Spyware / Malware / Virus Removal

plz check HJT log to see if vista 2011 security virus is gone plz

19 min read

Looking for the outcome? Ask AI

felicia452 Topic Starter

Post #1May 4, 2011, 11:57 AM UTC

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:50:32 AM, on 5/4/2011
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Windows\System32\mrt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Yahoo!\Search Protection\YspService.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: YSPManager - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] "c:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [F5D7050v3] C:\Program Files\Belkin\F5D7050v3\Belkinwcui.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [EPSON Artisan 710 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFSA.EXE /FU "C:\Windows\TEMP\E_S8AB2.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Artisan 710(Network)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFSA.EXE /FU "C:\Windows\TEMP\E_S48E2.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\YspService.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [Verizon Media Manager] C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe 0
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O9 - Extra 'Tools' menuitem: Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll/206 (file missing)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 12806 bytes

Blottedisk

Post #2May 6, 2011, 2:08 PM UTC

Hi Felicia,

Do you notice any symptoms? Please follow these steps:

Step 1 | Please download OTL from one of the following mirrors:

This is THE Mirror

——————————————————————–

Save it to your desktop
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it.
Double click inside the Custom Scan box at the bottom.
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel".
Click the OK button and navigate to the file scan.txt which we just saved to your desktop.
Select scan.txt and click Open. Writing will now appear under the Custom Scan box.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in this topic.
You may need two posts to fit them both in.

Step 2 | Please download GMER from one of the following locations and save it to your desktop:

Main Mirror - This version will download a randomly named file (Recommended)
Zipped Mirror - This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

——————————————————————–

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.

Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]

GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
Make sure all options are checked except:
IAT/EAT
Drives/Partition other than Systemdrive, which is typically C:\
Show All (This is important, so do not miss it.)

[external image: Posted Image]
Click the image to enlarge it

Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

– If you encounter any problems, try running GMER in Safe Mode.

felicia452

Post #3May 6, 2011, 4:58 PM UTC

GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-06 12:56:34
Windows 6.0.6000 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD5000AAKS-00A7B2 rev.01.03B01
Running: jq5bn740.exe; Driver: C:\Users\felicia\AppData\Local\Temp\pwldyfod.sys

—- System - GMER 1.0.15 —-

INT 0x51 ? 845D0BF8
INT 0x52 ? 85DF6BF8
INT 0x62 ? 85DF6BF8
INT 0xA2 ? 845D0BF8
INT 0xA3 ? 85DF6BF8
INT 0xB2 ? 845D0BF8
INT 0xB3 ? 85DF6BF8

—- Kernel code sections - GMER 1.0.15 —-

? System32\drivers\dvdgnxw.sys The system cannot find the path specified. !
? System32\Drivers\spap.sys The system cannot find the path specified. !
PAGE ataport.SYS!DllUnload 80619AF4 5 Bytes JMP 845D01D8
.text USBPORT.SYS!DllUnload 901EEFEB 5 Bytes JMP 85DF61D8
.text am7kjlln.SYS 9005B000 22 Bytes [1A, 82, 3A, 82, 04, 81, 3A, …]
.text am7kjlln.SYS 9005B017 27 Bytes [00, 99, 27, 43, 80, A4, 25, …]
.text am7kjlln.SYS 9005B033 39 Bytes [82, 57, 8F, 07, 82, E7, 8F, …]
.text am7kjlln.SYS 9005B05B 91 Bytes [82, F0, 1D, 08, 82, 42, 45, …]
.text am7kjlln.SYS 9005B0B7 22 Bytes [00, 00, 00, 00, 00, 00, 00, …]
.text …

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[1872] ntdll.dll!LdrLoadDll 76ECEB00 5 Bytes JMP 01101410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 84F5D1F8
Device \Driver\volmgr \Device\VolMgrControl 84F5A1F8
Device \Driver\usbohci \Device\USBPDO-0 861B21F8
Device \Driver\usbohci \Device\USBPDO-1 861B21F8
Device \Driver\usbohci \Device\USBPDO-2 861B21F8
Device \Driver\sptd \Device\1627344211 spap.sys
Device \Driver\usbohci \Device\USBPDO-3 861B21F8
Device \Driver\usbohci \Device\USBPDO-4 861B21F8
Device \Driver\usbehci \Device\USBPDO-5 861C51F8
Device \Driver\PCI_PNP4201 \Device\00000049 spap.sys
Device \Driver\USBSTOR \Device\00000070 866A3500
Device \Driver\volmgr \Device\HarddiskVolume1 84F5A1F8
Device \Driver\USBSTOR \Device\00000071 866A3500
Device \Driver\volmgr \Device\HarddiskVolume2 84F5A1F8
Device \Driver\cdrom \Device\CdRom0 861A8500
Device \Driver\atapi \Device\Ide\IdePort0 84F5C1F8
Device \Driver\atapi \Device\Ide\IdePort1 84F5C1F8
Device \Driver\atapi \Device\Ide\IdePort2 84F5C1F8
Device \Driver\atapi \Device\Ide\IdePort3 84F5C1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 84F5C1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-7 84F5C1F8
Device \Driver\cdrom \Device\CdRom1 861A8500
Device \Driver\volmgr \Device\HarddiskVolume3 84F5A1F8
Device \Driver\cdrom \Device\CdRom2 861A8500
Device \Driver\volmgr \Device\HarddiskVolume4 84F5A1F8
Device \Driver\cdrom \Device\CdRom3 861A8500
Device \Driver\volmgr \Device\HarddiskVolume5 84F5A1F8
Device \Driver\volmgr \Device\HarddiskVolume6 84F5A1F8
Device \Driver\netbt \Device\NetBt_Wins_Export 867511F8
Device \Driver\Smb \Device\NetbiosSmb 8675A1F8
Device \Driver\iScsiPrt \Device\RaidPort0 862E3500
Device \Driver\USBSTOR \Device\0000006a 866A3500
Device \Driver\USBSTOR \Device\0000006c 866A3500
Device \Driver\usbohci \Device\USBFDO-0 861B21F8
Device \Driver\USBSTOR \Device\0000006d 866A3500
Device \Driver\usbohci \Device\USBFDO-1 861B21F8
Device \Driver\USBSTOR \Device\0000006e 866A3500
Device \Driver\usbohci \Device\USBFDO-2 861B21F8
Device \Driver\USBSTOR \Device\0000006f 866A3500
Device \Driver\usbohci \Device\USBFDO-3 861B21F8
Device \Driver\usbohci \Device\USBFDO-4 861B21F8
Device \Driver\usbehci \Device\USBFDO-5 861C51F8
Device \Driver\netbt \Device\NetBT_Tcpip_{BD437186-CDE9-4492-9E64-510CD2B7C575} 867511F8
Device \Driver\am7kjlln \Device\Scsi\am7kjlln1Port5Path0Target0Lun0 862DE1F8
Device \Driver\am7kjlln \Device\Scsi\am7kjlln1Port5Path0Target2Lun0 862DE1F8
Device \Driver\am7kjlln \Device\Scsi\am7kjlln1 862DE1F8
Device \Driver\am7kjlln \Device\Scsi\am7kjlln1Port5Path0Target1Lun0 862DE1F8
Device \FileSystem\cdfs \Cdfs 867FA1F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x98 0xE2 0x29 0x97 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x38 0x11 0x1E 0xDD …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x9B 0x52 0x4F 0xBF …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x5A 0x7C 0x4C 0xCC …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xE1 0x64 0x8A 0x13 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x98 0xE2 0x29 0x97 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x38 0x11 0x1E 0xDD …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x9B 0x52 0x4F 0xBF …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x5A 0x7C 0x4C 0xCC …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xE1 0x64 0x8A 0x13 …

—- EOF - GMER 1.0.15 —-

felicia452

Post #4May 6, 2011, 5:00 PM UTC

OTL logfile created on: 5/6/2011 12:22:22 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\felicia\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 69.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 174.63 Gb Free Space | 37.49% Space Free | Partition Type: NTFS

