAntiSpyware 4.40.0.1006 2011.04.25 Trojan.Agent/Gen-CDesc[Gen]
Symantec 20101.3.2.89 2011.04.25 Trojan.FakeAV!gen29
TheHacker 6.7.0.1.182 2011.04.25 -
TrendMicro 9.200.0.1012 2011.04.25 TROJ_FAKEAV.SMA2
TrendMicro-HouseCall 9.200.0.1012 2011.04.25 TROJ_FAKEAV.SMA2
VBA32 3.12.16.0 2011.04.25 -
VIPRE 9118 2011.04.25 VirTool.Win32.Obfuscator.hg!b1 (v)
ViRobot 2011.4.25.4428 2011.04.25 Trojan.Win32.Itsproc.184832
VirusBuster 13.6.320.0 2011.04.25 Trojan.DL.FakeAlert!kzBBIEXz0lA
Additional informationShow all
MD5 : 941bfa021c02f0de1efaab869b45554e
SHA1 : 976ffcb2e5e9f28d0e48d49da85ba0c91cfb0254
SHA256: 92bd13a6ddbccc5451b7c7358a3523ce65d658f42b75f02465f57a248ffadae2
ssdeep: 3072:gZcGg12z4ICBRHCm35Zq4nvhAHkrqKsBoUay946h7MHKQidPcmwI:IqwvCBRHCe5Z95AEx
sB2y9nUiUmw
File size : 184832 bytes
First seen: 2011-04-25 20:36:13
Last seen : 2011-04-25 20:44:31
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x6A70
timedatestamp….: 0x4AAF7D7A (Tue Sep 15 11:41:46 2009)
machinetype……: 0x14c (I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
CODE, 0x1000, 0x9F7D, 0xA000, 3.48, 1c8e6be96706ed2bad8e15199b48d6a5
.rdata, 0xB000, 0x348B8, 0x21A00, 7.31, c2f6847dc3aa2a6b4038306ce5c19f66
.tls, 0x40000, 0x1058, 0x1200, 0.08, 0c8bc74f3ddcf6eb97d9c4f1e0e8818f

[[ 5 import(s) ]]
GDI32.DLL: CreateDIBSection
kernel32.dll: ExitProcess, VirtualAlloc, GetModuleHandleA, SetEndOfFile, LocalAlloc, GetStringTypeW, GetLocalTime, GetProcAddress, CloseHandle, SizeofResource, GetCommandLineA, GetFileType, GlobalAlloc, GetOEMCP, SetFilePointer, lstrcmpA, GetFileAttributesA
version.dll: VerQueryValueA
SHELL32.DLL: SHGetFolderPathA, SHGetSpecialFolderLocation, SHGetDesktopFolder
oleaut32.dll: SafeArrayUnaccessData, SafeArrayPtrOfIndex, SysFreeString, SafeArrayGetUBound, OleLoadPicture, GetErrorInfo, SysStringLen

Prevx Info:
http://info.prevx.com/aboutprogramtext.asp…8009F00D3E5B8DC
ExifTool:
file metadata
CodeSize: 40960
EntryPoint: 0x6a70
FileSize: 180 kB
FileType: Win32 EXE
ImageVersion: 0.0
InitializedDataSize: 142336
LinkerVersion: 2.6
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2009:09:15 13:41:46+02:00
UninitializedDataSize: 77824

data\bo7a1ef2.exe log…

File name: b07a1ef2.exe
Submission date: 2011-04-25 20:57:20 (UTC)
Current status: queued queued (#32) analysing finished

Result: 36/ 42 (85.7%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.04.26.00 2011.04.25 Trojan/Win32.Trojan Horse
AntiVir 7.11.7.7 2011.04.25 TR/Spy.45056.633
Antiy-AVL 2.0.3.7 2011.04.25 -
Avast 4.8.1351.0 2011.04.25 Win32:Alureon-ID
Avast5 5.0.677.0 2011.04.25 Win32:Alureon-ID
AVG 10.0.0.1190 2011.04.25 Agent2.BAEU
BitDefender 7.2 2011.04.25 Gen:Trojan.Heur.FU.cmW@aOxAQbe
CAT-QuickHeal 11.00 2011.04.25 Trojan.Alureon.co
ClamAV 0.97.0.0 2011.04.25 -
Commtouch 5.3.2.6 2011.04.25 W32/MalwareF.ELLW
Comodo 8470 2011.04.25 Heur.Suspicious
DrWeb 5.0.2.03300 2011.04.25 Trojan.PWS.IpDiscover.17
Emsisoft 5.1.0.5 2011.04.25 Gen.Trojan!IK
eSafe 7.0.17.0 2011.04.25 -
eTrust-Vet 36.1.8290 2011.04.25 Win32/Alureon.M!generic
F-Prot 4.6.2.117 2011.04.25 W32/MalwareF.ELLW
F-Secure 9.0.16440.0 2011.04.25 Gen:Trojan.Heur.FU.cmW@aOxAQbe
Fortinet 4.2.257.0 2011.04.25 W32/PackTDss.V!tr
GData 22 2011.04.25 Gen:Trojan.Heur.FU.cmW@aOxAQbe
Ikarus T3.1.1.103.0 2011.04.25 Gen.Trojan
Jiangmin 13.0.900 2011.04.25 Trojan/Generic.aomh
K7AntiVirus 9.98.4474 2011.04.25 Riskware
Kaspersky 9.0.0.837 2011.04.25 HEUR:Trojan.Win32.Generic
McAfee 5.400.0.1158 2011.04.25 DNSChanger.cc
McAfee-GW-Edition 2010.1D 2011.04.25 DNSChanger.cc
Microsoft 1.6802 2011.04.25 Trojan:Win32/Alureon.CO
NOD32 6070 2011.04.25 Win32/Olmarik.ABS
Norman 6.07.07 2011.04.25 W32/Suspicious_Gen2.FRFIW
Panda 10.0.3.5 2011.04.25 Bck/TDSS.FJ
PCTools 7.0.3.5 2011.04.21 Trojan.Generic
Prevx 3.0 2011.04.25 Medium Risk Malware
Rising 23.55.00.05 2011.04.25 -
Sophos 4.64.0 2011.04.25 Mal/TDSSPack-AF
SUPERAntiSpyware 4.40.0.1006 2011.04.25 -
Symantec 20101.3.2.89 2011.04.25 Trojan Horse
TheHacker 6.7.0.1.182 2011.04.25 Trojan/Olmarik.abs
TrendMicro 9.200.0.1012 2011.04.25 TROJ_TDSS.SMET
TrendMicro-HouseCall 9.200.0.1012 2011.04.25 TROJ_TDSS.SMET
VBA32 3.12.16.0 2011.04.25 BScope.MTA.Trojan.Olmarik.ABS
VIPRE 9118 2011.04.25 Packed.Win32.Tdss.ad (v)
ViRobot 2011.4.25.4428 2011.04.25 -
VirusBuster 13.6.320.0 2011.04.25 Trojan.Olmarik!cRjeMwvFp34
Additional informationShow all
MD5 : 5d5525178b91b43e4e6511f51cd7e4fe
SHA1 : ef8943c9502a8c1ebbd6c2412c231d370bc7fe90
SHA256: 352f362fbfed4b0545792c8f1c548840c0abdf974930c45aa66e1224d7b3923d
ssdeep: 768:dTSmSNUpThWnnx5uTwA9VrOoNkmGDwofxLGVIBea4Qe+okZl:dSmSQTQPuhOLwoZAsea4io
U
File size : 45056 bytes
First seen: 2010-07-19 19:47:15
Last seen : 2011-04-25 20:57:20
TrID:
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x1000
timedatestamp….: 0x422EEF1B (Wed Mar 09 12:42:03 2005)
machinetype……: 0x14c (I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x1000, 0x800, 6.51, bed42205924261631cc10c1cb3e1a62a
.rdata, 0x2000, 0xF000, 0xA400, 6.91, 6548df3d0b248cab9137c0ed84c4f3f7
.rsrc, 0x11000, 0x1000, 0x200, 0.00, bf619eac0cdf3f68d496ea9344137e8b

