Spyware / Malware / Virus Removal

I tried removing the google redirect virus on my computer, but it'

22 min read

Looking for the outcome? Ask AI

blaugrana15

Post #16May 2, 2011, 2:19 AM UTC

here is the MBAM log. (after i removed the stuff it found, though, it said it couldn't remove some items…)
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6470

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

5/1/2011 9:27:22 AM
mbam-log-2011-05-01 (09-27-22).txt

Scan type: Quick scan
Objects scanned: 163973
Time elapsed: 8 minute(s), 34 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
c:\documents and settings\Jones\application data\dwm.exe (Trojan.Downloader) -> 1272 -> Unloaded process successfully.
c:\documents and settings\Jones\application data\microsoft\conhost.exe (Trojan.Agent) -> 2088 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Agent) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Bad: (C:\DOCUME~1\Jones\LOCALS~1\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Jones\application data\dwm.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jones\application data\microsoft\conhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jones\local settings\Temp\csrss.exe (Trojan.Agent) -> Delete on reboot.

here is the OTL log:
OTL logfile created on: 5/1/2011 10:03:53 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Jones\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

127.00 Mb Total Physical Memory | 19.00 Mb Available Physical Memory | 15.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 1000 1500 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 18.68 Gb Total Space | 3.75 Gb Free Space | 20.05% Space Free | Partition Type: NTFS
Drive E: | 18.58 Gb Total Space | 12.40 Gb Free Space | 66.72% Space Free | Partition Type: NTFS

Computer Name: BRUNO | User Name: Jones | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Jones\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\ESET\nod32kui.exe (Eset )
PRC - C:\Program Files\ESET\nod32krn.exe (Eset )
PRC - C:\WINDOWS\vmsnap3.exe (ZSMCSNAP)
PRC - C:\WINDOWS\Domino.exe (Vimicro)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Jones\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV - (SQTECH905C) – C:\WINDOWS\system32\drivers\Capt905c.sys (Service & Quality Technology.)
DRV - (AMON) – C:\WINDOWS\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\WINDOWS\system32\drivers\nod32drv.sys ()
DRV - (ZSMC303) – C:\WINDOWS\system32\drivers\usbVM303.sys (Vimicro Corporation)
DRV - (vmfilter303) – C:\WINDOWS\system32\drivers\vmfilter303.sys (Vimicro Corporation)
DRV - (dtscsi) – C:\WINDOWS\System32\Drivers\dtscsi.sys (DT Soft Ltd.)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (HSFHWCD2) – C:\WINDOWS\system32\drivers\HSFHWCD2.sys (Conexant Systems)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems)
DRV - (nv4) – C:\WINDOWS\system32\drivers\nv4.sys (NVIDIA Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:53273

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p;="
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:4.5
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p;="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 53273
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/29 17:45:02 | 000,000,000 | —D | M]

[2008/12/17 17:11:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jones\Application Data\Mozilla\Extensions
[2010/12/25 15:56:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jones\Application Data\Mozilla\Firefox\Profiles\c207s8xr.default\extensions
[2010/03/17 15:40:06 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Jones\Application Data\Mozilla\Firefox\Profiles\c207s8xr.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/25 15:42:07 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Jones\Application Data\Mozilla\Firefox\Profiles\c207s8xr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/09/29 17:45:02 | 000,000,000 | —D | M] (HP Smart Web Printing) – C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