Computer Name: FELICIA-PC | User Name: felicia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/06 12:07:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
PRC - [2011/04/29 12:11:58 | 002,146,496 | —- | M] (Lavasoft Limited) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011/04/29 12:11:58 | 001,191,216 | —- | M] (Lavasoft Limited) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011/01/27 04:33:00 | 012,336,432 | —- | M] (www.BitComet.com) – C:\Program Files\BitComet\BitComet.exe
PRC - [2010/12/28 04:00:34 | 001,296,728 | —- | M] (www.BitComet.com) – C:\Program Files\BitComet\tools\BitCometService.exe
PRC - [2010/09/16 16:04:06 | 001,164,584 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/07/11 03:37:00 | 001,006,264 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2010/07/11 03:21:51 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/03/31 23:34:36 | 000,243,000 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Search Protection\YspService.exe
PRC - [2009/04/07 12:13:10 | 000,673,616 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\Epson Software\Event Manager\EEventManager.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/01 05:39:48 | 000,486,856 | —- | M] (DT Soft Ltd) – C:\Program Files\DAEMON Tools Lite\daemon.exe
PRC - [2007/04/16 20:54:01 | 001,174,152 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2007/04/04 21:54:58 | 000,200,812 | —- | M] () – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
PRC - [2007/04/04 21:54:08 | 000,266,343 | —- | M] (CyberLink) – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
PRC - [2007/03/23 07:04:54 | 004,423,680 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2007/02/07 03:04:26 | 000,457,512 | —- | M] (HiTRSUT) – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007/02/07 03:04:16 | 000,464,168 | —- | M] (HiTRUST) – C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
PRC - [2007/02/02 04:37:40 | 000,630,784 | —- | M] (Motorola Inc.) – C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2007/01/24 13:27:50 | 000,319,488 | —- | M] () – C:\Acer\Empowering Technology\SysMonitor.exe
PRC - [2007/01/24 13:27:42 | 000,319,488 | —- | M] (Acer Inc.) – C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2006/12/29 20:51:56 | 000,028,672 | —- | M] () – C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
PRC - [2006/12/19 21:23:20 | 000,094,208 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
PRC - [2006/11/21 00:45:00 | 000,194,240 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2006/11/21 00:44:28 | 000,107,112 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2006/11/21 00:43:42 | 000,046,736 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

========== Modules (SafeList) ==========

MOD - [2011/05/06 12:07:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
MOD - [2011/04/18 03:01:04 | 000,632,656 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d
4\msvcr80.dll
MOD - [2011/04/18 03:00:57 | 000,097,280 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d1cb520e4353d91
8\ATL80.dll
MOD - [2007/04/16 20:44:16 | 000,229,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
MOD - [2006/11/02 05:46:04 | 000,183,808 | —- | M] (Microsoft Corporation) – C:\Windows\System32\duser.dll
MOD - [2006/11/02 05:38:57 | 001,648,128 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/04/29 12:11:58 | 002,146,496 | —- | M] (Lavasoft Limited) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/12/28 04:00:34 | 001,296,728 | —- | M] (www.BitComet.com) [On_Demand | Running] – C:\Program Files\BitComet\tools\BitCometService.exe – (BITCOMET_HELPER_SERVICE)
SRV - [2010/07/11 03:36:59 | 000,265,912 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2007/04/16 20:54:01 | 001,174,152 | —- | M] (Symantec Corporation) [On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – (Symantec Core LC)
SRV - [2007/04/04 21:54:08 | 000,266,343 | —- | M] (CyberLink) [Auto | Running] – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe – (Acer HomeMedia Connect Service)
SRV - [2007/02/07 03:04:26 | 000,457,512 | —- | M] (HiTRSUT) [Auto | Running] – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe – (eDataSecurity Service)
SRV - [2006/12/29 20:51:56 | 000,028,672 | —- | M] () [Auto | Running] – C:\Acer\Empowering Technology\ePerformance\MemCheck.exe – (AcerMemUsageCheckService)
SRV - [2006/12/19 21:23:20 | 000,094,208 | —- | M] (SEIKO EPSON CORPORATION) [Auto | Running] – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe – (EpsonBidirectionalService)
SRV - [2006/11/21 00:45:00 | 002,541,248 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE – (LiveUpdate)
SRV - [2006/11/21 00:45:00 | 000,194,240 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe – (CLTNetCnService)
SRV - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe – (ccSetMgr)
SRV - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe – (ccEvtMgr)
SRV - [2006/11/21 00:43:42 | 000,046,736 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe – (SymAppCore)
SRV - [2006/11/21 00:42:52 | 000,049,296 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe – (comHost)
SRV - [2006/11/21 00:42:12 | 000,080,552 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\isPwdSvc.exe – (ISPwdSvc)

========== Driver Services (SafeList) ==========

DRV - [2011/04/29 12:12:00 | 000,064,512 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2011/04/29 12:11:58 | 000,015,232 | —- | M] () [Kernel | On_Demand | Running] – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys – (Lavasoft Kernexplorer)
DRV - [2010/12/04 22:18:41 | 000,464,384 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\netr73.sys – (netr73)
DRV - [2010/07/11 10:04:50 | 000,717,296 | —- | M] () [Kernel | Boot | Running] – C:\Windows\System32\Drivers\sptd.sys – (sptd)
DRV - [2007/04/16 20:54:39 | 000,109,744 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2007/03/14 10:04:28 | 002,427,392 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2007/02/02 04:37:36 | 000,982,272 | —- | M] (Motorola Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\smserial.sys – (smserial)
DRV - [2006/11/21 00:45:42 | 000,275,576 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\srtspl.sys – (SRTSPL)
DRV - [2006/11/21 00:45:42 | 000,245,880 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\srtsp.sys – (SRTSP)
DRV - [2006/11/21 00:45:42 | 000,024,184 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\srtspx.sys – (SRTSPX)
DRV - [2006/11/21 00:45:36 | 000,406,672 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2006/11/21 00:44:14 | 000,831,880 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Symantec\Definitions\VirusDefs\20061106.064\NAVEX15.SYS – (NAVEX15)
DRV - [2006/11/21 00:44:12 | 000,079,240 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Symantec\Definitions\VirusDefs\20061106.064\NAVENG.SYS – (NAVENG)
DRV - [2006/11/21 00:44:10 | 000,387,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2006/11/21 00:42:22 | 000,202,872 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\ProgramData\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSvix86.sys – (IDSvix86)
DRV - [2006/10/29 23:22:26 | 000,008,192 | —- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\AtiPcie.sys – (AtiPcie) ATI PCI Express (3GIO)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=http://search.yahoo.com/search?ei=UTF-8&fr;=yff35kawe&p;="
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?fr=fptb-yff40"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.25

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/01 12:38:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/01 12:38:25 | 000,000,000 | —D | M]

[2010/07/10 16:30:49 | 000,000,000 | —D | M] (No name found) – C:\Users\felicia\AppData\Roaming\Mozilla\Extensions
[2011/04/18 09:04:29 | 000,000,000 | —D | M] (No name found) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions
[2011/04/01 12:43:24 | 000,000,000 | —D | M] (4shared.com Community Toolbar) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{09ec805c-cb2e-4d53-b0d3-a75a428b81c7}
[2010/11/26 13:37:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/01 12:39:08 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/18 19:50:21 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}(111)
[2011/02/08 00:29:17 | 000,000,000 | —D | M] (No name found) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2011/04/01 12:43:31 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/04/01 12:43:22 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\[removed]
[2011/04/01 12:38:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/04 20:39:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/25 23:14:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/04/01 12:38:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/04/01 12:38:29 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File not found (No name found) –
[2010/01/01 04:00:00 | 000,135,168 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/08/24 05:31:30 | 000,773,120 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2010/11/04 20:38:32 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBHO.dll (Symantec Corporation)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer Registration\ACE1.exe (Leader Technologies)
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [F5D7050v3] File not found
O4 - HKLM..\Run: [IS CfgWiz] c:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe (Symantec Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [osCheck] c:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Artisan 710(Network)] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFSA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core] File not found
O4 - HKCU..\Run: [EPSON Artisan 710 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFSA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [Verizon Media Manager] C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe ()
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
O8 - Extra context menu item: &D;&ownload; &with; BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{47452df7-1f3e-11e0-bba4-806e6f6e6963}\Shell\AutoRun\command - "" = C:\PROGRA~2\IMESHA~1\iMesh\iMesh.exe
O33 - MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\Shell - "" = AutoRun
O33 - MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\Shell\AutoRun\command - "" = J:\Autorun.exe
O33 - MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\Shell - "" = AutoRun
O33 - MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -a
O33 - MountPoints2\{f042d436-a684-11df-8d48-bd1fd4cedcfc}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\LCGOZ.ExE
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.divxa32 - C:\Windows\System32\DivXa32.acm (Hacked With Joy !)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIV3 - C:\Windows\System32\DivXc32.dll (Hacked with Joy !)
Drivers32: vidc.DIV4 - C:\Windows\System32\DivXc32f.dll (Hacked with Joy !)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.HFYU - C:\Windows\System32\HUFFYUV.DLL (Disappearing Inc.)
Drivers32: vidc.tscc - C:\Program Files\MpcStar\Codecs\tscc\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