[[ 1 import(s) ]]
VERSION.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA

Prevx Info:
http://info.prevx.com/aboutprogramtext.asp…836FC00F50998AE
ThreatExpert:
ThreatExpert info: http://www.threatexpert.com/report.aspx?md…e6511f51cd7e4fe
ExifTool:
file metadata
CodeSize: 4096
EntryPoint: 0x1000
FileSize: 44 kB
FileType: Win32 EXE
ImageVersion: 0.0
InitializedDataSize: 65536
LinkerVersion: 5.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2005:03:09 13:42:03+01:00
UninitializedDataSize: 0

OTL fix log…

OTL logfile created on: 25/04/2011 08:16:47 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Stan\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

759.00 Mb Total Physical Memory | 272.00 Mb Available Physical Memory | 36.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.17 Gb Total Space | 18.09 Gb Free Space | 52.95% Space Free | Partition Type: NTFS
Drive E: | 44.14 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: STANSLAPTOP | User Name: Stan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Stan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe (Affinegy, Inc.)
PRC - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe (Affinegy, Inc.)
PRC - C:\Program Files\Virgin Broadband Wireless\wpa_supplicant.exe ()
PRC - C:\Program Files\Virgin Broadband Wireless\ndis_events.exe ()
PRC - C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\WINDOWS\Dit.exe (ICSI Technology Ltd.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Stan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (VmbService) – C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AffinegyService) – C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe (Affinegy, Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (CardReaderFilter) – C:\WINDOWS\system32\drivers\USBCRFT.SYS (ICSI Technology Ltd.)
DRV - (ZTEusbnet) – C:\WINDOWS\system32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbvoice) – C:\WINDOWS\system32\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (vodafone_K380x-z_dc_enum) – C:\WINDOWS\system32\drivers\vodafone_K380x-z_dc_enum.sys (Vodafone)
DRV - (windrvNT) – C:\WINDOWS\system32\windrvNT.sys ()
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (iegdmini) – C:\WINDOWS\system32\drivers\iegdmini.sys (Intel Corporation)
DRV - (sdvo) – C:\WINDOWS\system32\drivers\sdvo.sys ()
DRV - (analog) – C:\WINDOWS\system32\drivers\analog.sys ()
DRV - (lvds) – C:\WINDOWS\system32\drivers\lvds.sys ()
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (AFGSp50) – C:\WINDOWS\system32\drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (tapvpn) – C:\WINDOWS\system32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (pgfilter) – C:\Program Files\PeerGuardian2\pgfilter.sys ()
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"