O1 HOSTS File: ([2001/08/19 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - File not found
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe (Vimicro)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Microsoft Telecoms Center] File not found
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [UpdateReminder] C:\Program Files\ESET\UpdateReminder.exe (ESET, spol. s r.o.)
O4 - HKLM..\Run: [VMSnap3] C:\WINDOWS\vmsnap3.exe (ZSMCSNAP)
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
O4 - HKLM..\RunServices: [Microsoft Telecoms Center] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\System32\imon.dll (Eset )
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1168006931250 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_07)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Jones\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jones\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/01/19 07:39:54 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell - "" = AutoRun
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell\Auto\command - "" = boot.exe
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/30 07:18:26 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/04/29 20:41:50 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/04/29 20:25:10 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/04/29 20:25:10 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/04/29 20:25:10 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/04/29 20:25:10 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/04/29 20:24:46 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/04/29 20:24:20 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/29 17:43:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Jones\Desktop\Joeyy
[2011/04/28 11:50:28 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jones\Desktop\OTL.exe
[2011/04/28 03:05:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/04/27 22:43:46 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Jones\Recent
[2007/02/07 06:40:49 | 002,391,884 | —- | C] (Macromedia, Inc.) – C:\Program Files\Start.exe
[2007/02/07 06:40:49 | 000,057,344 | —- | C] (The Learning Company) – C:\Program Files\UNINSTALL.EXE
[2007/02/07 06:40:49 | 000,045,056 | —- | C] (The Learning Company) – C:\Program Files\TLCRUN.EXE
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/01 10:07:04 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1006UA.job
[2011/05/01 09:57:35 | 000,001,230 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/01 09:55:49 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/01 09:55:41 | 133,746,688 | -HS- | M] () – C:\hiberfil.sys
[2011/05/01 09:27:44 | 000,019,151 | —- | M] () – C:\Documents and Settings\Jones\Application Data\7F6E.1D8
[2011/05/01 08:55:16 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1004UA.job
[2011/05/01 06:55:33 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1004Core.job
[2011/04/30 07:15:23 | 004,333,524 | R— | M] () – C:\Documents and Settings\Jones\Desktop\ComboFix.exe
[2011/04/30 07:11:49 | 000,002,265 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Skype.lnk
[2011/04/29 20:42:26 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/04/29 19:57:16 | 000,000,800 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/29 19:07:06 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1006Core.job
[2011/04/29 17:51:47 | 000,002,288 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Google Chrome.lnk
[2011/04/29 17:51:47 | 000,002,266 | —- | M] () – C:\Documents and Settings\Jones\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/04/29 17:19:54 | 000,000,372 | —- | M] () – C:\Documents and Settings\Jones\My Documents\spider.sav
[2011/04/29 08:46:15 | 000,000,150 | —- | M] () – C:\Documents and Settings\Jones\Desktop\rk-proxy.reg
[2011/04/29 08:42:33 | 001,006,778 | —- | M] () – C:\Documents and Settings\Jones\Desktop\iExplore.exe
[2011/04/28 12:40:02 | 000,133,632 | —- | M] () – C:\Documents and Settings\Jones\Desktop\RKUnhookerLE.EXE
[2011/04/28 11:51:53 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jones\Desktop\OTL.exe
[2011/04/28 03:06:37 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/04/25 22:31:56 | 000,044,032 | —- | M] () – C:\Documents and Settings\Jones\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/25 11:09:25 | 000,002,377 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Children's Encarta.lnk
[2011/04/11 12:06:28 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/01 08:58:58 | 000,000,800 | —- | C] () – C:\Documents and Settings\Jones\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/29 20:42:26 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/04/29 20:42:09 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/04/29 20:25:10 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/04/29 20:25:10 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/04/29 20:25:10 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/04/29 20:25:10 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/04/29 20:25:10 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/29 20:18:27 | 004,333,524 | R— | C] () – C:\Documents and Settings\Jones\Desktop\ComboFix.exe
[2011/04/29 08:46:06 | 000,000,150 | —- | C] () – C:\Documents and Settings\Jones\Desktop\rk-proxy.reg
[2011/04/29 08:39:49 | 001,006,778 | —- | C] () – C:\Documents and Settings\Jones\Desktop\iExplore.exe
[2011/04/28 12:39:33 | 000,133,632 | —- | C] () – C:\Documents and Settings\Jones\Desktop\RKUnhookerLE.EXE
[2011/04/28 03:06:37 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/04/27 21:36:42 | 000,019,151 | —- | C] () – C:\Documents and Settings\Jones\Application Data\7F6E.1D8
[2011/04/25 15:29:01 | 000,002,265 | —- | C] () – C:\Documents and Settings\Jones\Desktop\Skype.lnk
[2011/03/20 11:42:33 | 000,000,466 | —- | C] () – C:\Program Files\0320201111423315.bat
[2011/01/30 10:14:56 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/29 17:16:55 | 000,165,664 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/09/29 17:16:55 | 000,000,586 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2009/10/02 14:38:20 | 000,241,744 | —- | C] () – C:\WINDOWS\System32\DNLEng.dll
[2009/10/02 14:38:18 | 001,022,944 | —- | C] () – C:\WINDOWS\dbplugin.exe
[2008/12/02 09:25:47 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/11/29 09:08:52 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\setupfilter.exe
[2007/03/06 13:10:27 | 000,000,023 | —- | C] () – C:\WINDOWS\MegaManager.INI
[2007/02/11 03:27:41 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2007/02/07 06:41:02 | 000,000,284 | —- | C] () – C:\Program Files\UNINSTALL.INF
[2007/02/07 06:40:52 | 000,600,620 | —- | C] () – C:\Program Files\opening.dxr
[2007/02/07 06:40:49 | 000,000,268 | —- | C] () – C:\Program Files\TLCRUN.INI
[2007/02/07 06:40:44 | 000,015,845 | —- | C] () – C:\Program Files\Uninst.isu
[2007/02/07 06:39:31 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2007/01/14 16:11:44 | 000,004,096 | —- | C] () – C:\WINDOWS\is941.exe
[2007/01/14 13:28:32 | 000,000,053 | —- | C] () – C:\WINDOWS\System32\imon1.dat
[2007/01/05 21:54:29 | 000,015,424 | —- | C] () – C:\WINDOWS\System32\drivers\nod32drv.sys
[2007/01/05 07:28:24 | 000,000,000 | —- | C] () – C:\WINDOWS\ka.ini
[2006/07/08 01:43:12 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2006/07/08 01:04:06 | 000,000,000 | —- | C] () – C:\WINDOWS\vpc32.INI
[2006/07/07 22:19:40 | 000,000,040 | —- | C] () – C:\WINDOWS\System32\profile.dat
[2006/07/07 07:45:14 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/05/17 04:51:34 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/03/30 19:26:24 | 000,107,134 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2006/03/30 19:26:05 | 000,003,607 | —- | C] () – C:\WINDOWS\mozver.dat
[2006/01/22 09:10:19 | 000,044,032 | —- | C] () – C:\Documents and Settings\Jones\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/20 05:23:30 | 000,000,119 | —- | C] () – C:\WINDOWS\QTW.INI
[2006/01/20 05:16:15 | 000,004,001 | —- | C] () – C:\WINDOWS\hpdj3740.ini
[2006/01/20 00:19:09 | 000,000,039 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2006/01/20 00:09:36 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/19 22:43:27 | 001,519,616 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2006/01/19 22:43:26 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/01/19 22:43:25 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/01/19 22:43:24 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/01/19 22:43:21 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/01/19 22:43:21 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2006/01/19 22:43:21 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/01/19 22:43:21 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/01/19 22:43:17 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2006/01/19 22:43:17 | 000,043,008 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/01/19 22:43:15 | 000,425,984 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2006/01/19 22:40:16 | 000,006,454 | —- | C] () – C:\WINDOWS\System32\drivers\firmware.bin
[2006/01/19 08:05:09 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2006/01/19 07:51:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/01/19 07:50:10 | 000,004,536 | —- | C] () – C:\WINDOWS\oembios.dat
[2006/01/19 07:50:07 | 013,107,200 | —- | C] () – C:\WINDOWS\oembios.bin
[2006/01/19 07:48:19 | 000,000,887 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/01/19 07:48:00 | 000,002,359 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/01/19 07:43:27 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2006/01/19 07:36:53 | 000,022,736 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2006/01/19 07:32:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/01/19 07:31:50 | 000,301,232 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/08/29 20:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2002/08/29 20:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2002/08/29 20:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2002/08/29 20:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2002/08/29 20:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2002/08/29 20:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2002/08/29 20:00:00 | 000,004,463 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2002/08/29 20:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[1980/01/01 16:00:00 | 000,313,368 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[1980/01/01 16:00:00 | 000,041,036 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[1980/01/01 16:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/11/25 20:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DigitalBlue
[2011/04/28 03:05:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2007/03/14 18:10:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/03/20 11:40:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/01/27 23:02:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\calibre
[2010/11/26 16:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Disney Mix It Plug-in
[2008/12/21 13:48:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Gamelab
[2011/03/19 14:00:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\GOL_byHasbro
[2007/03/06 13:05:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Megaupload
[2008/08/28 15:49:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\MegauploadToolbar
[2011/03/19 13:55:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Oberon Media
[2007/09/19 19:26:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Opera
[2007/03/14 18:10:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\PlayFirst

