What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Searchqu, datamngrui by discordia, ltd.

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Ok so I have searchqu and datamngrui on my computer, i didnt really notice anything other then the frequent redirection of my page, so i figured it was harmless, ill just not click the page, and redirect myself to google again, now i have to click every link twice, wait ages for pages to load and all that good stuff anyhow i ive read, and downloaded all the stuff LDtate posted, i just need a little guidance, also im assuming i got the the datamngrui by discordia from bareshare because when i click properties on it, it says signiture is signed by bandoo, and bandoo im assuming made bareshare, which i researched and im assuming was sold to a company in new york who has malicious intentions, i guess, anyway a little help would be appreciated.
Post #2
Hello jimmyroberts1991 and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

OK, let’s get rid of this mess.• Hold down the Windows key and press R to open a run box
• type the following text into the run box

appwiz.cpl

• This will open your Programs And Features
• A list of installed programs will appear
• Remove the following program:

Searchqu 406 MediaBar

===================================================

Download and run OTL
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
===================================================

Run aswMBR

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
🖼Click to load external image (Posted Image)

On completion of the scan click save log, save it to your desktop and post in your next reply
🖼Click to load external image (Posted Image)

Logs to include with next post:

OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan
Post #3
ok i just wanted to mention some things i failed to mention before,(also im following your direction but) a month or so ago i read another post from this site that concerned this and didnt realize it was so crucial to have personal help so I downloaded and ran combo fix myself, luckily i still have the logs, and that program, i dont know if it helped, not sure if i even still have this virus, but id rather be safe then sorry so when i send all the logs, i will also send the combofix logs also. also i ran a hijackthis scan, i followed the directions given by ldtate, so all the programs ive run have been run correctly, i will also include those logs.thanks alot and i will check for a reply sometime tonight.also i couldnt include otl log into the first post it will be in the second

Attachments:

Post #7
Hi jimmyroberts1991

P2P - I see you have P2P software, (uTorrent, Azureus, LimeWire), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall them now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep them, please don’t use them until we have finished up here.

===================================================

Run OTL

  • Double click on the icon to run it.
  • Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
FF - prefs.js..keyword.URL: "http://www.searchqu.com/web?src=ffb&systemid=406&q="
[2011/03/23 08:24:21 | 000,005,529 | —- | M] () – C:\Documents and Settings\heather\Application Data\Mozilla\Firefox\Profiles\o6ohppju.default\searchplugins\SearchquWebSearch.xml
O4 - HKLM..\RunOnce: [removeSearchqutoolbar]  File not found
[2011/04/12 01:38:45 | 000,000,000 | —D | C] – C:\Documents and Settings\heather\Local Settings\Application Data\Ilivid Player
[2011/04/12 01:28:31 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
@Alternate Data Stream - 185 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A26AFC00
@Alternate Data Stream - 159 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F59E8EA
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B3B7A337
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:553CA6CA
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA199F0F

:Files
ipconfig /flushdns /c

:Commands
[resethosts]
[emptyflash]
[purity]
[emptytemp]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
  • start Malwarebytes-Anti-Malware and update it, (“Update” tab}
  • once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Thanks

Satchfan
Post #9
Hi Jimmy

Please copy and paste logs in your replies instead of attaching them. Thanks.

No sign of datamngr that I can see in the OTL logs so I think we’d better use the big guns. ^_^


Run ComboFix

Delete the version of ComboFix on your desktop ,(if there is one), and download a new one from one of the following locations:

Link1
Link2
Link3

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Close any open browser windows
  • Double click on combofix.exe and follow the prompts.
When finished, it will produce a report for you. Please include it in your next reply.

Note:Do not mouseclick combofix's window while it's running. That may cause it to stall

Can you also let me know if there is any difference and what remaining problems there are