[2010/04/21 11:49:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stan\Application Data\Mozilla\Firefox\Profiles\70a1kru4.default\extensions
[2006/01/03 17:18:31 | 000,000,000 | —D | M] (Firefox (default)) – C:\Documents and Settings\Stan\Application Data\Mozilla\Firefox\Profiles\70a1kru4.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/07/19 11:58:04 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stan\Application Data\Mozilla\Firefox\Profiles\70a1kru4.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2006/01/03 17:18:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2004/08/04 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKCU\..\Toolbar\ShellBrowser: (Stumble&Upon) - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1934.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Stumble&Upon) - {22D003CE-6952-46C5-80B9-D19B479620AB} - C:\WINDOWS\system32\s1934.dll ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Dit] C:\WINDOWS\Dit.exe (ICSI Technology Ltd.)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [Wireless Manager] C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe (Affinegy, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled [2009/04/20 16:03:42 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: stumbleupon.com ([]* in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {556EEC63-31E2-47C3-BF29-DFF799D2FE04} https://secure.logmein.com/activex/RACtrl.cab (Remote Access ActiveX Client)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/09/13 23:45:26 | 000,000,120 | R— | M] () - E:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{62ff00d9-6755-11e0-9405-0014228efae2}\Shell - "" = AutoRun
O33 - MountPoints2\{62ff00d9-6755-11e0-9405-0014228efae2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{62ff00d9-6755-11e0-9405-0014228efae2}\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe – [2010/07/08 12:14:50 | 000,274,432 | R— | M] (Vodafone)
O33 - MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\Shell\AutoRun\command - "" = k8jc.exe
O33 - MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\Shell\open\Command - "" = k8jc.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe – [2010/07/08 12:14:50 | 000,274,432 | R— | M] (Vodafone)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2011/04/24 23:50:05 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Stan\Desktop\OTL.exe
[2011/04/23 22:16:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Desktop\bikes
[2011/04/21 16:09:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Desktop\Boness
[2011/04/18 23:01:00 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/04/18 23:00:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/04/18 22:57:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\Temp
[2011/04/18 22:56:54 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/04/18 20:57:42 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/04/18 20:57:36 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/04/18 20:57:25 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/04/18 20:56:40 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2011/04/18 20:56:40 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2011/04/18 20:56:40 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2011/04/18 20:56:40 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2011/04/18 20:56:39 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2011/04/18 20:56:39 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2011/04/18 20:56:39 | 000,000,000 | —D | C] – C:\0042a3789f6a7c5940
[2011/04/17 13:32:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Desktop\Pictures
[2011/04/16 22:52:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\My Documents\My Albums
[2011/04/16 22:52:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\IsolatedStorage
[2011/04/16 22:52:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\HP
[2011/04/16 22:52:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\My Documents\My Scans
[2011/04/16 22:39:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2011/04/16 22:37:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2011/04/16 22:37:46 | 000,626,960 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hpvaut32.dll
[2011/04/16 22:37:46 | 000,487,424 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hpvcp70.dll
[2011/04/16 22:37:46 | 000,344,064 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\hpvcr70.dll
[2011/04/16 22:37:46 | 000,044,544 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSXML4a.dll
[2011/04/16 22:37:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Start Menu\Programs\HP
[2011/04/16 22:36:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\HP
[2011/04/16 22:26:47 | 000,061,440 | —- | C] (HP) – C:\WINDOWS\System32\HPZinw12.exe
[2011/04/16 22:26:46 | 000,278,584 | —- | C] (HP) – C:\WINDOWS\System32\HPZidr12.dll
[2011/04/16 22:26:46 | 000,204,800 | —- | C] (HP) – C:\WINDOWS\System32\HPZipr12.dll
[2011/04/16 22:26:46 | 000,094,208 | —- | C] (HP) – C:\WINDOWS\System32\HPZipt12.dll
[2011/04/16 22:26:46 | 000,065,536 | —- | C] (HP) – C:\WINDOWS\System32\HPZipm12.exe
[2011/04/16 22:26:46 | 000,057,344 | —- | C] (HP) – C:\WINDOWS\System32\HPZisn12.dll
[2011/04/16 22:23:47 | 000,000,000 | —D | C] – C:\Program Files\HP
[2011/04/16 22:17:23 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2011/04/16 22:11:26 | 000,581,632 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hpotscl.dll
[2011/04/16 22:11:26 | 000,270,336 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\HPZc3212.dll
[2011/04/16 22:11:26 | 000,090,112 | —- | C] (Hewlett-Packard Co.) – C:\WINDOWS\System32\hpovst08.dll
[2011/04/16 22:11:09 | 000,180,315 | —- | C] (HP) – C:\WINDOWS\System32\hpzsnt10.dll
[2011/04/16 22:11:08 | 000,344,064 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\hpzcon10.dll
[2011/04/16 22:11:08 | 000,196,608 | —- | C] (HP) – C:\WINDOWS\System32\hpzcoi10.dll
[2011/04/16 18:31:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Application Data\Hewlett-Packard
[2011/04/16 17:27:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Hewlett-Packard
[2011/04/16 17:24:42 | 000,000,000 | —D | C] – C:\Program Files\Hewlett-Packard
[2011/04/16 17:12:04 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2011/04/16 16:40:39 | 000,009,216 | R— | C] (MBB Incorporated) – C:\WINDOWS\System32\drivers\massfilter.sys
[2011/04/16 16:04:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Application Data\FLEXnet
[2011/04/16 15:58:56 | 000,114,688 | R— | C] (ZTE Corporation) – C:\WINDOWS\System32\drivers\ZTEusbnet.sys
[2011/04/16 15:58:30 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys
[2011/04/16 15:58:26 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zteusbvoice.sys
[2011/04/16 15:58:21 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys
[2011/04/16 15:58:17 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys
[2011/04/16 15:58:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Application Data\Vodafone
[2011/04/16 15:57:15 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsgXP_2k3.dll
[2011/04/16 15:56:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Vodafone
[2011/04/16 15:56:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2011/04/16 15:56:24 | 000,000,000 | —D | C] – C:\Program Files\Vodafone
[2011/04/16 15:56:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\FLEXnet
[2011/04/16 15:55:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Stan\Local Settings\Application Data\{F3E8BCCE-24B6-4737-920E-0D6073630E2A}
[2006/02/12 12:35:35 | 028,863,189 | —- | C] (eBay ) – C:\Program Files\setupUS.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/25 08:06:25 | 000,013,568 | —- | M] (ICSI Technology Ltd.) – C:\WINDOWS\System32\drivers\USBCRFT.SYS
[2011/04/25 08:01:57 | 000,443,034 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/25 08:01:57 | 000,072,134 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/04/25 08:01:05 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/25 07:58:16 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/25 07:58:14 | 000,000,278 | -H– | M] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2011/04/25 07:57:49 | 000,000,306 | —- | M] () – C:\WINDOWS\tasks\iwiuzeq.job
[2011/04/25 07:57:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/25 07:57:39 | 796,327,936 | -HS- | M] () – C:\hiberfil.sys
[2011/04/24 23:50:06 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Stan\Desktop\OTL.exe
[2011/04/24 23:13:29 | 002,589,189 | —- | M] () – C:\Documents and Settings\Stan\Desktop\Lynda licence.jpg
[2011/04/23 22:56:52 | 001,165,598 | —- | M] () – C:\Documents and Settings\Stan\Desktop\scan0003.jpg
[2011/04/18 23:00:39 | 000,001,915 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/04/18 21:10:33 | 000,250,288 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/17 16:03:53 | 000,209,920 | —- | M] () – C:\Documents and Settings\Stan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/16 23:40:42 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/16 22:52:25 | 000,000,127 | —- | M] () – C:\Documents and Settings\Stan\Local Settings\Application Data\fusioncache.dat
[2011/04/16 22:43:28 | 000,104,156 | —- | M] () – C:\WINDOWS\hpoins04.dat
[2011/04/16 22:41:14 | 000,000,798 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
[2011/04/16 22:38:07 | 000,001,808 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2011/04/16 17:06:52 | 000,002,515 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SMS.lnk
[2011/04/16 15:57:23 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K380x-z_dc_enum_01009.Wdf
[2011/04/16 15:57:21 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011/04/16 15:56:50 | 000,001,911 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Broadband.lnk