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/19 07:39:54 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/01/30 12:50:56 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/04/29 20:42:26 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2006/01/19 07:22:28 | 000,000,512 | -HS- | M] () – C:\BOOTSECT.DOS
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2006/01/19 07:39:54 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/05/01 09:55:41 | 133,746,688 | -HS- | M] () – C:\hiberfil.sys
[2006/01/19 07:56:18 | 000,000,073 | —- | M] () – C:\ImageLibraryDebug.log
[2006/12/17 13:27:01 | 000,001,407 | —- | M] () – C:\inferno.log
[2007/06/24 19:42:36 | 000,000,437 | —- | M] () – C:\INSTALL.LOG
[2006/01/19 07:39:54 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/12/30 11:55:06 | 000,000,480 | -H– | M] () – C:\IPH.PH
[2008/11/23 16:47:35 | 002,637,905 | —- | M] () – C:\log.txt
[2006/01/19 07:39:54 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/02/12 07:49:30 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2007/02/12 07:49:29 | 000,250,032 | RHS- | M] () – C:\ntldr
[2009/06/03 12:45:02 | 000,262,144 | —- | M] () – C:\ntuser.dat
[2009/06/03 12:45:02 | 000,001,024 | -H– | M] () – C:\ntuser.dat.LOG
[2011/05/01 09:55:39 | 1048,576,000 | -HS- | M] () – C:\pagefile.sys
[2011/04/21 20:16:09 | 000,000,300 | —- | M] () – C:\PromoPlugin.log
[2011/04/29 08:46:18 | 000,000,855 | —- | M] () – C:\rkill.log
[2011/04/28 02:20:39 | 000,077,874 | —- | M] () – C:\TDSSKiller.2.4.21.0_28.04.2011_02.18.40_log.txt
[2011/04/28 02:37:10 | 000,038,696 | —- | M] () – C:\TDSSKiller.2.4.21.0_28.04.2011_02.35.44_log.txt
[2007/05/21 17:07:15 | 000,000,146 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/01/20 01:22:17 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/04/16 14:08:20 | 000,312,832 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpfpp70v.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2005/04/13 06:29:32 | 000,802,816 | —- | M] (Sprout Games, LLC) – C:\WINDOWS\FeedingFrenzy.scr
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/03/20 11:42:33 | 000,000,466 | —- | M] () – C:\Program Files\0320201111423315.bat
[2001/10/18 02:48:18 | 000,002,998 | —- | M] () – C:\Program Files\Birthday.ico
[2002/01/15 07:46:40 | 000,000,766 | —- | M] () – C:\Program Files\ereg32.ico
[2002/03/19 07:40:46 | 000,600,620 | —- | M] () – C:\Program Files\opening.dxr
[2002/02/15 09:05:24 | 002,391,884 | —- | M] (Macromedia, Inc.) – C:\Program Files\Start.exe
[2002/01/15 07:46:40 | 000,045,056 | —- | M] (The Learning Company) – C:\Program Files\TLCRUN.EXE
[2007/02/07 06:44:27 | 000,000,268 | —- | M] () – C:\Program Files\TLCRUN.INI
[2007/02/07 06:44:40 | 000,015,845 | —- | M] () – C:\Program Files\Uninst.isu
[2002/01/15 07:46:40 | 000,057,344 | —- | M] (The Learning Company) – C:\Program Files\UNINSTALL.EXE
[2007/02/07 06:43:15 | 000,000,284 | —- | M] () – C:\Program Files\UNINSTALL.INF