Thanks

Satchfan
Post #10
sorry to be such a bother but combofix wont run because it says something like you are unable to rename combo fix-combofix(2) i tried just deleting it completly off my computer so it would be the original combo fix, but i cant seem to find it, i have so much bs.
Post #11
ok disreguard my last, I hit the search button and found the older ones, and deleted them, but i also searched datamngrui.exe again, and found that otl moved it, what that means i dont know. but thats what it did.
Post #12
ok combofix ran heres the log
_________________________________________________________________
ComboFix 11-06-02.02 - heather 06/02/2006 16:23:26.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.546 [GMT -4:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 110523-1] *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\heather\Application Data\H3YSGSXII0.exe
c:\documents and settings\heather\Application Data\PriceGong
c:\documents and settings\heather\Application Data\PriceGong\Data\mru.xml
c:\windows\system\winspool.drv
.
Infected copy of c:\windows\system32\msgsvc.dll was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\msgsvc.dll
.
.
((((((((((((((((((((((((( Files Created from 2006-05-02 to 2006-06-02 )))))))))))))))))))))))))))))))
.
.
2011-05-24 07:35 . 2011-05-24 07:35 ——– d—–w- c:\program files\Divo Games
2011-05-24 05:19 . 2011-05-24 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Enkord
2011-05-24 05:06 . 2011-05-24 05:06 ——– d—–w- c:\program files\Totem Tribe Gold
2011-05-24 05:06 . 2011-05-24 05:06 ——– d—–w- c:\windows\Totem Tribe Gold
2011-05-24 04:49 . 2011-05-24 04:49 ——– d—–w- c:\program files\Vuze
2011-05-23 17:06 . 2011-05-23 17:06 ——– d—–w- c:\program files\FishBone Games
2011-05-23 17:06 . 2011-05-23 17:06 ——– d—–w- C:\Downloads
2011-05-22 19:53 . 2011-05-24 07:48 ——– d—–w- c:\program files\NCH Swift Sound
2011-05-22 15:40 . 2011-05-24 07:48 ——– d—–w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2011-05-22 15:00 . 2009-09-04 21:29 1974616 —-a-w- c:\windows\system32\D3DCompiler_42.dll
2011-05-22 15:00 . 2009-09-04 21:29 1892184 —-a-w- c:\windows\system32\D3DX9_42.dll
2011-05-22 15:00 . 2008-10-15 10:22 4379984 —-a-w- c:\windows\system32\D3DX9_40.dll
2011-05-22 15:00 . 2007-07-19 22:14 3727720 —-a-w- c:\windows\system32\d3dx9_35.dll
2011-05-22 15:00 . 2007-05-16 20:45 3497832 —-a-w- c:\windows\system32\d3dx9_34.dll
2011-05-22 14:59 . 2011-05-22 14:59 ——– d—–w- c:\windows\Logs
2011-05-21 21:52 . 2011-05-21 21:52 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2011-05-21 16:13 . 2011-05-21 16:13 ——– d—–w- c:\program files\Jewel Quest Mysteries The Seventh Gate Collectors Edition
2011-05-21 16:13 . 2011-05-21 16:13 ——– d—–w- c:\windows\Jewel Quest Mysteries The Seventh Gate Collectors Edition
2011-05-21 10:47 . 2011-05-09 20:46 6962000 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{AE41591D-077C-473A-89F5-1CE7C814980C}\mpengine.dll
2011-05-21 07:28 . 2011-05-21 07:28 ——– d—–w- c:\program files\Virtual Villagers 4 - The Tree of Life
2011-05-20 08:40 . 2011-05-20 08:40 ——– d—–w- c:\program files\MSXML 4.0
2011-05-20 06:08 . 2011-05-20 06:09 ——– d—–w- c:\program files\VirtualDJ
2011-05-20 05:38 . 2011-05-20 05:39 ——– d—–w- c:\program files\KooLoader
2011-05-20 04:48 . 2006-05-31 04:27 ——– d—–w- c:\program files\SpeedFan
2011-05-15 03:15 . 2011-05-15 03:15 ——– d—–w- c:\program files\Real E$tate Empire
2011-05-15 03:15 . 2011-05-15 03:15 ——– d—–w- c:\windows\Real E$tate Empire
2011-05-13 22:22 . 2011-05-13 22:22 ——– d—–w- C:\5ab21defccee6f6fbfa10e
2011-05-13 18:45 . 2002-02-27 22:50 197120 —-a-w- c:\windows\patchw32.dll
2011-05-13 18:45 . 2011-05-13 18:45 ——– d—–w- c:\program files\Common Files\PocketSoft
2011-05-13 18:20 . 2011-05-13 18:20 98304 —-a-w- c:\windows\system32\CmdLineExt.dll