========== Files/Folders - Created Within 30 Days ==========

[2011/05/06 12:07:47 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
[2011/05/02 22:25:05 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\Malwarebytes
[2011/05/02 22:24:26 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/02 22:24:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/02 22:24:26 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/05/02 22:24:21 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/02 22:24:20 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/02 22:23:29 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/05/02 22:23:29 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/05/02 19:23:37 | 000,098,392 | —- | C] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2011/05/02 19:12:06 | 000,064,512 | —- | C] (Lavasoft AB) – C:\Windows\System32\drivers\Lbd.sys
[2011/05/02 19:11:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2011/05/02 19:11:55 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2011/05/02 19:11:55 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2011/04/30 15:49:25 | 000,000,000 | —D | C] – C:\Users\felicia\Documents\employment attachments
[2011/04/20 11:58:24 | 000,000,000 | —D | C] – C:\HiTRUSTDrive
[2011/04/18 23:25:01 | 000,000,000 | —D | C] – C:\PerfLogs
[2011/04/18 22:45:50 | 000,000,000 | —D | C] – C:\be0cda5c2b89500927aa400b504074
[2011/04/18 19:42:43 | 000,000,000 | —D | C] – C:\Users\felicia\Desktop\Lynda.Com.QuickBooks.Pro.2010.Essential.Training.part1
[2011/04/18 18:10:15 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Portforward.com
[2011/04/18 18:10:15 | 000,000,000 | —D | C] – C:\Program Files\PFConfig
[2011/04/18 08:25:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet
[2011/04/13 04:10:11 | 000,000,000 | —D | C] – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL2_files
[2011/04/13 04:09:06 | 000,000,000 | —D | C] – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL_files
[2011/04/09 19:27:32 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\BeautyGuide
[2011/04/09 19:22:35 | 000,000,000 | —D | C] – C:\Program Files\Two Pilots
[2011/04/09 19:22:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Beauty Guide
[2011/04/09 19:22:35 | 000,000,000 | —D | C] – C:\Program Files\Beauty Guide
[2010/07/10 18:36:37 | 000,016,384 | —- | C] ( ) – C:\Windows\System32\ClearEvent.exe
[2007/04/16 21:09:21 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll
[1 C:\Users\felicia\Documents\*.tmp files -> C:\Users\felicia\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/06 12:16:53 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/05/06 12:16:53 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/05/06 12:07:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
[2011/05/06 11:51:00 | 000,000,888 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/06 09:50:59 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/06 08:16:51 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/05/05 22:34:45 | 000,000,478 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for felicia.job
[2011/05/05 17:05:50 | 000,588,098 | —- | M] () – C:\Users\felicia\Desktop\strohsneiders app.pdf
[2011/05/04 07:50:32 | 000,012,808 | —- | M] () – C:\Users\felicia\Desktop\hijackthis542011
[2011/05/04 07:49:21 | 000,002,527 | —- | M] () – C:\Users\felicia\Desktop\HiJackThis.lnk
[2011/05/04 07:47:38 | 000,000,761 | —- | M] () – C:\Users\felicia\Desktop\hosts
[2011/05/04 07:42:16 | 000,618,410 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/05/04 07:42:16 | 000,103,818 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/05/04 07:35:55 | 2952,257,536 | -HS- | M] () – C:\hiberfil.sys
[2011/05/02 23:06:03 | 000,000,938 | —- | M] () – C:\Users\Public\Desktop\Comet Player.lnk
[2011/05/02 23:06:03 | 000,000,792 | —- | M] () – C:\Users\Public\Desktop\MpcStar.lnk
[2011/05/02 23:03:44 | 000,046,592 | —- | M] () – C:\Users\felicia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/02 22:24:26 | 000,000,910 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/02 19:23:37 | 000,098,392 | —- | M] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2011/05/02 19:23:36 | 000,016,432 | —- | M] () – C:\Windows\System32\lsdelete.exe
[2011/05/02 19:12:10 | 000,000,941 | —- | M] () – C:\Users\Public\Desktop\Ad-Aware.lnk
[2011/05/02 19:01:21 | 000,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2011/04/30 14:24:48 | 000,011,316 | -HS- | M] () – C:\Users\felicia\AppData\Local\c7b8l4817jy2c
[2011/04/30 14:24:48 | 000,011,316 | -HS- | M] () – C:\ProgramData\c7b8l4817jy2c
[2011/04/29 12:12:00 | 000,064,512 | —- | M] (Lavasoft AB) – C:\Windows\System32\drivers\Lbd.sys
[2011/04/18 18:10:15 | 000,000,848 | —- | M] () – C:\Users\felicia\Desktop\PFConfig.lnk
[2011/04/18 08:25:08 | 000,000,808 | —- | M] () – C:\Users\Public\Desktop\BitComet.lnk
[2011/04/13 04:10:12 | 000,001,576 | —- | M] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL2.htm
[2011/04/13 04:09:07 | 000,001,573 | —- | M] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL.htm
[2011/04/09 19:22:36 | 000,000,851 | —- | M] () – C:\Users\felicia\Desktop\Beauty Guide.lnk
[1 C:\Users\felicia\Documents\*.tmp files -> C:\Users\felicia\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/05 17:05:50 | 000,588,098 | —- | C] () – C:\Users\felicia\Desktop\strohsneiders app.pdf
[2011/05/04 07:50:32 | 000,012,808 | —- | C] () – C:\Users\felicia\Desktop\hijackthis542011
[2011/05/04 07:47:38 | 000,000,761 | —- | C] () – C:\Users\felicia\Desktop\hosts
[2011/05/02 23:06:03 | 000,000,938 | —- | C] () – C:\Users\Public\Desktop\Comet Player.lnk
[2011/05/02 23:06:03 | 000,000,792 | —- | C] () – C:\Users\Public\Desktop\MpcStar.lnk
[2011/05/02 22:24:26 | 000,000,910 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/02 22:23:29 | 000,002,527 | —- | C] () – C:\Users\felicia\Desktop\HiJackThis.lnk
[2011/05/02 22:16:36 | 000,016,432 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2011/05/02 19:12:10 | 000,000,941 | —- | C] () – C:\Users\Public\Desktop\Ad-Aware.lnk
[2011/04/20 13:00:08 | 2952,257,536 | -HS- | C] () – C:\hiberfil.sys
[2011/04/18 22:41:06 | 000,011,316 | -HS- | C] () – C:\Users\felicia\AppData\Local\c7b8l4817jy2c
[2011/04/18 22:41:06 | 000,011,316 | -HS- | C] () – C:\ProgramData\c7b8l4817jy2c
[2011/04/18 18:10:15 | 000,000,848 | —- | C] () – C:\Users\felicia\Desktop\PFConfig.lnk
[2011/04/13 04:10:11 | 000,001,576 | —- | C] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL2.htm
[2011/04/13 04:09:06 | 000,001,573 | —- | C] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL.htm
[2011/04/09 19:22:36 | 000,000,851 | —- | C] () – C:\Users\felicia\Desktop\Beauty Guide.lnk
[2011/01/29 13:26:05 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/01/29 13:13:57 | 000,000,198 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/12/30 20:58:45 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/12/04 22:19:02 | 000,200,704 | —- | C] () – C:\Windows\System32\UpdateDriver.exe
[2010/12/04 22:19:02 | 000,005,224 | —- | C] () – C:\Windows\System32\ucuiinfo.ini
[2010/08/21 13:20:48 | 000,000,000 | —- | C] () – C:\Users\felicia\AppData\Local\packet
[2010/08/04 10:26:09 | 000,053,248 | —- | C] () – C:\Users\felicia\AppData\Roaming\chrtmp
[2010/08/04 10:15:03 | 000,000,096 | —- | C] () – C:\Windows\bizpub32.INI
[2010/07/17 23:06:49 | 000,165,376 | —- | C] () – C:\Windows\System32\unrar.dll
[2010/07/17 23:06:49 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2010/07/17 23:06:48 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/07/17 23:06:48 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2010/07/17 23:06:48 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/07/17 22:30:08 | 000,196,608 | —- | C] () – C:\Windows\System32\avisynth.dll
[2010/07/17 17:54:33 | 000,046,592 | —- | C] () – C:\Users\felicia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/10 18:37:15 | 000,000,044 | —- | C] () – C:\Windows\Acer(Normal).ini
[2010/07/10 18:37:15 | 000,000,042 | —- | C] () – C:\Windows\Acer(Wide).ini
[2010/07/10 18:36:37 | 000,016,384 | —- | C] () – C:\Windows\System32\LauncheRyAgentUser.exe
[2010/07/10 16:20:38 | 000,073,220 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2010/07/10 16:20:38 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2010/07/10 16:20:38 | 000,029,114 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2010/07/10 16:20:38 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2010/07/10 16:20:38 | 000,021,021 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2010/07/10 16:20:38 | 000,015,670 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2010/07/10 16:20:38 | 000,013,280 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2010/07/10 16:20:38 | 000,010,673 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2010/07/10 16:20:38 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2010/07/10 16:20:38 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2010/07/10 16:20:38 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2010/07/10 16:20:38 | 000,001,137 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2010/07/10 16:20:38 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2010/07/10 16:20:38 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2010/07/10 16:20:38 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2010/07/10 16:20:38 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2007/04/16 21:41:33 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2007/04/16 21:09:21 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2007/04/16 20:28:29 | 000,000,818 | —- | C] () – C:\Windows\generic.ini
[2007/04/16 20:28:29 | 000,000,125 | —- | C] () – C:\Windows\Alaunch.ini
[2007/04/16 20:28:26 | 003,107,788 | —- | C] () – C:\Windows\System32\atiumdva.dat
[2007/04/16 20:28:26 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2007/04/16 20:28:25 | 000,143,676 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2007/02/07 02:58:10 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/02/07 02:57:58 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/02/07 02:57:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/02/07 02:56:30 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/02/07 02:56:28 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/02/07 02:52:08 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 18:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/11/13 08:50:06 | 000,071,680 | —- | C] () – C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 08:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,404,240 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,618,410 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,818 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 03:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 03:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2001/12/26 18:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 01:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 18:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 00:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