[2011/04/14 20:39:52 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/24 23:09:10 | 001,165,598 | —- | C] () – C:\Documents and Settings\Stan\Desktop\scan0003.jpg
[2011/04/20 20:49:36 | 002,589,189 | —- | C] () – C:\Documents and Settings\Stan\Desktop\Lynda licence.jpg
[2011/04/18 23:00:39 | 000,001,915 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/04/18 22:56:47 | 000,000,882 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/18 22:56:46 | 000,000,878 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/16 22:52:25 | 000,000,127 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\fusioncache.dat
[2011/04/16 22:41:14 | 000,000,798 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
[2011/04/16 22:39:36 | 000,000,731 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\I.R.I.S. OCR Registration.lnk
[2011/04/16 22:38:07 | 000,001,808 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2011/04/16 22:11:42 | 000,104,156 | —- | C] () – C:\WINDOWS\hpoins04.dat
[2011/04/16 22:11:42 | 000,017,176 | —- | C] () – C:\WINDOWS\hpomdl04.dat
[2011/04/16 15:57:23 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K380x-z_dc_enum_01009.Wdf
[2011/04/16 15:57:21 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011/04/16 15:56:50 | 000,002,515 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SMS.lnk
[2011/04/16 15:56:50 | 000,001,911 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Broadband.lnk
[2010/08/11 11:43:50 | 000,159,464 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4
[2010/07/20 08:17:13 | 000,184,832 | —- | C] () – C:\WINDOWS\Mqoqeb.exe
[2010/07/19 19:57:28 | 000,184,832 | —- | C] () – C:\WINDOWS\Mqoqea.exe
[2010/07/19 19:56:49 | 000,045,056 | —- | C] () – C:\Documents and Settings\Stan\Application Data\b07a1ef2.exe
[2010/07/17 20:11:45 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/04/20 07:58:32 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/04/18 21:47:25 | 000,033,792 | —- | C] () – C:\WINDOWS\System32\drivers\tv.sys.BAK.sys
[2009/04/18 21:47:25 | 000,033,152 | —- | C] () – C:\WINDOWS\System32\drivers\sdvo.sys
[2009/04/18 21:47:24 | 000,367,488 | —- | C] () – C:\WINDOWS\System32\iegd3dg3.dll
[2009/04/18 21:47:24 | 000,007,424 | —- | C] () – C:\WINDOWS\System32\drivers\analog.sys
[2009/04/18 21:47:24 | 000,007,296 | —- | C] () – C:\WINDOWS\System32\drivers\lvds.sys
[2009/04/18 09:22:42 | 002,545,152 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\cooliris-win-ie-release-1.10.0.24532.en-US.msi
[2009/03/09 22:37:40 | 002,351,616 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\cooliris-win-ie-release-1.9.1.17582.msi
[2008/10/31 22:27:25 | 000,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/10/31 22:27:23 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/03/08 10:39:54 | 000,035,363 | —- | C] () – C:\WINDOWS\System32\windrvNT.sys
[2008/03/08 10:39:53 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\suppdll.dll
[2007/10/04 10:49:46 | 000,000,260 | R— | C] () – C:\WINDOWS\Dit.INI
[2007/10/04 10:49:44 | 000,024,576 | —- | C] () – C:\WINDOWS\CICache.exe
[2006/05/14 07:57:45 | 000,209,920 | —- | C] () – C:\Documents and Settings\Stan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/21 23:13:15 | 000,348,160 | —- | C] () – C:\WINDOWS\System32\s1940.dll
[2006/04/10 12:18:12 | 000,007,920 | —- | C] () – C:\WINDOWS\System32\ractrlkeyhook.dll
[2006/03/15 07:53:43 | 000,434,176 | —- | C] () – C:\WINDOWS\System32\s1939.dll
[2006/03/06 07:30:22 | 000,434,176 | —- | C] () – C:\WINDOWS\System32\s1938.dll
[2006/02/21 07:55:03 | 000,409,600 | —- | C] () – C:\WINDOWS\System32\s1937.dll
[2006/02/16 00:49:35 | 000,409,600 | —- | C] () – C:\WINDOWS\System32\s1936.dll
[2006/01/29 22:41:41 | 000,610,304 | —- | C] () – C:\WINDOWS\System32\s1934.dll
[2006/01/08 21:28:33 | 000,051,733 | —- | C] () – C:\WINDOWS\System32\hippy.dat
[2006/01/03 17:39:59 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/02 18:38:00 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/01/01 22:20:07 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2005/12/15 18:23:18 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/12/15 18:17:43 | 000,003,137 | —- | C] () – C:\WINDOWS\mozver.dat
[2005/12/15 18:16:21 | 000,000,354 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/12/15 18:10:38 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/12/15 18:08:51 | 000,000,004 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2005/12/15 18:08:11 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2005/12/15 18:08:11 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2005/12/15 17:45:06 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2005/12/15 17:44:28 | 000,000,401 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/05/04 20:58:54 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/10 14:12:05 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 14:07:31 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 14:02:15 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 14:01:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 13:57:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 13:57:15 | 000,250,288 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 13:51:21 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 13:51:20 | 000,443,034 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 13:51:20 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 13:51:20 | 000,072,134 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 13:51:20 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 13:51:18 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 13:51:17 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/10 13:51:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 13:51:12 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 13:51:11 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 13:51:05 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 13:50:56 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2010/07/17 20:11:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Affinegy
[2008/10/26 13:42:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2008/04/27 20:08:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Transparent
[2005/12/15 18:12:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/04/16 15:56:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2011/04/25 08:21:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\Affinegy
[2010/05/25 14:11:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\Azureus
[2010/08/03 14:59:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\BitTorrent
[2010/07/20 14:25:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\uTorrent
[2011/04/16 15:58:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Stan\Application Data\Vodafone
[2010/01/07 21:20:48 | 000,000,310 | —- | M] () – C:\WINDOWS\Tasks\Install_NSS.job
[2011/04/25 07:57:49 | 000,000,306 | —- | M] () – C:\WINDOWS\Tasks\iwiuzeq.job
[2011/02/10 10:45:09 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/04/25 07:58:14 | 000,000,278 | -H– | M] () – C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/01 18:33:50 | 000,000,735 | —- | M] () – C:\892.cin
[2004/08/10 14:04:08 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/06/29 02:58:24 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2004/08/10 14:04:08 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2005/12/15 17:48:44 | 000,004,609 | RH– | M] () – C:\dell.sdr
[2011/04/25 07:57:39 | 796,327,936 | -HS- | M] () – C:\hiberfil.sys
[2011/04/22 11:04:22 | 000,005,472 | —- | M] () – C:\hook.log
[2003/12/08 13:15:56 | 000,028,672 | R— | M] ( ) – C:\hpqimgrc.resources.dll
[2006/01/02 00:19:54 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2010/07/20 23:44:56 | 000,001,806 | —- | M] () – C:\InstallHelper.log
[2004/08/10 14:04:08 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2005/12/15 18:12:27 | 000,000,884 | -H– | M] () – C:\IPH.PH
[2011/04/22 14:46:37 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2004/08/10 14:04:08 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/07/15 13:45:19 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/25 07:57:37 | 1194,389,504 | -HS- | M] () – C:\pagefile.sys
[2005/10/31 16:56:00 | 000,700,416 | —- | M] (LimeWire) – C:\StubInstaller.exe
[2011/04/24 11:51:20 | 000,055,996 | —- | M] () – C:\TDSSKiller.2.4.21.0_24.04.2011_11.47.33_log.txt
[2011/04/16 22:53:06 | 000,001,167 | —- | M] () – C:\_Sid.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 14:03:42 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2006/02/12 12:36:34 | 028,863,189 | —- | M] (eBay ) – C:\Program Files\setupUS.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 13:56:48 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/10 13:56:46 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/10 13:56:46 | 000,872,448 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2010/07/15 13:53:35 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2011/04/16 22:41:14 | 000,000,902 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\HP Image Zone.lnk
[2011/04/16 22:36:52 | 000,000,804 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\HP Director.lnk
[2006/01/03 17:39:09 | 000,001,992 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\New Office Document.lnk
[2006/01/03 17:39:09 | 000,002,002 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Open Office Document.lnk
[2010/07/15 13:53:35 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2004/08/10 14:04:12 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2007/09/29 08:38:53 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-19 14:48:54