2011-05-13 18:01 . 2011-05-13 18:41 ——– d—–w- c:\program files\Atari
2011-04-21 19:50 . 2011-05-21 19:58 ——– d—–w- c:\program files\Infogrames Interactive
2011-04-19 05:40 . 2011-04-19 05:40 23456 —-a-w- c:\windows\system32\drivers\DrvAgent32.sys
2011-04-19 05:31 . 2011-04-19 05:31 ——– d—–w- c:\documents and settings\All Users\Uniblue
2011-04-19 04:54 . 2011-04-19 04:54 84480 —-a-w- c:\windows\system32\EasyHook32.dll
2011-04-19 04:54 . 2011-05-20 15:12 ——– d—–w- c:\program files\DAP
2011-04-19 04:53 . 2011-05-20 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedBit
2011-04-19 04:53 . 1998-12-05 17:18 172032 —-a-w- c:\windows\system32\AniGIF.ocx
2011-04-18 17:05 . 2011-04-20 04:03 ——– d—–w- c:\program files\Road to Riches
2011-04-18 17:05 . 2011-04-18 17:05 ——– d—–w- c:\windows\Road to Riches
2011-04-18 04:16 . 2006-05-31 01:38 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-04-18 03:26 . 2011-04-18 03:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Big Fish Games
2011-04-18 03:26 . 2011-04-18 03:26 ——– d—–w- c:\program files\bfgclient
2011-04-18 03:16 . 2011-04-18 03:28 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2011-04-12 06:46 . 2011-04-12 06:50 ——– d—–w- c:\documents and settings\All Users\Application Data\PMB Files
2011-04-12 06:43 . 2011-04-12 06:43 ——– d—–w- c:\program files\Pando Networks
2011-04-12 06:31 . 2011-04-12 06:33 ——– d—–w- c:\program files\Delivery King
2011-04-12 06:31 . 2011-04-12 06:31 ——– d—–w- c:\windows\Delivery King
2011-03-28 15:37 . 2011-03-28 15:38 967 —-a-w- c:\windows\ScUnin.pif
2011-03-28 15:37 . 2011-03-28 15:38 94208 —-a-w- c:\windows\ScUnin.exe
2011-03-18 09:39 . 2011-02-23 21:04 13496 —-a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
2011-03-18 09:39 . 2011-02-23 20:54 29520 —-a-w- c:\windows\system32\SmartDefragBootTime.exe
2011-03-18 09:39 . 2011-03-18 09:39 ——– d—–w- c:\program files\IObit
2011-03-18 09:37 . 2011-04-20 04:04 ——– d—–w- c:\program files\AntiLogger
2011-03-18 06:38 . 2010-12-20 22:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-18 06:38 . 2011-03-18 06:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-03-18 06:38 . 2011-03-18 06:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-03-18 06:38 . 2010-12-20 22:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-03-12 16:28 . 2011-03-12 16:28 103864 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2011-03-10 02:47 . 2011-03-18 05:00 ——– d—–w- c:\documents and settings\All Users\Application Data\SwiftKit
2011-03-10 02:47 . 2006-05-29 07:06 ——– d—–w- c:\program files\SwiftKit
2011-03-07 03:11 . 2011-03-24 21:54 ——– d—–w- c:\program files\LimeWire
2011-02-20 11:39 . 2011-02-20 11:39 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Zynga
2011-02-20 11:39 . 2011-02-20 11:39 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\uTorrentBar
2011-02-18 13:46 . 2011-02-18 13:46 11691856 —-a-w- c:\program files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
2011-02-16 23:00 . 2011-02-16 23:00 17370496 —-a-w- c:\program files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
2011-02-11 13:25 . 2011-02-11 13:25 229888 ——w- c:\windows\system32\dllcache\fxscover.exe
2011-02-09 13:53 . 2011-02-09 13:53 270848 ——w- c:\windows\system32\dllcache\sbe.dll
2011-02-09 13:53 . 2011-02-09 13:53 186880 ——w- c:\windows\system32\dllcache\encdec.dll
2011-02-09 02:57 . 2011-02-09 02:57 ——– d—–w- c:\program files\Intel
2011-02-09 02:45 . 2011-05-24 08:33 ——– d—–w- c:\program files\Dell
2011-02-07 18:56 . 2011-02-07 18:56 ——– d—–w- c:\program files\SystemRequirementsLab
2011-02-07 15:38 . 2011-02-07 15:38 ——– d—–w- C:\Intel
2011-02-07 00:23 . 2006-03-24 01:12 139264 —-a-w- c:\windows\system32\igfxres.dll