< End of report >

OTL Extras logfile created on: 5/6/2011 12:22:22 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\felicia\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 69.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 174.63 Gb Free Space | 37.49% Space Free | Partition Type: NTFS

Computer Name: FELICIA-PC | User Name: felicia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1F64DB2C-1519-4367-BBE6-6DAC36FA77B5}" = rport=138 | protocol=17 | dir=out | app=system |
"{29351A03-C875-4612-B8B9-8451F94F68A9}" = rport=137 | protocol=17 | dir=out | app=system |
"{29B011D2-46D2-4CCE-80E5-26CCFC33CBBF}" = rport=445 | protocol=6 | dir=out | app=system |
"{74706287-6482-4F5C-836D-A4EC8DF3FF6F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7DB59A54-C424-4E24-91FE-C4FEDE7D835A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{9E86AFB3-4E8E-4C0D-B46E-B99D1217677B}" = lport=445 | protocol=6 | dir=in | app=system |
"{BD3ED0F4-6C6C-42B9-B7F7-06450CE36F26}" = lport=139 | protocol=6 | dir=in | app=system |
"{C6B05018-0578-4D72-9DA7-47D46734C622}" = rport=139 | protocol=6 | dir=out | app=system |
"{D4914CAF-77B3-4DE1-8194-274FA206E7F8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{DC25129F-7DCD-48C5-8F08-63619D829E7A}" = lport=137 | protocol=17 | dir=in | app=system |
"{EBC1A160-1FAD-4395-8C88-EFFF6B5B99B9}" = lport=138 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{14A6678B-9D13-433B-A284-E1F151A8DCFB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{1955E669-BE1F-4C13-B854-FB32F2900974}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe |
"{33509F09-F58E-4E8D-8295-AF1F83894893}" = protocol=17 | dir=in | app=c:\program files\epsonnet\epsonnet setup\tool09\eneasyapp.exe |
"{3606CC2E-632B-4AD7-A72E-277E92AA6D78}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3FBE3BAD-235A-40FC-B531-288BC20FA950}" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"{5008C911-156B-4C04-837F-157ACF80D6C9}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{5A620900-C81F-4CD1-90C4-2AF22C89990D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{5F06C73B-3B46-4ED5-983C-2880071833B2}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\homemedia connect.exe |
"{5FE0C53B-091F-4597-BBF0-F0602454545A}" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"{64C52DD3-2977-4C34-BDA1-8FD96179DF00}" = dir=in | app=c:\program files\acer arcade live\slideshow dvd\component\clsldvd.exe |
"{6A814592-FC2E-41A3-AC9F-CDD38B5C4415}" = protocol=6 | dir=in | app=c:\program files\epsonnet\epsonnet setup\tool09\eneasyapp.exe |
"{8445352E-4E34-4130-AB08-43B8A56A9491}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8E91A272-4B72-40C7-A90B-5FF611910120}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8F8916EB-A05B-49D9-9076-557A505AAF04}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{9F929495-9364-4AA2-9385-207485A20D7C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{A0E22BD1-9D17-41A4-BF50-419B503C50D0}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\component\dvax2process.exe |
"{A8757501-B402-4C19-AD10-EA4697A9512B}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\videomagician.exe |
"{C0B04953-9D63-4886-9FEE-B20972592777}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe |
"{D181A090-AB40-4E46-B44A-89A54868B91C}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{D230129E-4957-42DB-9310-DDCE42366D56}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{DFFF3429-DA90-43DB-898C-FAEEFE3F39E2}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\homemedia.exe |
"{E59634F8-1C07-40AC-84E1-E301FBC238EE}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\dvdivine.exe |
"{E5D4B0AA-2197-4DE3-8ECF-A8577C9AB39E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{EF393F99-3800-46B8-9713-D96471023143}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{F42A10AE-D383-4A78-9E05-64BBC84376C5}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\component\arawp.exe |
"TCP Query User{228DC1A5-C2D1-4A1E-A6F9-BEE428A19815}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe |
"TCP Query User{2952B6D3-DFB3-4620-97E3-B675CFD26E9D}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{53A136FD-33A9-4615-A704-5AACA4CF489A}C:\program files\verizon\verizon media manager\release\verizon media manager.exe" = protocol=6 | dir=in | app=c:\program files\verizon\verizon media manager\release\verizon media manager.exe |
"TCP Query User{93AD5035-75C7-4CFA-9187-D1A13E816429}E:\wos\souls.exe" = protocol=6 | dir=in | app=e:\wos\souls.exe |
"TCP Query User{A44C478C-8599-4F95-BB50-C4BF9CC2E867}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{AEDC30FA-93C0-497E-82D5-057AB8F5EA30}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"TCP Query User{B93E26CD-D3A6-460E-B606-9EDD45F7C20B}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe |
"TCP Query User{C9024742-99B4-4626-9918-22C9CC9CD42D}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{EA8A541C-7A5D-4B3B-8AAA-0D07BECF02D1}C:\program files\hobbyist software\itunes remote helper\itunesremotehelper.exe" = protocol=6 | dir=in | app=c:\program files\hobbyist software\itunes remote helper\itunesremotehelper.exe |
"UDP Query User{418CEB5E-79FF-4BC6-9D5D-8A3D29D02B69}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"UDP Query User{447850CD-E525-46FC-AD24-0BA6C1EAD7A2}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{5595CC5E-A364-4B69-94E6-BAA3AB67DFAF}C:\program files\verizon\verizon media manager\release\verizon media manager.exe" = protocol=17 | dir=in | app=c:\program files\verizon\verizon media manager\release\verizon media manager.exe |
"UDP Query User{7F5D4A13-4D1D-48C8-B317-2BFCEC1F835E}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{9AE83A43-37A8-40B3-A468-CD9E960B86C0}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{BD498D5D-DCA3-458A-8702-6395F2DBB037}C:\program files\hobbyist software\itunes remote helper\itunesremotehelper.exe" = protocol=17 | dir=in | app=c:\program files\hobbyist software\itunes remote helper\itunesremotehelper.exe |
"UDP Query User{DB9A44A2-1502-4291-9B82-BF8A68A61A79}E:\wos\souls.exe" = protocol=17 | dir=in | app=e:\wos\souls.exe |
"UDP Query User{E1B7F401-D37A-4F42-A1E6-C05ED617D6DF}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe |
"UDP Query User{EC9D674B-F6C5-4256-B0B0-4B1FDD243C80}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"Google Chrome" = Google Chrome
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MpcStar" = MpcStar 5.0

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Blottedisk

Post #5May 6, 2011, 6:35 PM UTC

Hi Felicia, Do you notice any symptoms? Anything outstanding in your machine's behavior?

felicia452

Post #6May 6, 2011, 7:04 PM UTC

No, I don't notice anything different but I haven't restarted it either. I do know that my pre-installed security system repair, restore drive option that comes with Vista system has been missing for months and just last week I had the 2011 vista virus that kept popping up I did a system restore and it didn't seem to work but then I completely turned the computer off for a few days because I got frustrated because I couldn't get the f8 or f10 button to work, then when I turned it back on after a couple days it seems to be gone that's I sent you the hjt log. The security restore options still didn't come back yet. Do I need to completely shut the computer down and turn it back on?