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/01/19 19:11:59 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/01/20 01:05:41 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2006/01/19 19:11:59 | 015,990,784 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/01/19 19:12:00 | 003,145,728 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2007/02/12 08:05:58 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/02/12 10:30:01 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\Jones\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/01/20 01:30:37 | 000,000,079 | —- | M] () – C:\Documents and Settings\Jones\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/04/30 07:15:23 | 004,333,524 | R— | M] () – C:\Documents and Settings\Jones\Desktop\ComboFix.exe
[2011/04/29 08:42:33 | 001,006,778 | —- | M] () – C:\Documents and Settings\Jones\Desktop\iExplore.exe
[2011/04/28 11:51:53 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jones\Desktop\OTL.exe
[2011/04/28 12:40:02 | 000,133,632 | —- | M] () – C:\Documents and Settings\Jones\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/02/12 10:30:02 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Jones\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/05/01 09:56:04 | 000,032,768 | -HS- | M] () – C:\Documents and Settings\Jones\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-21 10:12:00

========== Alternate Data Streams ==========

@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C6A77F3
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:48F5D95B
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07699D3B

< End of report >

after i restarted the computer, i couldn't access the internet. i use opera browser and it said "access denied by proxy server". this happened after malwarebytes removed the infected items and i rebooted. i'm using a new account on the computer to post these logs because i can access the internet here, but not on my account.. :\

mowman

Post #17May 2, 2011, 10:42 AM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Otl
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:53273
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 53273
FF - prefs.js..network.proxy.type: 1
O2 - BHO: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - File not found
O3 - HKLM\..\Toolbar: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Megaupload Toolbar) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - File not found
O4 - HKLM..\Run: [Microsoft Telecoms Center] File not found
O4 - HKLM..\RunServices: [Microsoft Telecoms Center] File not found
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell - "" = AutoRun
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell\Auto\command - "" = boot.exe
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2C6A77F3
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:48F5D95B
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07699D3B

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

blaugrana15

Post #18May 3, 2011, 2:39 AM UTC

i ran OTL two times, still i'm not able to access the internet on my account. here's the log: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Prefs.js: "127.0.0.1" removed from network.proxy.http Prefs.js: 53273 removed from network.proxy.http_port Prefs.js: 1 removed from network.proxy.type Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Microsoft Telecoms Center not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\\Microsoft Telecoms Center not found. File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found. Starting removal of ActiveX control DirectAnimation Java Classes Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found. File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found. Starting removal of ActiveX control Microsoft XML Parser for Java Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. File boot.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51528b6b-dcc5-11db-a160-0004231bcb72}\ not found. File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe not found. Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:2C6A77F3 . Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:48F5D95B . Unable to delete ADS C:\Documents and Settings\All Users\Application Data\TEMP:07699D3B . ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Joeyy ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Jones ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 41268 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Martee ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 4472 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05032011_102011 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

mowman

Post #19May 4, 2011, 11:39 AM UTC

The ESET log i asked for in my last post?

blaugrana15

Post #20May 5, 2011, 3:59 AM UTC

i ran the eset online scanner and it detected and cleaned 10 infected items. however, there wasn't a details tab.. it didn't produce a log for me. i tried looking in the program files of the eset online scanner but there wasn't a log file.

mowman

Post #21May 5, 2011, 7:03 AM UTC

Post a new OTL log and tell me what problems now remain with the computer.

blaugrana15

Post #22May 6, 2011, 3:27 AM UTC

OTL logfile created on: 5/6/2011 11:03:39 AM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Jones\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

127.00 Mb Total Physical Memory | 12.00 Mb Available Physical Memory | 9.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 1000 1500 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 18.68 Gb Total Space | 3.80 Gb Free Space | 20.34% Space Free | Partition Type: NTFS
Drive E: | 18.58 Gb Total Space | 12.40 Gb Free Space | 66.72% Space Free | Partition Type: NTFS