< MD5 for: EXPLORER.EX_ >
[2004/08/04 06:00:00 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\i386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/14 01:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 01:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 12:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 11:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 06:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: EXPLORER.EXE-02121B1A.PF >
[2011/04/24 18:39:43 | 000,070,950 | —- | M] () MD5=C9645FFA8817D3D104D1809B18FFFA74 – C:\WINDOWS\Prefetch\EXPLORER.EXE-02121B1A.pf

< MD5 for: EXPLORER.SC_ >
[2004/08/04 06:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\i386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2004/08/04 06:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\i386\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2004/08/04 06:00:00 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\i386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2008/04/14 01:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2004/08/04 06:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ie8\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-2D97EBE6.PF >
[2011/04/25 08:13:55 | 000,106,590 | —- | M] () MD5=6F62B79E46F94D5065C66A0037C7DC27 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf

< MD5 for: IEXPLORE.HLP >
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\i386\iexplore.hlp
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EXE >
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\i386\winlogon.exe
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/14 01:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 01:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< End of report >

oldman960

Post #7April 26, 2011, 7:54 AM UTC

Hi scudo,

That was the OTL scan log you posted earlier. The OTL fix log can be found at C:\_OTL\MovedFiles It will have a file name consisting of numders that reflect the date and time stamp the fix was ran. It will be something similar to 25042011_111009.log . Please copy and paste the contents into your next reply.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

OTL fix log
combofix log

Thanks

scudo

Post #8April 26, 2011, 9:47 AM UTC

A couple of points:
1. When I run the Mqoqeb exes in the previous posts Avira brought it up as a virus, I clicked ignoe assuming it was a false positive.
2. When running Combifix it stated Avira was running, It was shut down and had the closed umbrella icon.

Logs:
Data\bo7a1ef2.exe.

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f144e19d-6f03-11df-93cd-0014228efae2}\ not found.
File k8jc.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f144e19d-6f03-11df-93cd-0014228efae2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f144e19d-6f03-11df-93cd-0014228efae2}\ not found.
File k8jc.exe not found.
========== FILES ==========
========== COMMANDS ==========
Unable to start service SrService!

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Stan
->Temp folder emptied: 667330839 bytes
->Temporary Internet Files folder emptied: 44233961 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 4022 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 32768 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 2778757 bytes