Blottedisk

Post #7May 6, 2011, 10:21 PM UTC

Hi Felicia,

You will restart your machine during the OTL step, so it's fine. Please follow these steps:

Step 1 | Please go to the following site to scan a file: Virus Total

Click on Browse, and upload the following file for analysis:
- C:\Windows\System32\NTIBUN4.dll
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

Step 2 | Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
[2011/04/18 22:41:06 | 000,011,316 | -HS- | C] () – C:\Users\felicia\AppData\Local\c7b8l4817jy2c
[2011/04/18 22:41:06 | 000,011,316 | -HS- | C] () – C:\ProgramData\c7b8l4817jy2c
[1 C:\Users\felicia\Documents\*.tmp files -> C:\Users\felicia\Documents\*.tmp -> ]

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CCS\Services\Tcpip\Parameters]
DhcpNameServer = 192.168.1.1

:Commands
[createrestorepoint]
[purity]
[EmptyFlash]
[emptytemp]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
It will produce a log for you on reboot, please post that log in your next reply.

felicia452

Post #8May 7, 2011, 1:14 AM UTC

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: NTIBUN4.dll Submission date: 2011-05-07 00:43:22 (UTC) Current status: finished Result: 1/ 42 (2.4%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.05.07.00 2011.05.06 - AntiVir 7.11.7.176 2011.05.06 - Antiy-AVL 2.0.3.7 2011.05.06 - Avast 4.8.1351.0 2011.05.06 - Avast5 5.0.677.0 2011.05.06 - AVG 10.0.0.1190 2011.05.06 - BitDefender 7.2 2011.05.07 - CAT-QuickHeal 11.00 2011.05.06 - ClamAV 0.97.0.0 2011.05.07 - Commtouch 5.3.2.6 2011.05.06 - Comodo 8608 2011.05.07 - DrWeb 5.0.2.03300 2011.05.07 - Emsisoft 5.1.0.5 2011.05.06 - eSafe 7.0.17.0 2011.05.05 - eTrust-Vet 36.1.8312 2011.05.06 - F-Prot 4.6.2.117 2011.05.06 - F-Secure 9.0.16440.0 2011.05.07 - Fortinet 4.2.257.0 2011.05.07 - GData 22 2011.05.07 - Ikarus T3.1.1.103.0 2011.05.06 - Jiangmin 13.0.900 2011.05.05 - K7AntiVirus 9.102.4584 2011.05.06 - Kaspersky 9.0.0.837 2011.05.07 - McAfee 5.400.0.1158 2011.05.07 - McAfee-GW-Edition 2010.1D 2011.05.06 - Microsoft 1.6802 2011.05.06 - NOD32 6101 2011.05.07 - Norman 6.07.07 2011.05.06 - Panda 10.0.3.5 2011.05.06 - PCTools 7.0.3.5 2011.05.06 - Prevx 3.0 2011.05.07 - Rising 23.56.04.05 2011.05.06 - Sophos 4.65.0 2011.05.07 - SUPERAntiSpyware 4.40.0.1006 2011.05.07 Rogue.Agent/Gen-Nullo[DLL] Symantec 20101.3.2.89 2011.05.07 - TheHacker 6.7.0.1.189 2011.05.06 - TrendMicro 9.200.0.1012 2011.05.06 - TrendMicro-HouseCall 9.200.0.1012 2011.05.07 - VBA32 3.12.16.0 2011.05.06 - VIPRE 9207 2011.05.07 - ViRobot 2011.5.6.4448 2011.05.06 - VirusBuster 13.6.340.0 2011.05.06 - Additional information MD5 : 85a8250bdc535869b8db788afe224315 SHA1 : e64a724b945fa0a30fbf4716bfad5ac0bb4751ca SHA256: b90d174d08aaf9ef89522c7f4df8b0ac1766330ff0b922eb691c7238bb5b1504 ________________________________________________________________________________ __________________________________ All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== C:\Users\felicia\AppData\Local\c7b8l4817jy2c moved successfully. C:\ProgramData\c7b8l4817jy2c moved successfully. C:\Users\felicia\Documents\~WRL0001.tmp deleted successfully. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SYSTEM\CCS\Services\Tcpip\Parameters\\DhcpNameServer | 192.168.1.1 /E : value set successfully! ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 56504 bytes User: Default User ->Flash cache emptied: 0 bytes User: felicia ->Flash cache emptied: 65048 bytes User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: felicia ->Temp folder emptied: 41128834 bytes ->Temporary Internet Files folder emptied: 32905934 bytes ->Java cache emptied: 576439 bytes ->FireFox cache emptied: 330476694 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 7924733 bytes RecycleBin emptied: 35328 bytes Total Files Cleaned = 394.00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05062011_205516 Files\Folders moved on Reboot… File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot. File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot. C:\Windows\temp\MPENGINE.DLL moved successfully. Registry entries deleted on Reboot…

Blottedisk

Post #9May 7, 2011, 1:59 AM UTC

Thanks for the log. Please do the following:

Step 1 | As you have Malwarebytes' Anti-Malware installed on your computer. Could you please do a scan using these settings:

Open Malwarebytes' Anti-Malware
Select the Update tab
Click Check for Updates
After the update have been completed, Select the Scanner tab.
Select Perform Quick scan, then click on Scan
When done, you will be prompted. Click OK. If Items are found, then click on Show Results
Check all items then click on Remove Selected
After it has removed the items, Notepad will open. Please post this log in your next reply.

The log can also be found here:

C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Or via the Logs tab when the application is started.

Note: MBAM may ask to reboot your computer so it can continue with the removal process, please do so immediately.
Failure to reboot will prevent MBAM from removing all the malware.

Step 2 | Let's perform an ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Please go here then click on: [external image: Posted Image]
Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed make sure you first copy the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.
Now click on: [external image: Posted Image] (Selecting Uninstall application on close if you so wish)

felicia452

Post #10May 7, 2011, 4:56 AM UTC

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6523 Windows 6.0.6000 Internet Explorer 7.0.6000.16982 5/6/2011 10:19:54 PM mbam-log-2011-05-06 (22-19-54).txt Scan type: Quick scan Objects scanned: 149848 Time elapsed: 4 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=0796a5a4d2d099448d241870341d4554 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-05-07 04:44:33 # local_time=2011-05-07 12:44:33 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.0.6000 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=3586 16764890 60 25 127042477 139733295 0 0 # compatibility_mode=5892 16776573 100 100 0 141342919 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=143235 # found=4 # cleaned=0 # scan_time=8082 C:\Downloads\Aiseesoft_Youtube_Converter_Suite_v3.3.02.rar probably a variant of Win32/Agent.BBGEJMC trojan (unable to clean) 00000000000000000000000000000000 I C:\Downloads\bcpro.rar a variant of Win32/Injector.BGO trojan (unable to clean) 00000000000000000000000000000000 I C:\Downloads\daemon_tools.SparkLoaded.com.zip a variant of Win32/Injector.BGI trojan (unable to clean) 00000000000000000000000000000000 I C:\Downloads\The Sims 3 - Razor1911 Final MAXSPEED +vetsoljers patch to 1.3.24\The Sims 3 - Razor1911 MAXSPEED www.torentz.3xforum.ro.iso probably a variant of Win32/Hupigon.CJKIBCX trojan (unable to clean) 00000000000000000000000000000000 I

Blottedisk

Post #11May 8, 2011, 12:14 AM UTC

Good evening,

Please run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL

:Files
C:\Downloads\Aiseesoft_Youtube_Converter_Suite_v3.3.02.rar
C:\Downloads\bcpro.rar
C:\Downloads\daemon_tools.SparkLoaded.com.zip
C:\Downloads\The Sims 3 - Razor1911 Final MAXSPEED +vetsoljers patch to 1.3.24

:Commands
[purity]
[EmptyFlash]
[emptytemp]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
It will produce a log for you on reboot, please post that log in your next reply.

When finished let's take another standard OTL log. Double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Quick Scan button without changing any settings. The scan wont take long.
- When the scan completes, it will open a notepad window: OTL.Txt. It is saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of OTL.Txt, and post it in your next reply.
Note: there will only be an OTL.txt this time

felicia452

Post #12May 9, 2011, 7:07 PM UTC

All processes killed
========== OTL ==========
========== FILES ==========
C:\Downloads\Aiseesoft_Youtube_Converter_Suite_v3.3.02.rar moved successfully.
C:\Downloads\bcpro.rar moved successfully.
C:\Downloads\daemon_tools.SparkLoaded.com.zip moved successfully.
C:\Downloads\The Sims 3 - Razor1911 Final MAXSPEED +vetsoljers patch to 1.3.24\Patches folder moved successfully.
C:\Downloads\The Sims 3 - Razor1911 Final MAXSPEED +vetsoljers patch to 1.3.24\crack folder moved successfully.
C:\Downloads\The Sims 3 - Razor1911 Final MAXSPEED +vetsoljers patch to 1.3.24 folder moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: felicia
->Flash cache emptied: 1152 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: felicia
->Temp folder emptied: 698120 bytes
->Temporary Internet Files folder emptied: 31102171 bytes
->Java cache emptied: 1306881 bytes
->FireFox cache emptied: 156451777 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48386 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 181.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05092011_143653

Files\Folders moved on Reboot…
File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot.