Computer Name: BRUNO | User Name: Jones | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Jones\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\ESET\nod32kui.exe (Eset )
PRC - C:\Program Files\ESET\nod32krn.exe (Eset )
PRC - C:\WINDOWS\vmsnap3.exe (ZSMCSNAP)
PRC - C:\WINDOWS\Domino.exe (Vimicro)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Jones\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV - (SQTECH905C) – C:\WINDOWS\system32\drivers\Capt905c.sys (Service & Quality Technology.)
DRV - (AMON) – C:\WINDOWS\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\WINDOWS\system32\drivers\nod32drv.sys ()
DRV - (ZSMC303) – C:\WINDOWS\system32\drivers\usbVM303.sys (Vimicro Corporation)
DRV - (vmfilter303) – C:\WINDOWS\system32\drivers\vmfilter303.sys (Vimicro Corporation)
DRV - (dtscsi) – C:\WINDOWS\System32\Drivers\dtscsi.sys (DT Soft Ltd.)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (HSFHWCD2) – C:\WINDOWS\system32\drivers\HSFHWCD2.sys (Conexant Systems)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems)
DRV - (nv4) – C:\WINDOWS\system32\drivers\nv4.sys (NVIDIA Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:4.5
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p="
FF - prefs.js..network.proxy.http: ""
FF - prefs.js..network.proxy.http_port: ""
FF - prefs.js..network.proxy.type: ""

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/29 17:45:02 | 000,000,000 | —D | M]

[2008/12/17 17:11:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jones\Application Data\Mozilla\Extensions
[2010/12/25 15:56:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jones\Application Data\Mozilla\Firefox\Profiles\c207s8xr.default\extensions
[2010/03/17 15:40:06 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Jones\Application Data\Mozilla\Firefox\Profiles\c207s8xr.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/25 15:42:07 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Jones\Application Data\Mozilla\Firefox\Profiles\c207s8xr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/09/29 17:45:02 | 000,000,000 | —D | M] (HP Smart Web Printing) – C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

O1 HOSTS File: ([2001/08/19 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IeMonitorBho Class) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (Megaupload Limited)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe (Vimicro)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [UpdateReminder] C:\Program Files\ESET\UpdateReminder.exe (ESET, spol. s r.o.)
O4 - HKLM..\Run: [VMSnap3] C:\WINDOWS\vmsnap3.exe (ZSMCSNAP)
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\System32\imon.dll (Eset )
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1168006931250 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_07)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Jones\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jones\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/01/19 07:39:54 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/03 09:53:40 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/30 07:18:26 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/04/29 20:41:50 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/04/29 20:25:10 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/04/29 20:25:10 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/04/29 20:25:10 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/04/29 20:25:10 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/04/29 20:24:46 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/04/29 20:24:20 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/28 11:50:28 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jones\Desktop\OTL.exe
[2011/04/28 03:05:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/04/27 22:43:46 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Jones\Recent
[2007/02/07 06:40:49 | 002,391,884 | —- | C] (Macromedia, Inc.) – C:\Program Files\Start.exe
[2007/02/07 06:40:49 | 000,057,344 | —- | C] (The Learning Company) – C:\Program Files\UNINSTALL.EXE
[2007/02/07 06:40:49 | 000,045,056 | —- | C] (The Learning Company) – C:\Program Files\TLCRUN.EXE

========== Files - Modified Within 30 Days ==========

[2011/05/06 11:07:03 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1006UA.job
[2011/05/06 11:02:05 | 000,001,230 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/06 10:55:05 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1004UA.job
[2011/05/06 07:57:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/06 07:57:07 | 133,746,688 | -HS- | M] () – C:\hiberfil.sys
[2011/05/06 06:55:05 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1004Core.job
[2011/05/05 19:07:04 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-429115175-3153008980-2320958936-1006Core.job
[2011/05/01 09:27:44 | 000,019,151 | —- | M] () – C:\Documents and Settings\Jones\Application Data\7F6E.1D8
[2011/04/30 07:15:23 | 004,333,524 | R— | M] () – C:\Documents and Settings\Jones\Desktop\ComboFix.exe
[2011/04/30 07:11:49 | 000,002,265 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Skype.lnk
[2011/04/29 20:42:26 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/04/29 19:57:16 | 000,000,800 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/29 17:51:47 | 000,002,288 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Google Chrome.lnk
[2011/04/29 17:51:47 | 000,002,266 | —- | M] () – C:\Documents and Settings\Jones\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/04/29 17:19:54 | 000,000,372 | —- | M] () – C:\Documents and Settings\Jones\My Documents\spider.sav
[2011/04/29 08:46:15 | 000,000,150 | —- | M] () – C:\Documents and Settings\Jones\Desktop\rk-proxy.reg
[2011/04/29 08:42:33 | 001,006,778 | —- | M] () – C:\Documents and Settings\Jones\Desktop\iExplore.exe
[2011/04/28 12:40:02 | 000,133,632 | —- | M] () – C:\Documents and Settings\Jones\Desktop\RKUnhookerLE.EXE
[2011/04/28 11:51:53 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jones\Desktop\OTL.exe
[2011/04/28 03:06:37 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/04/25 22:31:56 | 000,044,032 | —- | M] () – C:\Documents and Settings\Jones\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/25 11:09:25 | 000,002,377 | —- | M] () – C:\Documents and Settings\Jones\Desktop\Children's Encarta.lnk
[2011/04/11 12:06:28 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini

========== Files Created - No Company Name ==========

[2011/05/01 08:58:58 | 000,000,800 | —- | C] () – C:\Documents and Settings\Jones\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/04/29 20:42:26 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/04/29 20:42:09 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/04/29 20:25:10 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/04/29 20:25:10 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/04/29 20:25:10 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/04/29 20:25:10 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/04/29 20:25:10 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/29 20:18:27 | 004,333,524 | R— | C] () – C:\Documents and Settings\Jones\Desktop\ComboFix.exe
[2011/04/29 08:46:06 | 000,000,150 | —- | C] () – C:\Documents and Settings\Jones\Desktop\rk-proxy.reg
[2011/04/29 08:39:49 | 001,006,778 | —- | C] () – C:\Documents and Settings\Jones\Desktop\iExplore.exe
[2011/04/28 12:39:33 | 000,133,632 | —- | C] () – C:\Documents and Settings\Jones\Desktop\RKUnhookerLE.EXE
[2011/04/28 03:06:37 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011/04/27 21:36:42 | 000,019,151 | —- | C] () – C:\Documents and Settings\Jones\Application Data\7F6E.1D8
[2011/04/25 15:29:01 | 000,002,265 | —- | C] () – C:\Documents and Settings\Jones\Desktop\Skype.lnk
[2011/03/20 11:42:33 | 000,000,466 | —- | C] () – C:\Program Files\0320201111423315.bat
[2011/01/30 10:14:56 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/29 17:16:55 | 000,165,664 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/09/29 17:16:55 | 000,000,586 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2009/10/02 14:38:20 | 000,241,744 | —- | C] () – C:\WINDOWS\System32\DNLEng.dll
[2009/10/02 14:38:18 | 001,022,944 | —- | C] () – C:\WINDOWS\dbplugin.exe
[2008/12/02 09:25:47 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/11/29 09:08:52 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\setupfilter.exe
[2007/03/06 13:10:27 | 000,000,023 | —- | C] () – C:\WINDOWS\MegaManager.INI
[2007/02/11 03:27:41 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2007/02/07 06:41:02 | 000,000,284 | —- | C] () – C:\Program Files\UNINSTALL.INF
[2007/02/07 06:40:52 | 000,600,620 | —- | C] () – C:\Program Files\opening.dxr
[2007/02/07 06:40:49 | 000,000,268 | —- | C] () – C:\Program Files\TLCRUN.INI
[2007/02/07 06:40:44 | 000,015,845 | —- | C] () – C:\Program Files\Uninst.isu
[2007/02/07 06:39:31 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2007/01/14 16:11:44 | 000,004,096 | —- | C] () – C:\WINDOWS\is941.exe
[2007/01/14 13:28:32 | 000,000,053 | —- | C] () – C:\WINDOWS\System32\imon1.dat
[2007/01/05 21:54:29 | 000,015,424 | —- | C] () – C:\WINDOWS\System32\drivers\nod32drv.sys
[2007/01/05 07:28:24 | 000,000,000 | —- | C] () – C:\WINDOWS\ka.ini
[2006/07/08 01:43:12 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2006/07/08 01:04:06 | 000,000,000 | —- | C] () – C:\WINDOWS\vpc32.INI
[2006/07/07 22:19:40 | 000,000,040 | —- | C] () – C:\WINDOWS\System32\profile.dat
[2006/07/07 07:45:14 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/05/17 04:51:34 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/03/30 19:26:24 | 000,107,134 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2006/03/30 19:26:05 | 000,003,607 | —- | C] () – C:\WINDOWS\mozver.dat
[2006/01/22 09:10:19 | 000,044,032 | —- | C] () – C:\Documents and Settings\Jones\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/20 05:23:30 | 000,000,119 | —- | C] () – C:\WINDOWS\QTW.INI
[2006/01/20 05:16:15 | 000,004,001 | —- | C] () – C:\WINDOWS\hpdj3740.ini
[2006/01/20 00:19:09 | 000,000,039 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2006/01/20 00:09:36 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/19 22:43:27 | 001,519,616 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2006/01/19 22:43:26 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/01/19 22:43:25 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/01/19 22:43:24 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/01/19 22:43:21 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/01/19 22:43:21 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2006/01/19 22:43:21 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/01/19 22:43:21 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/01/19 22:43:17 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2006/01/19 22:43:17 | 000,043,008 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/01/19 22:43:15 | 000,425,984 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2006/01/19 22:40:16 | 000,006,454 | —- | C] () – C:\WINDOWS\System32\drivers\firmware.bin
[2006/01/19 08:05:09 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2006/01/19 07:51:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/01/19 07:50:10 | 000,004,536 | —- | C] () – C:\WINDOWS\oembios.dat
[2006/01/19 07:50:07 | 013,107,200 | —- | C] () – C:\WINDOWS\oembios.bin
[2006/01/19 07:48:19 | 000,000,887 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/01/19 07:48:00 | 000,002,359 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/01/19 07:43:27 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2006/01/19 07:36:53 | 000,022,736 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2006/01/19 07:32:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/01/19 07:31:50 | 000,301,232 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/08/29 20:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2002/08/29 20:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2002/08/29 20:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2002/08/29 20:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2002/08/29 20:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2002/08/29 20:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2002/08/29 20:00:00 | 000,004,463 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2002/08/29 20:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[1980/01/01 16:00:00 | 000,313,368 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[1980/01/01 16:00:00 | 000,041,036 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[1980/01/01 16:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/11/25 20:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DigitalBlue
[2011/04/28 03:05:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2007/03/14 18:10:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/03/20 11:40:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/01/27 23:02:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\calibre
[2010/11/26 16:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Disney Mix It Plug-in
[2008/12/21 13:48:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Gamelab
[2011/03/19 14:00:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\GOL_byHasbro
[2007/03/06 13:05:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Megaupload
[2008/08/28 15:49:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\MegauploadToolbar
[2011/03/19 13:55:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Oberon Media
[2007/09/19 19:26:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\Opera
[2007/03/14 18:10:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Jones\Application Data\PlayFirst