Total Files Cleaned = 681.00 mb

ComboFix 11-04-25.02 - Stan 26/04/2011 10:21:06.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.759.409 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Stan\Application Data\b07a1ef2.exe
c:\documents and settings\Stan\WINDOWS
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_NPF
——-\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2011-03-26 to 2011-04-26 )))))))))))))))))))))))))))))))
.
.
2011-04-25 21:10 . 2011-04-25 21:10 ——– dc—-w- C:\_OTL
2011-04-18 22:01 . 2011-04-18 22:01 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2011-04-18 21:57 . 2011-04-18 21:59 ——– d—–w- c:\documents and settings\Stan\Local Settings\Application Data\Temp
2011-04-18 21:56 . 2011-04-18 21:56 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2011-04-18 19:57 . 2011-04-18 19:57 ——– d—–w- c:\windows\system32\XPSViewer
2011-04-18 19:57 . 2011-04-18 19:57 ——– d—–w- c:\program files\MSBuild
2011-04-18 19:57 . 2011-04-18 19:57 ——– d—–w- c:\program files\Reference Assemblies
2011-04-18 19:57 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-04-18 19:56 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-04-18 19:56 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-04-18 19:56 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-04-18 19:56 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2011-04-18 19:56 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-04-18 19:56 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-04-18 19:56 . 2011-04-18 19:57 ——– dc—-w- C:\0042a3789f6a7c5940
2011-04-18 19:56 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-04-18 19:56 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2011-04-16 21:52 . 2011-04-16 21:52 ——– d—–w- c:\documents and settings\Stan\Local Settings\Application Data\IsolatedStorage
2011-04-16 21:52 . 2011-04-16 21:52 ——– d—–w- c:\documents and settings\Stan\Local Settings\Application Data\HP
2011-04-16 21:39 . 2011-04-16 21:39 ——– d—–w- c:\program files\Common Files\HP
2011-04-16 21:37 . 2011-04-16 21:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2011-04-16 21:37 . 2004-05-11 09:53 626960 —-a-r- c:\windows\system32\hpvaut32.dll
2011-04-16 21:37 . 2004-05-11 09:53 487424 —-a-r- c:\windows\system32\hpvcp70.dll
2011-04-16 21:37 . 2004-05-11 09:53 44544 —-a-r- c:\windows\system32\MSXML4a.dll
2011-04-16 21:37 . 2004-05-11 09:53 344064 —-a-r- c:\windows\system32\hpvcr70.dll
2011-04-16 21:37 . 2011-04-16 21:37 45056 —-a-r- c:\documents and settings\Stan\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
2011-04-16 21:26 . 2004-03-18 15:38 61440 —-a-w- c:\windows\system32\HPZinw12.exe
2011-04-16 21:26 . 2004-03-18 15:56 204800 —-a-w- c:\windows\system32\HPZipr12.dll
2011-04-16 21:26 . 2004-03-18 15:55 65536 —-a-w- c:\windows\system32\HPZipm12.exe
2011-04-16 21:26 . 2004-03-18 15:53 278584 —-a-w- c:\windows\system32\HPZidr12.dll
2011-04-16 21:26 . 2004-03-18 15:39 57344 —-a-w- c:\windows\system32\HPZisn12.dll
2011-04-16 21:26 . 2004-03-18 15:39 94208 —-a-w- c:\windows\system32\HPZipt12.dll
2011-04-16 21:23 . 2011-04-16 21:42 ——– d—–w- c:\program files\HP
2011-04-16 21:17 . 2011-04-16 21:18 ——– d—–w- c:\windows\system32\NtmsData
2011-04-16 21:11 . 2004-06-22 15:05 51088 —-a-w- c:\windows\system32\drivers\hpzid412.sys
2011-04-16 21:11 . 2004-06-22 15:05 21744 —-a-w- c:\windows\system32\drivers\HPZius12.sys
2011-04-16 21:11 . 2004-06-22 15:05 16496 —-a-w- c:\windows\system32\drivers\HPZipr12.sys
2011-04-16 21:11 . 2004-06-22 15:05 90112 —-a-w- c:\windows\system32\hpovst08.dll
2011-04-16 21:11 . 2004-06-22 15:05 581632 —-a-w- c:\windows\system32\hpotscl.dll
2011-04-16 21:11 . 2004-06-22 15:04 270336 —-a-w- c:\windows\system32\HPZc3212.dll
2011-04-16 21:11 . 2004-06-22 15:05 180315 —-a-w- c:\windows\system32\hpzsnt10.dll
2011-04-16 21:11 . 2004-06-22 15:05 196608 —-a-w- c:\windows\system32\hpzcoi10.dll
2011-04-16 21:11 . 2004-06-22 15:05 344064 —-a-w- c:\windows\system32\hpzcon10.dll
2011-04-16 17:31 . 2011-04-16 17:31 ——– d—–w- c:\documents and settings\Stan\Application Data\Hewlett-Packard
2011-04-16 16:27 . 2011-04-16 16:27 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2011-04-16 16:24 . 2011-04-16 21:37 ——– d—–w- c:\program files\Hewlett-Packard
2011-04-16 16:12 . 2008-04-13 18:47 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2011-04-16 16:12 . 2008-04-13 18:47 25856 —-a-w- c:\windows\system32\dllcache\usbprint.sys
2011-04-16 15:40 . 2010-08-11 10:44 9216 —-a-r- c:\windows\system32\drivers\massfilter.sys
2011-04-16 15:04 . 2011-04-16 15:04 ——– d—–w- c:\documents and settings\Stan\Application Data\FLEXnet
2011-04-16 14:58 . 2010-08-11 10:44 114688 —-a-r- c:\windows\system32\drivers\ZTEusbnet.sys
2011-04-16 14:58 . 2010-08-11 10:44 105856 —-a-r- c:\windows\system32\drivers\ZTEusbmdm6k.sys
2011-04-16 14:58 . 2010-08-11 10:44 105856 —-a-r- c:\windows\system32\drivers\zteusbvoice.sys
2011-04-16 14:58 . 2010-08-11 10:44 105856 —-a-r- c:\windows\system32\drivers\ZTEusbnmea.sys
2011-04-16 14:58 . 2010-08-11 10:44 105856 —-a-r- c:\windows\system32\drivers\ZTEusbser6k.sys
2011-04-16 14:58 . 2011-04-16 14:58 ——– d—–w- c:\documents and settings\Stan\Application Data\Vodafone
2011-04-16 14:57 . 2008-11-07 17:55 16928 ——w- c:\windows\system32\spmsgXP_2k3.dll
2011-04-16 14:56 . 2011-04-16 14:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Vodafone
2011-04-16 14:56 . 2011-04-16 14:56 ——– d—–w- c:\program files\Vodafone
2011-04-16 14:56 . 2011-04-16 14:56 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2011-04-16 14:55 . 2011-04-16 14:55 ——– d—–w- c:\documents and settings\Stan\Local Settings\Application Data\{F3E8BCCE-24B6-4737-920E-0D6073630E2A}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-26 09:29 . 2007-10-04 09:49 13568 —-a-w- c:\windows\system32\drivers\USBCRFT.SYS
2011-03-07 05:33 . 2004-08-10 13:02 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-10 12:51 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-10 12:51 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2004-08-10 12:51 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-10 12:51 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2004-08-10 12:51 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-10 12:51 385024 —-a-w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2005-12-15 16:42 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2005-12-15 16:42 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-04-15 18:19 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-10 12:50 290432 —-a-w- c:\windows\system32\atmfd.dll
2011-02-11 13:25 . 2004-08-10 13:01 229888 —-a-w- c:\windows\system32\fxscover.exe
2011-02-09 13:53 . 2004-08-10 12:51 270848 —-a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-10 12:51 186880 —-a-w- c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-08-10 12:51 978944 —-a-w- c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-08-10 12:51 974848 —-a-w- c:\windows\system32\mfc42u.dll
2011-02-02 07:58 . 2004-08-10 13:01 2067456 —-a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2004-08-10 13:01 677888 —-a-w- c:\windows\system32\mstsc.exe
2006-02-12 11:36 . 2006-02-12 11:35 28863189 -c–a-w- c:\program files\setupUS.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2005-08-23 393216]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-06-06 118784]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Dit"="Dit.exe" [2004-04-27 86016]
"ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]
"Wireless Manager"="c:\program files\Virgin Broadband Wireless\Wireless Manager.exe" [2008-05-26 585728]
"MobileBroadband"="c:\program files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe" [2010-08-18 272384]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-1-5 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Stan^Start Menu^Programs^Startup^Secunia PSI.lnk]
path=c:\documents and settings\Stan\Start Menu\Programs\Startup\Secunia PSI.lnk
backup=c:\windows\pss\Secunia PSI.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
c:\windows\system32\WLTRAY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-06-06 16:06 77824 —-a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-06-06 16:09 94208 —-a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 16:50 221184 —-a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWBMOUSE]
2001-11-20 10:51 356352 —-a-w- c:\program files\Browser Mouse\Browser Mouse\1.1\Mouse32A.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 02:24 20480 ——w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-07-12 19:05 1117184 -c–a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2005-06-24 06:36 729178 -c–a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65000:TCP"= 65000:TCP:Azureus
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [20/04/2009 16:00 108289]
R2 VmbService;Vodafone Mobile Broadband Service;c:\program files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [18/08/2010 19:33 8704]
R3 vodafone_K380x-z_dc_enum;vodafone_K380x-z_dc_enum;c:\windows\system32\drivers\vodafone_K380x-z_dc_enum.sys [20/05/2010 14:40 80000]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [16/04/2011 15:58 114688]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\zteusbvoice.sys [16/04/2011 15:58 105856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18/04/2011 22:56 136176]
S3 analog;analog;c:\windows\system32\drivers\analog.sys [18/04/2009 21:47 7424]
S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [04/10/2007 10:49 13568]
S3 iegdmini;iegdmini;c:\windows\system32\drivers\iegdmini.sys [18/04/2009 21:47 5633792]
S3 lvds;lvds;c:\windows\system32\drivers\lvds.sys [18/04/2009 21:47 7296]
S3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [16/04/2011 16:40 9216]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [24/03/2009 12:03 7808]
S3 sdvo;sdvo;c:\windows\system32\drivers\sdvo.sys [18/04/2009 21:47 33152]
S3 tv;tv;c:\windows\system32\DRIVERS\tv.sys –> c:\windows\system32\DRIVERS\tv.sys [?]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
.
Contents of the 'Scheduled Tasks' folder
.
2009-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2011-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-18 21:56]
.
2011-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-18 21:56]
.
2010-01-07 c:\windows\Tasks\Install_NSS.job
- c:\program files\Vuze\nssstub.exe [2009-12-23 16:09]
.
2011-04-26 c:\windows\Tasks\iwiuzeq.job
- c:\windows\system32\irclassu.dll [2010-07-19 18:56]
.
2011-02-10 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: stumbleupon.com
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-HijackThis - e:\hijackthis\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-26 10:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files:
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2796)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\wltrysvc.exe
c:\windows\System32\bcmwltry.exe
c:\windows\system32\rundll32.exe
c:\program files\Virgin Broadband Wireless\AffinegyService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\windows\stsystra.exe
c:\windows\Dit.exe
c:\program files\Virgin Broadband Wireless\ndis_events.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\windows\system32\HPZipm12.exe
.
**************************************************************************
.
Completion time: 2011-04-26 10:34:40 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-26 09:34
.
Pre-Run: 20,004,225,024 bytes free
Post-Run: 19,908,907,008 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 0A33C4A8350047462F6EB28992CB21A8