Registry entries deleted on Reboot…

OTL logfile created on: 5/9/2011 3:03:39 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\felicia\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 54.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 167.88 Gb Free Space | 36.04% Space Free | Partition Type: NTFS

Computer Name: FELICIA-PC | User Name: felicia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/06 12:07:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
PRC - [2011/05/02 11:14:11 | 001,191,216 | —- | M] (Lavasoft Limited) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011/05/02 11:14:04 | 002,146,496 | —- | M] (Lavasoft Limited) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011/01/27 04:33:00 | 012,336,432 | —- | M] (www.BitComet.com) – C:\Program Files\BitComet\BitComet.exe
PRC - [2010/12/28 04:00:34 | 001,296,728 | —- | M] (www.BitComet.com) – C:\Program Files\BitComet\tools\BitCometService.exe
PRC - [2010/09/16 16:04:06 | 001,164,584 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/07/11 03:37:00 | 001,006,264 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2010/07/11 03:21:51 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/03/31 23:34:36 | 000,243,000 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Search Protection\YspService.exe
PRC - [2010/01/01 04:00:00 | 000,917,504 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/04/07 12:13:10 | 000,673,616 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\Epson Software\Event Manager\EEventManager.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/01 05:39:48 | 000,486,856 | —- | M] (DT Soft Ltd) – C:\Program Files\DAEMON Tools Lite\daemon.exe
PRC - [2007/04/04 21:54:58 | 000,200,812 | —- | M] () – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
PRC - [2007/04/04 21:54:08 | 000,266,343 | —- | M] (CyberLink) – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
PRC - [2007/03/23 07:04:54 | 004,423,680 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2007/02/07 03:04:26 | 000,457,512 | —- | M] (HiTRSUT) – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007/02/07 03:04:16 | 000,464,168 | —- | M] (HiTRUST) – C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
PRC - [2007/02/02 04:37:40 | 000,630,784 | —- | M] (Motorola Inc.) – C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2007/01/24 13:27:50 | 000,319,488 | —- | M] () – C:\Acer\Empowering Technology\SysMonitor.exe
PRC - [2007/01/24 13:27:42 | 000,319,488 | —- | M] (Acer Inc.) – C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2006/12/29 20:51:56 | 000,028,672 | —- | M] () – C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
PRC - [2006/12/19 21:23:20 | 000,094,208 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe
PRC - [2006/11/21 00:45:00 | 000,194,240 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2006/11/21 00:44:28 | 000,107,112 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2006/11/21 00:43:42 | 000,046,736 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

========== Modules (SafeList) ==========

MOD - [2011/05/06 12:07:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
MOD - [2006/11/02 05:38:57 | 001,648,128 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/05/02 11:14:04 | 002,146,496 | —- | M] (Lavasoft Limited) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/12/28 04:00:34 | 001,296,728 | —- | M] (www.BitComet.com) [On_Demand | Running] – C:\Program Files\BitComet\tools\BitCometService.exe – (BITCOMET_HELPER_SERVICE)
SRV - [2010/07/11 03:36:59 | 000,265,912 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2007/04/16 20:54:01 | 001,174,152 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – (Symantec Core LC)
SRV - [2007/04/04 21:54:08 | 000,266,343 | —- | M] (CyberLink) [Auto | Running] – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe – (Acer HomeMedia Connect Service)
SRV - [2007/02/07 03:04:26 | 000,457,512 | —- | M] (HiTRSUT) [Auto | Running] – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe – (eDataSecurity Service)
SRV - [2006/12/29 20:51:56 | 000,028,672 | —- | M] () [Auto | Running] – C:\Acer\Empowering Technology\ePerformance\MemCheck.exe – (AcerMemUsageCheckService)
SRV - [2006/12/19 21:23:20 | 000,094,208 | —- | M] (SEIKO EPSON CORPORATION) [Auto | Running] – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe – (EpsonBidirectionalService)
SRV - [2006/11/21 00:45:00 | 002,541,248 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE – (LiveUpdate)
SRV - [2006/11/21 00:45:00 | 000,194,240 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe – (CLTNetCnService)
SRV - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe – (ccSetMgr)
SRV - [2006/11/21 00:44:32 | 000,107,624 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe – (ccEvtMgr)
SRV - [2006/11/21 00:43:42 | 000,046,736 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe – (SymAppCore)
SRV - [2006/11/21 00:42:52 | 000,049,296 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe – (comHost)
SRV - [2006/11/21 00:42:12 | 000,080,552 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\isPwdSvc.exe – (ISPwdSvc)

========== Driver Services (SafeList) ==========

DRV - [2011/04/29 12:12:00 | 000,064,512 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2011/04/29 12:11:58 | 000,015,232 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys – (Lavasoft Kernexplorer)
DRV - [2010/12/04 22:18:41 | 000,464,384 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\netr73.sys – (netr73)
DRV - [2010/07/11 10:04:50 | 000,717,296 | —- | M] () [Kernel | Boot | Running] – C:\Windows\System32\Drivers\sptd.sys – (sptd)
DRV - [2007/04/16 20:54:39 | 000,109,744 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2007/03/14 10:04:28 | 002,427,392 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2007/02/02 04:37:36 | 000,982,272 | —- | M] (Motorola Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\smserial.sys – (smserial)
DRV - [2006/11/21 00:45:42 | 000,275,576 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\srtspl.sys – (SRTSPL)
DRV - [2006/11/21 00:45:42 | 000,245,880 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\srtsp.sys – (SRTSP)
DRV - [2006/11/21 00:45:42 | 000,024,184 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\srtspx.sys – (SRTSPX)
DRV - [2006/11/21 00:45:36 | 000,406,672 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2006/11/21 00:44:14 | 000,831,880 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Symantec\Definitions\VirusDefs\20061106.064\NAVEX15.SYS – (NAVEX15)
DRV - [2006/11/21 00:44:12 | 000,079,240 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Symantec\Definitions\VirusDefs\20061106.064\NAVENG.SYS – (NAVENG)
DRV - [2006/11/21 00:44:10 | 000,387,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2006/11/21 00:42:22 | 000,202,872 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\ProgramData\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSvix86.sys – (IDSvix86)
DRV - [2006/10/29 23:22:26 | 000,008,192 | —- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\AtiPcie.sys – (AtiPcie) ATI PCI Express (3GIO)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=http://search.yahoo.com/search?ei=UTF-8&fr;=yff35kawe&p;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/?fr=fptb-yff40"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.25

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/08 22:05:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/08 22:05:38 | 000,000,000 | —D | M]