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/01/19 07:39:54 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/01/30 12:50:56 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/04/29 20:42:26 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2006/01/19 07:22:28 | 000,000,512 | -HS- | M] () – C:\BOOTSECT.DOS
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2006/01/19 07:39:54 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/05/06 07:57:07 | 133,746,688 | -HS- | M] () – C:\hiberfil.sys
[2006/01/19 07:56:18 | 000,000,073 | —- | M] () – C:\ImageLibraryDebug.log
[2006/12/17 13:27:01 | 000,001,407 | —- | M] () – C:\inferno.log
[2007/06/24 19:42:36 | 000,000,437 | —- | M] () – C:\INSTALL.LOG
[2006/01/19 07:39:54 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/12/30 11:55:06 | 000,000,480 | -H– | M] () – C:\IPH.PH
[2008/11/23 16:47:35 | 002,637,905 | —- | M] () – C:\log.txt
[2006/01/19 07:39:54 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/02/12 07:49:30 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2007/02/12 07:49:29 | 000,250,032 | RHS- | M] () – C:\ntldr
[2009/06/03 12:45:02 | 000,262,144 | —- | M] () – C:\ntuser.dat
[2009/06/03 12:45:02 | 000,001,024 | -H– | M] () – C:\ntuser.dat.LOG
[2011/05/06 07:57:05 | 1048,576,000 | -HS- | M] () – C:\pagefile.sys
[2011/04/21 20:16:09 | 000,000,300 | —- | M] () – C:\PromoPlugin.log
[2011/04/29 08:46:18 | 000,000,855 | —- | M] () – C:\rkill.log
[2011/04/28 02:20:39 | 000,077,874 | —- | M] () – C:\TDSSKiller.2.4.21.0_28.04.2011_02.18.40_log.txt
[2011/04/28 02:37:10 | 000,038,696 | —- | M] () – C:\TDSSKiller.2.4.21.0_28.04.2011_02.35.44_log.txt
[2007/05/21 17:07:15 | 000,000,146 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/01/20 01:22:17 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/04/16 14:08:20 | 000,312,832 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpfpp70v.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2005/04/13 06:29:32 | 000,802,816 | —- | M] (Sprout Games, LLC) – C:\WINDOWS\FeedingFrenzy.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/03/20 11:42:33 | 000,000,466 | —- | M] () – C:\Program Files\0320201111423315.bat
[2001/10/18 02:48:18 | 000,002,998 | —- | M] () – C:\Program Files\Birthday.ico
[2002/01/15 07:46:40 | 000,000,766 | —- | M] () – C:\Program Files\ereg32.ico
[2002/03/19 07:40:46 | 000,600,620 | —- | M] () – C:\Program Files\opening.dxr
[2002/02/15 09:05:24 | 002,391,884 | —- | M] (Macromedia, Inc.) – C:\Program Files\Start.exe
[2002/01/15 07:46:40 | 000,045,056 | —- | M] (The Learning Company) – C:\Program Files\TLCRUN.EXE
[2007/02/07 06:44:27 | 000,000,268 | —- | M] () – C:\Program Files\TLCRUN.INI
[2007/02/07 06:44:40 | 000,015,845 | —- | M] () – C:\Program Files\Uninst.isu
[2002/01/15 07:46:40 | 000,057,344 | —- | M] (The Learning Company) – C:\Program Files\UNINSTALL.EXE
[2007/02/07 06:43:15 | 000,000,284 | —- | M] () – C:\Program Files\UNINSTALL.INF