OTL by OldTimer - Version 3.2.22.3 log created on 04252011_221005

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Stan\Local Settings\Temp\~DFD63C.tmp not found!
File\Folder C:\Documents and Settings\Stan\Local Settings\Temp\~DFD84E.tmp not found!
File\Folder C:\Documents and Settings\Stan\Local Settings\Temp\~DFDC2B.tmp not found!
File\Folder C:\Documents and Settings\Stan\Local Settings\Temp\~WRD0000.doc not found!
File\Folder C:\Documents and Settings\Stan\Local Settings\Temp\~WRS0002.tmp not found!
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\WNI8SII2\like[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\8V1WNP4C\iframe[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\8V1WNP4C\index[3].htm moved successfully.

Registry entries deleted on Reboot…

Combil log:

oldman960

Post #9April 26, 2011, 5:07 PM UTC

Hi scudo,

We'll take of those files now.

BitTorrent, uTorrent, Azureus

You have or had BitTorrent, uTorrent, Azureus, P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall BitTorrent, uTorrent, Azureus, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
C:\WINDOWS\Mqoqeb.exe
C:\WINDOWS\Mqoqea.exe
c:\windows\Tasks\iwiuzeq.job
c:\windows\system32\irclassu.dll 
ipconfig /flushdns /c

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log .

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

OTL fix log
MBAM log

How's the computer?

Thanks

scudo

Post #10April 26, 2011, 6:46 PM UTC

I have uninstalled Bit torrent & uTorrent but could not find Azureus, this may have been taken out a while back and remnants remaining, if the logs say different where would I locate it in order to uninstall.
Google appears to be going to the links now with no redirects.