[2010/07/10 16:30:49 | 000,000,000 | —D | M] (No name found) – C:\Users\felicia\AppData\Roaming\Mozilla\Extensions
[2011/04/18 09:04:29 | 000,000,000 | —D | M] (No name found) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions
[2011/04/01 12:43:24 | 000,000,000 | —D | M] (4shared.com Community Toolbar) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{09ec805c-cb2e-4d53-b0d3-a75a428b81c7}
[2010/11/26 13:37:30 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/01 12:39:08 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/18 19:50:21 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}(111)
[2011/02/08 00:29:17 | 000,000,000 | —D | M] (No name found) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2011/04/01 12:43:31 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/04/01 12:43:22 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\felicia\AppData\Roaming\Mozilla\Firefox\Profiles\efph2tty.default\extensions\[removed]
[2011/04/01 12:38:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/04 20:39:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/25 23:14:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/04/01 12:38:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/04/01 12:38:29 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File not found (No name found) –
[2010/01/01 04:00:00 | 000,135,168 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/08/24 05:31:30 | 000,773,120 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2010/11/04 20:38:32 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBHO.dll (Symantec Corporation)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer Registration\ACE1.exe (Leader Technologies)
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [F5D7050v3] File not found
O4 - HKLM..\Run: [IS CfgWiz] c:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe (Symantec Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [osCheck] c:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Artisan 710(Network)] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFSA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core] File not found
O4 - HKCU..\Run: [EPSON Artisan 710 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFSA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [Verizon Media Manager] C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe ()
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
O8 - Extra context menu item: &D;&ownload; &with; BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{47452df7-1f3e-11e0-bba4-806e6f6e6963}\Shell\AutoRun\command - "" = C:\PROGRA~2\IMESHA~1\iMesh\iMesh.exe
O33 - MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\Shell - "" = AutoRun
O33 - MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\Shell\AutoRun\command - "" = J:\Autorun.exe
O33 - MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\Shell - "" = AutoRun
O33 - MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -a
O33 - MountPoints2\{f042d436-a684-11df-8d48-bd1fd4cedcfc}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\LCGOZ.ExE
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/08 22:16:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/05/08 22:15:09 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/05/08 22:10:28 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/05/08 22:10:26 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/05/08 22:05:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/05/08 22:05:07 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/05/06 20:55:16 | 000,000,000 | —D | C] – C:\_OTL
[2011/05/06 12:07:47 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
[2011/05/02 22:25:05 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\Malwarebytes
[2011/05/02 22:24:26 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/02 22:24:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/02 22:24:26 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/05/02 22:24:21 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/02 22:24:20 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/02 22:23:29 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/05/02 22:23:29 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/05/02 19:23:37 | 000,098,392 | —- | C] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2011/05/02 19:12:06 | 000,064,512 | —- | C] (Lavasoft AB) – C:\Windows\System32\drivers\Lbd.sys
[2011/05/02 19:11:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2011/05/02 19:11:55 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2011/05/02 19:11:55 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2011/04/30 15:49:25 | 000,000,000 | —D | C] – C:\Users\felicia\Documents\employment attachments
[2011/04/20 11:58:24 | 000,000,000 | —D | C] – C:\HiTRUSTDrive
[2011/04/18 23:25:01 | 000,000,000 | —D | C] – C:\PerfLogs
[2011/04/18 22:45:50 | 000,000,000 | —D | C] – C:\be0cda5c2b89500927aa400b504074
[2011/04/18 19:42:43 | 000,000,000 | —D | C] – C:\Users\felicia\Desktop\Lynda.Com.QuickBooks.Pro.2010.Essential.Training.part1
[2011/04/18 18:10:15 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Portforward.com
[2011/04/18 18:10:15 | 000,000,000 | —D | C] – C:\Program Files\PFConfig
[2011/04/18 08:25:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet
[2011/04/13 04:10:11 | 000,000,000 | —D | C] – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL2_files
[2011/04/13 04:09:06 | 000,000,000 | —D | C] – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL_files
[2011/04/09 19:27:32 | 000,000,000 | —D | C] – C:\Users\felicia\AppData\Roaming\BeautyGuide
[2011/04/09 19:22:35 | 000,000,000 | —D | C] – C:\Program Files\Two Pilots
[2011/04/09 19:22:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Beauty Guide
[2011/04/09 19:22:35 | 000,000,000 | —D | C] – C:\Program Files\Beauty Guide
[2010/07/10 18:36:37 | 000,016,384 | —- | C] ( ) – C:\Windows\System32\ClearEvent.exe
[2007/04/16 21:09:21 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 30 Days ==========

[2011/05/09 14:51:00 | 000,000,888 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/09 14:44:49 | 000,618,410 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/05/09 14:44:49 | 000,103,818 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/05/09 14:39:34 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/05/09 14:39:34 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/09 14:39:33 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/05/09 14:39:27 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/05/09 14:39:20 | 2952,257,536 | -HS- | M] () – C:\hiberfil.sys
[2011/05/09 13:22:38 | 000,091,660 | —- | M] () – C:\Users\felicia\Documents\CreditReportDisputeForm.pdf
[2011/05/08 22:16:02 | 000,001,668 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/05/08 22:05:20 | 000,001,730 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/05/08 19:09:00 | 000,000,478 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for felicia.job
[2011/05/07 18:14:55 | 000,107,544 | —- | M] () – C:\Users\felicia\Documents\Office Manager quiz.pdf
[2011/05/06 12:42:41 | 000,302,080 | —- | M] () – C:\Users\felicia\Desktop\jq5bn740.exe
[2011/05/06 12:07:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\felicia\Desktop\OTL.exe
[2011/05/05 17:05:50 | 000,588,098 | —- | M] () – C:\Users\felicia\Desktop\strohsneiders app.pdf
[2011/05/04 07:50:32 | 000,012,808 | —- | M] () – C:\Users\felicia\Desktop\hijackthis542011
[2011/05/04 07:49:21 | 000,002,527 | —- | M] () – C:\Users\felicia\Desktop\HiJackThis.lnk
[2011/05/04 07:47:38 | 000,000,761 | —- | M] () – C:\Users\felicia\Desktop\hosts
[2011/05/02 23:06:03 | 000,000,938 | —- | M] () – C:\Users\Public\Desktop\Comet Player.lnk
[2011/05/02 23:06:03 | 000,000,792 | —- | M] () – C:\Users\Public\Desktop\MpcStar.lnk
[2011/05/02 23:03:44 | 000,046,592 | —- | M] () – C:\Users\felicia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/02 22:24:26 | 000,000,910 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/02 19:23:37 | 000,098,392 | —- | M] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2011/05/02 19:23:36 | 000,016,432 | —- | M] () – C:\Windows\System32\lsdelete.exe
[2011/05/02 19:12:10 | 000,000,941 | —- | M] () – C:\Users\Public\Desktop\Ad-Aware.lnk
[2011/05/02 19:01:21 | 000,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2011/04/29 12:12:00 | 000,064,512 | —- | M] (Lavasoft AB) – C:\Windows\System32\drivers\Lbd.sys
[2011/04/18 18:10:15 | 000,000,848 | —- | M] () – C:\Users\felicia\Desktop\PFConfig.lnk
[2011/04/18 08:25:08 | 000,000,808 | —- | M] () – C:\Users\Public\Desktop\BitComet.lnk
[2011/04/13 04:10:12 | 000,001,576 | —- | M] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL2.htm
[2011/04/13 04:09:07 | 000,001,573 | —- | M] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL.htm
[2011/04/09 19:22:36 | 000,000,851 | —- | M] () – C:\Users\felicia\Desktop\Beauty Guide.lnk