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/01/19 19:11:59 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/01/20 01:05:41 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2006/01/19 19:11:59 | 015,990,784 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/01/19 19:12:00 | 003,145,728 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2007/02/12 08:05:58 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/02/12 10:30:01 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\Jones\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/01/20 01:30:37 | 000,000,079 | —- | M] () – C:\Documents and Settings\Jones\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/04/30 07:15:23 | 004,333,524 | R— | M] () – C:\Documents and Settings\Jones\Desktop\ComboFix.exe
[2011/04/29 08:42:33 | 001,006,778 | —- | M] () – C:\Documents and Settings\Jones\Desktop\iExplore.exe
[2011/04/28 11:51:53 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jones\Desktop\OTL.exe
[2011/04/28 12:40:02 | 000,133,632 | —- | M] () – C:\Documents and Settings\Jones\Desktop\RKUnhookerLE.EXE

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/02/12 10:30:02 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Jones\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/05/06 11:01:23 | 000,032,768 | -HS- | M] () – C:\Documents and Settings\Jones\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-21 10:12:00

< End of report >

my computer has been working pretty well, the only problem is i still can't access the internet on my account, but other than that, no strange problems. i'm not being redirected to other sites anymore when i use search engines, the firewall stopped turning off by itself, and security shield seems to be gone.

mowman

Post #23May 6, 2011, 7:14 AM UTC last edited May 6, 2011, 7:15 AM UTC

i still can't access the internet on my account

Is that just in Opera,can you use IE and Firefox?

Try this for Opera if there is a proxy server present in Opera

How to disable proxy settings in Opera 10

To disable proxy settings:

• Select Tools and then Preferences.

• Open the Advanced tab and select the Network sub-category.

• Click the Proxy servers button.

• Remove proxy information from the corresponding fields.

• Click OK.

Next

Please scan the following files

Please visit Virus Total by clicking here.
Click the Browse button and search for the following file: C:\Program Files\0320201111423315.bat
Click Open.
Then click Send File.
Please be patient while the file is scanned.
If Virus Total tells you that the file has already been scanned, click "reanalyse now".

Once the scan results appear, copy and paste them into Notepad and post the results.

blaugrana15

Post #24May 6, 2011, 11:00 AM UTC

it's not just opera, i can't access the internet in other browsers like google chrome either. anyway, here are the virustotal results: Antivirus Version Last Update Result AhnLab-V3 2011.05.06.05 2011.05.06 - AntiVir 7.11.7.163 2011.05.06 - Antiy-AVL 2.0.3.7 2011.05.06 - Avast 4.8.1351.0 2011.05.05 - Avast5 5.0.677.0 2011.05.05 - AVG 10.0.0.1190 2011.05.06 - BitDefender 7.2 2011.05.06 - CAT-QuickHeal 11.00 2011.05.06 - ClamAV 0.97.0.0 2011.05.06 - Commtouch 5.3.2.6 2011.05.06 - Comodo 8601 2011.05.06 - eSafe 7.0.17.0 2011.05.05 - eTrust-Vet 36.1.8311 2011.05.06 - F-Prot 4.6.2.117 2011.05.06 - F-Secure 9.0.16440.0 2011.05.06 - Fortinet 4.2.257.0 2011.05.06 - GData 22 2011.05.06 - Ikarus T3.1.1.103.0 2011.05.06 - Jiangmin 13.0.900 2011.05.05 - K7AntiVirus 9.101.4574 2011.05.05 - Kaspersky 9.0.0.837 2011.05.06 - McAfee 5.400.0.1158 2011.05.06 - McAfee-GW-Edition 2010.1D 2011.05.05 - Microsoft 1.6802 2011.05.06 - NOD32 6099 2011.05.06 - Norman 6.07.07 2011.05.06 - Panda 10.0.3.5 2011.05.05 - PCTools 7.0.3.5 2011.05.06 - Prevx 3.0 2011.05.06 - Rising 23.56.04.03 2011.05.06 - Sophos 4.65.0 2011.05.06 - SUPERAntiSpyware 4.40.0.1006 2011.05.06 - Symantec 20101.3.2.89 2011.05.06 - TheHacker 6.7.0.1.189 2011.05.06 - TrendMicro 9.200.0.1012 2011.05.06 - TrendMicro-HouseCall 9.200.0.1012 2011.05.06 - VBA32 3.12.16.0 2011.05.06 - VIPRE 9200 2011.05.06 - ViRobot 2011.5.6.4448 2011.05.06 - VirusBuster 13.6.338.0 2011.05.05 - is that correct?

mowman

Post #25May 7, 2011, 10:30 AM UTC

I can't see any reason why you can't connect to the internet from your account only,you should ask in our Windows forum and they should be able to help fix that. http://forums.whatthetech.com/index.php?showforum=119

The logs appear clean regarding malware so we will now clean up the tools we have used.

ComboFix - Cleanup
Time for some housekeeping

Click Start…select Run from the menu.
Copy and paste the following into the text entry box:
Combofix /Uninstall
Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 25 and save it to your desktop.
Scroll down to where it says JDK 6 Update 25 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u25 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u25-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

blaugrana15

Post #26May 10, 2011, 1:52 PM UTC

okay. will do those. thank you SO much for the help!

mowman

Post #27May 10, 2011, 10:15 PM UTC

You're welcome,glad we could help

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

I tried removing the google redirect virus on my computer, but it'

✨ Ask AI

Ask AI