LOGS:

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
C:\WINDOWS\Mqoqeb.exe moved successfully.
C:\WINDOWS\Mqoqea.exe moved successfully.
c:\windows\Tasks\iwiuzeq.job moved successfully.
c:\windows\system32\irclassu.dll moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Stan\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Stan\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point (0)

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Stan
->Temp folder emptied: 105273 bytes
->Temporary Internet Files folder emptied: 22492471 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 770 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 10752 bytes

Total Files Cleaned = 22.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 04262011_183555

Files\Folders moved on Reboot…
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\NNDXM920\index[3].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\N3NU1XZE\default[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\N3NU1XZE\InboxLight[3].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\N3NU1XZE\like[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\N3NU1XZE\xmlProxy[5].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\JP9DVVG6\01[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\JP9DVVG6\B5353379[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\JP9DVVG6\LocalStorage[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\JP9DVVG6\Messenger[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\8GUB0SHZ\adloader[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\8GUB0SHZ\iframe[1].htm moved successfully.
C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\8GUB0SHZ\xmlProxy[2].htm moved successfully.

Registry entries deleted on Reboot…

MBAM log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6448

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26/04/2011 19:35:49
mbam-log-2011-04-26 (19-35-49).txt

Scan type: Quick scan
Objects scanned: 153304
Time elapsed: 7 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

oldman960

Post #11April 27, 2011, 8:47 AM UTC

Hi scudo,

Azureus seems to be a remnant. We'll take care of the traces of it and the other P2P programs you have uninstalled.

You have some very old vulnerable Java installed.

Open Control Panel > Add/Remove Programs and uninstall

Java 2 Runtime Environment, SE v1.4.2_03
J2SE Runtime Environment 5.0 Update 10
Java™ 6 Update 3
Java™ 6 Update 5

Do not uninstall Java™ 6 Update 13

Next still in Control panel.

Locate the Java icon (it looks like a coffee cup)
double click it to open it
click the Update tab
Click update now

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
C:\Documents and Settings\All Users\Application Data\Azureus
C:\Documents and Settings\Stan\Application Data\Azureus
C:\Program Files\Vuze
c:\windows\Tasks\Install_NSS.job
C:\Documents and Settings\Stan\Application Data\uTorrent
C:\Documents and Settings\Stan\Application Data\BitTorrent
C:\Program Files\uTorrent
C:\Program Files\BitTorrent

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"65000:TCP"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe"=- 
"C:\Program Files\Vuze\Azureus.exe"=-
"c:\Program Files\BitTorrent\bittorrent.exe"=-

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log .

One more scan to check our handiwork.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
Re-enable your Antivirus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.

Please post back with the ESET log.

Please post back with

OTL fix log
ESET log

Any remaining issues?

Thanks

scudo

Post #12April 27, 2011, 11:18 AM UTC

Having some issues getting a decent internet connection using this dongle thing, Its nothing to do with above issues but is causing delays. I had to abort on the Java update (120 hour download) but have uninstalled the older versions as advised. Cant currently get the ESET connection but as soon as I can run the scan I will post. In case my connections gets any worse I will be away from this afternoon until Sun, but will endeavour to get scans done before I leave. Scudo

oldman960

Post #13April 27, 2011, 4:51 PM UTC

Hi scudo, Thanks for leting me know.

scudo

Post #14May 2, 2011, 9:11 AM UTC

I am having problems with the ESET online scanner I get so far and then it hangs, will keep trying and post when I have it. Below is the OTL log. All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== File\Folder C:\Documents and Settings\All Users\Application Data\Azureus not found. File\Folder C:\Documents and Settings\Stan\Application Data\Azureus not found. File\Folder C:\Program Files\Vuze not found. File\Folder c:\windows\Tasks\Install_NSS.job not found. File\Folder C:\Documents and Settings\Stan\Application Data\uTorrent not found. File\Folder C:\Documents and Settings\Stan\Application Data\BitTorrent not found. File\Folder C:\Program Files\uTorrent not found. File\Folder C:\Program Files\BitTorrent not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\65000:TCP not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\uTorrent\uTorrent.exe not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Vuze\Azureus.exe not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\c:\Program Files\BitTorrent\bittorrent.exe not found. ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Stan ->Temp folder emptied: 1009235 bytes ->Temporary Internet Files folder emptied: 9234386 bytes ->Java cache emptied: 6910 bytes ->Flash cache emptied: 700 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 668220623 bytes Total Files Cleaned = 647.00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05022011_083617 Files\Folders moved on Reboot… C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\Z3SXEJDP\iframe[1].htm moved successfully. C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\YSNLZAPK\like[1].htm moved successfully. C:\Documents and Settings\Stan\Local Settings\Temporary Internet Files\Content.IE5\2YZJFXLF\index[2].htm moved successfully. Registry entries deleted on Reboot…

scudo

Post #15May 2, 2011, 4:54 PM UTC

At last I think i now have the ESET log…. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=1af0a298b3b90c42b5695cbb342ae408 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-05-02 04:42:19 # local_time=2011-05-02 05:42:19 (+0000, GMT Daylight Time) # country="United Kingdom" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=768 16777215 100 0 93765440 93765440 0 0 # compatibility_mode=1797 16775129 100 100 26288613 79248763 28692573 0 # compatibility_mode=6143 16777215 0 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 1683 1683 0 0 # scanned=64737 # found=5 # cleaned=0 # scan_time=2346 C:\Qoobox\Quarantine\C\Documents and Settings\Stan\Application Data\b07a1ef2.exe.vir Win32/Olmarik.ABS trojan (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000019.exe Win32/Olmarik.ABS trojan (unable to clean) 00000000000000000000000000000000 I C:\_OTL\MovedFiles\04262011_183555\C_WINDOWS\Mqoqea.exe Win32/TrojanDownloader.FakeAlert.AQI trojan (unable to clean) 00000000000000000000000000000000 I C:\_OTL\MovedFiles\04262011_183555\C_WINDOWS\Mqoqeb.exe Win32/TrojanDownloader.FakeAlert.AQI trojan (unable to clean) 00000000000000000000000000000000 I C:\_OTL\MovedFiles\04262011_183555\C_WINDOWS\system32\irclassu.dll Win32/Agent.RMC trojan (unable to clean) 00000000000000000000000000000000 I

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Maybe not a viirus, unsure

✨ Ask AI

Ask AI