========== Files Created - No Company Name ==========

[2011/05/09 13:22:38 | 000,091,660 | —- | C] () – C:\Users\felicia\Documents\CreditReportDisputeForm.pdf
[2011/05/08 22:16:02 | 000,001,668 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/05/08 22:05:20 | 000,001,730 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/05/07 18:14:55 | 000,107,544 | —- | C] () – C:\Users\felicia\Documents\Office Manager quiz.pdf
[2011/05/06 12:42:37 | 000,302,080 | —- | C] () – C:\Users\felicia\Desktop\jq5bn740.exe
[2011/05/05 17:05:50 | 000,588,098 | —- | C] () – C:\Users\felicia\Desktop\strohsneiders app.pdf
[2011/05/04 07:50:32 | 000,012,808 | —- | C] () – C:\Users\felicia\Desktop\hijackthis542011
[2011/05/04 07:47:38 | 000,000,761 | —- | C] () – C:\Users\felicia\Desktop\hosts
[2011/05/02 23:06:03 | 000,000,938 | —- | C] () – C:\Users\Public\Desktop\Comet Player.lnk
[2011/05/02 23:06:03 | 000,000,792 | —- | C] () – C:\Users\Public\Desktop\MpcStar.lnk
[2011/05/02 22:24:26 | 000,000,910 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/02 22:23:29 | 000,002,527 | —- | C] () – C:\Users\felicia\Desktop\HiJackThis.lnk
[2011/05/02 22:16:36 | 000,016,432 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2011/05/02 19:12:10 | 000,000,941 | —- | C] () – C:\Users\Public\Desktop\Ad-Aware.lnk
[2011/04/20 13:00:08 | 2952,257,536 | -HS- | C] () – C:\hiberfil.sys
[2011/04/18 18:10:15 | 000,000,848 | —- | C] () – C:\Users\felicia\Desktop\PFConfig.lnk
[2011/04/13 04:10:11 | 000,001,576 | —- | C] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL2.htm
[2011/04/13 04:09:06 | 000,001,573 | —- | C] () – C:\Users\felicia\Documents\ROLE_EMPLOYEE.PY_IC_PAY_INQ.GBL.htm
[2011/04/09 19:22:36 | 000,000,851 | —- | C] () – C:\Users\felicia\Desktop\Beauty Guide.lnk
[2011/01/29 13:26:05 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/01/29 13:13:57 | 000,000,198 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/12/30 20:58:45 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/12/04 22:19:02 | 000,200,704 | —- | C] () – C:\Windows\System32\UpdateDriver.exe
[2010/12/04 22:19:02 | 000,005,224 | —- | C] () – C:\Windows\System32\ucuiinfo.ini
[2010/08/21 13:20:48 | 000,000,000 | —- | C] () – C:\Users\felicia\AppData\Local\packet
[2010/08/04 10:26:09 | 000,053,248 | —- | C] () – C:\Users\felicia\AppData\Roaming\chrtmp
[2010/08/04 10:15:03 | 000,000,096 | —- | C] () – C:\Windows\bizpub32.INI
[2010/07/17 23:06:49 | 000,165,376 | —- | C] () – C:\Windows\System32\unrar.dll
[2010/07/17 23:06:49 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2010/07/17 23:06:48 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/07/17 23:06:48 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2010/07/17 23:06:48 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/07/17 22:30:08 | 000,196,608 | —- | C] () – C:\Windows\System32\avisynth.dll
[2010/07/17 17:54:33 | 000,046,592 | —- | C] () – C:\Users\felicia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/10 18:37:15 | 000,000,044 | —- | C] () – C:\Windows\Acer(Normal).ini
[2010/07/10 18:37:15 | 000,000,042 | —- | C] () – C:\Windows\Acer(Wide).ini
[2010/07/10 18:36:37 | 000,016,384 | —- | C] () – C:\Windows\System32\LauncheRyAgentUser.exe
[2010/07/10 16:20:38 | 000,073,220 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2010/07/10 16:20:38 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2010/07/10 16:20:38 | 000,029,114 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2010/07/10 16:20:38 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2010/07/10 16:20:38 | 000,021,021 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2010/07/10 16:20:38 | 000,015,670 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2010/07/10 16:20:38 | 000,013,280 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2010/07/10 16:20:38 | 000,010,673 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2010/07/10 16:20:38 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2010/07/10 16:20:38 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2010/07/10 16:20:38 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2010/07/10 16:20:38 | 000,001,137 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2010/07/10 16:20:38 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2010/07/10 16:20:38 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2010/07/10 16:20:38 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2010/07/10 16:20:38 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2007/04/16 21:41:33 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2007/04/16 21:09:21 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2007/04/16 20:28:29 | 000,000,818 | —- | C] () – C:\Windows\generic.ini
[2007/04/16 20:28:29 | 000,000,125 | —- | C] () – C:\Windows\Alaunch.ini
[2007/04/16 20:28:26 | 003,107,788 | —- | C] () – C:\Windows\System32\atiumdva.dat
[2007/04/16 20:28:26 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2007/04/16 20:28:25 | 000,143,676 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2007/02/07 02:58:10 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/02/07 02:57:58 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/02/07 02:57:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/02/07 02:56:30 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/02/07 02:56:28 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/02/07 02:52:08 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 18:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/11/13 08:50:06 | 000,071,680 | —- | C] () – C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 08:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,404,240 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,618,410 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,818 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 03:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 03:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2001/12/26 18:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 01:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 18:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 00:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2010/07/10 18:40:06 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\Acer
[2011/04/09 19:27:32 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\BeautyGuide
[2011/05/09 15:01:29 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\BitComet
[2010/10/20 13:44:35 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\CometPlayer
[2010/11/04 14:35:11 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\DAEMON Tools
[2011/01/30 13:54:56 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\Epson
[2010/07/10 18:40:05 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\Leadertech
[2010/10/15 23:26:28 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\OpenOffice.org
[2011/02/10 03:05:21 | 000,000,000 | —D | M] – C:\Users\felicia\AppData\Roaming\tigerplayer
[2011/05/09 14:38:24 | 000,032,546 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Blottedisk

Post #13May 10, 2011, 12:56 PM UTC

Hi,

How's the machine working? We are almost done, please follow these steps:

Step 1 | Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
O33 - MountPoints2\{47452df7-1f3e-11e0-bba4-806e6f6e6963}\Shell\AutoRun\command - "" = C:\PROGRA~2\IMESHA~1\iMesh\iMesh.exe
O33 - MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\Shell - "" = AutoRun
O33 - MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\Shell\AutoRun\command - "" = J:\Autorun.exe
O33 - MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\Shell - "" = AutoRun
O33 - MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -a
O33 - MountPoints2\{f042d436-a684-11df-8d48-bd1fd4cedcfc}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\LCGOZ.ExE

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
 "ProxyOverride"=-

:Commands
[createrestorepoint]
[EmptyFlash]
[emptytemp]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
It will produce a log for you on reboot, please post that log in your next reply.

Step 2 | Please go to the following site to scan a file: Virus Total

Click on Browse, and upload the following file for analysis:
- C:\Windows\System32\ClearEvent.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

felicia452

Post #14May 10, 2011, 11:14 PM UTC

All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{47452df7-1f3e-11e0-bba4-806e6f6e6963}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47452df7-1f3e-11e0-bba4-806e6f6e6963}\ not found. File C:\PROGRA~2\IMESHA~1\iMesh\iMesh.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70bfc58d-8cf5-11df-a892-001c25295812}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{70bfc58d-8cf5-11df-a892-001c25295812}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70bfc58d-8cf5-11df-a892-001c25295812}\ not found. File J:\Autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{833b8786-8f82-11df-b42d-001c25295812}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{833b8786-8f82-11df-b42d-001c25295812}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{833b8786-8f82-11df-b42d-001c25295812}\ not found. File N:\LaunchU3.exe -a not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f042d436-a684-11df-8d48-bd1fd4cedcfc}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f042d436-a684-11df-8d48-bd1fd4cedcfc}\ not found. File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\LCGOZ.ExE not found. ========== REGISTRY ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride deleted successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: felicia ->Flash cache emptied: 700 bytes User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: felicia ->Temp folder emptied: 437042 bytes ->Temporary Internet Files folder emptied: 471672 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 129053316 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 108805 bytes RecycleBin emptied: 1115983 bytes Total Files Cleaned = 125.00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05102011_185616 Files\Folders moved on Reboot… File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot. File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot. Registry entries deleted on Reboot… ________________________________________________________________________________ ________________________________ 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: ClearEvent.exe Submission date: 2011-05-10 23:09:08 (UTC) Current status: finished Result: 0/ 42 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.05.11.00 2011.05.10 - AntiVir 7.11.7.214 2011.05.10 - Antiy-AVL 2.0.3.7 2011.05.10 - Avast 4.8.1351.0 2011.05.10 - Avast5 5.0.677.0 2011.05.10 - AVG 10.0.0.1190 2011.05.10 - BitDefender 7.2 2011.05.10 - CAT-QuickHeal 11.00 2011.05.10 - ClamAV 0.97.0.0 2011.05.10 - Commtouch 5.3.2.6 2011.05.10 - Comodo 8654 2011.05.10 - DrWeb 5.0.2.03300 2011.05.11 - eSafe 7.0.17.0 2011.05.09 - eTrust-Vet 36.1.8319 2011.05.10 - F-Prot 4.6.2.117 2011.05.10 - F-Secure 9.0.16440.0 2011.05.11 - Fortinet 4.2.257.0 2011.05.10 - GData 22 2011.05.10 - Ikarus T3.1.1.103.0 2011.05.10 - Jiangmin 13.0.900 2011.05.09 - K7AntiVirus 9.103.4614 2011.05.10 - Kaspersky 9.0.0.837 2011.05.10 - McAfee 5.400.0.1158 2011.05.11 - McAfee-GW-Edition 2010.1D 2011.05.10 - Microsoft 1.6802 2011.05.10 - NOD32 6111 2011.05.11 - Norman 6.07.07 2011.05.10 - nProtect 2011-05-10.01 2011.05.10 - Panda 10.0.3.5 2011.05.10 - PCTools 7.0.3.5 2011.05.10 - Prevx 3.0 2011.05.11 - Rising 23.57.01.05 2011.05.10 - Sophos 4.65.0 2011.05.11 - SUPERAntiSpyware 4.40.0.1006 2011.05.11 - Symantec 20101.3.2.89 2011.05.11 - TheHacker 6.7.0.1.195 2011.05.11 - TrendMicro 9.200.0.1012 2011.05.10 - TrendMicro-HouseCall 9.200.0.1012 2011.05.11 - VBA32 3.12.16.0 2011.05.09 - VIPRE 9247 2011.05.11 - ViRobot 2011.5.9.4451 2011.05.10 - VirusBuster 13.6.347.2 2011.05.10 - Additional information MD5 : ff4cbfd9dc16a3334d50ec5de7c65b6c SHA1 : 6aa537ba42f7e6cbc37ba94a48cbc8dbae5da081 SHA256: 3278d7329ac8ca6d1b0df8f2dd4c6d74de4395c6d77a77e236d7efb78be20eb2

Blottedisk

Post #15May 10, 2011, 11:28 PM UTC

Nice. How's the machine working? Any issues?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

plz check HJT log to see if vista 2011 security virus is gone plz

✨ Ask AI

Ask AI