2011-02-07 00:20 . 2006-03-24 01:38 61440 —-a-w- c:\windows\system32\iAlmCoIn_v4543.dll
2011-01-27 03:58 . 2011-01-27 03:58 ——– d—–w- C:\.jagex_cache_32
2011-01-25 05:55 . 2011-01-25 05:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2011-01-21 14:44 . 2011-01-21 14:44 439296 ——w- c:\windows\system32\dllcache\shimgvw.dll
2011-01-15 08:36 . 2011-01-15 08:36 ——– d—–w- c:\program files\VideoLAN
2011-01-13 07:45 . 2009-11-24 23:48 23120 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 07:45 . 2009-11-24 23:49 48560 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 07:45 . 2009-11-24 23:47 27408 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-13 07:45 . 2009-11-24 23:47 97480 —-a-w- c:\windows\system32\AvastSS.scr
2011-01-13 07:45 . 2009-11-24 23:51 93424 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-13 07:45 . 2009-09-15 11:56 94160 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-13 07:45 . 2009-09-15 11:55 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 07:45 . 2009-09-15 11:55 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-13 07:44 . 2009-11-24 23:54 1280480 —-a-w- c:\windows\system32\aswBoot.exe
2011-01-13 07:44 . 2004-01-09 10:13 380928 —-a-w- c:\windows\system32\actskin4.ocx
2011-01-13 07:44 . 2011-01-13 07:44 ——– d—–w- c:\program files\Alwil Software
2011-01-11 13:14 . 2011-01-11 13:14 670032 —-a-w- c:\program files\Common Files\Microsoft Shared\VC\msdia90.dll
2011-01-11 04:00 . 2011-01-11 04:00 641536 —-a-w- c:\program files\Common Files\Microsoft Shared\VC\msdia80.dll
2011-01-10 07:41 . 2011-01-10 07:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2011-01-10 01:33 . 2011-01-10 01:33 ——– d—–w- c:\documents and settings\LocalService\Application Data\Roxio
2011-01-10 01:28 . 2011-01-10 01:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Sonic
2011-01-10 01:26 . 2011-01-10 06:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Roxio
2011-01-10 00:52 . 2011-01-10 00:57 ——– d—–w- c:\windows\system32\NtmsData
2011-01-09 23:54 . 2006-06-02 20:36 256 —-a-w- c:\windows\system32\pool.bin
2011-01-09 23:53 . 2011-01-10 06:18 ——– d—–w- c:\program files\Common Files\Roxio Shared
2011-01-09 23:53 . 2011-01-10 07:43 ——– d—–w- c:\program files\Research In Motion
2011-01-09 20:33 . 2011-01-09 20:33 ——– d—–w- C:\.562_cache_32v4
2011-01-05 23:17 . 2011-01-05 23:17 ——– d—–w- c:\windows\.runecreation
2011-01-05 22:47 . 2011-01-05 22:50 ——– d—–w- C:\ZIGI
2011-01-05 22:33 . 2011-01-05 22:33 ——– d—–w- C:\rpkcache
2010-12-31 20:31 . 2011-03-24 21:52 ——– d—–w- c:\program files\Blubster
2010-12-31 20:12 . 2009-08-07 00:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-12-30 02:03 . 2010-12-30 02:03 ——– d—–w- c:\program files\Zynga
2010-12-26 23:44 . 2011-04-17 04:04 ——– d—–w- c:\program files\Big Money Deluxe
2010-12-26 23:44 . 2010-12-26 23:44 ——– d—–w- c:\windows\Big Money Deluxe
2010-12-26 23:42 . 2010-12-26 23:42 ——– d—–w- c:\program files\GameHouse
2010-12-26 20:04 . 2010-12-26 20:04 ——– d—–w- c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2010-12-26 19:44 . 2010-12-26 19:44 ——– d—–w- c:\windows\CLUE Classic
2010-12-26 19:44 . 2010-12-26 19:44 ——– d—–w- c:\program files\CLUE Classic
2010-12-26 07:26 . 2010-12-26 07:31 ——– d—–w- C:\PwnXile
2010-12-26 07:23 . 2011-02-03 01:40 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-12-26 06:47 . 2010-12-26 07:09 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2010-12-25 17:06 . 2010-12-25 17:06 ——– d—–w- c:\program files\Trymedia
2010-12-25 17:05 . 2010-12-25 17:06 ——– d—–w- c:\program files\WildTangent
2010-12-25 17:05 . 2010-12-25 17:06 ——– d—–w- c:\windows\wt
2010-12-25 17:05 . 2010-12-25 17:05 ——– d—–w- c:\program files\WildTangent Games
2010-12-25 16:33 . 2010-12-25 16:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-12-25 16:32 . 2010-12-25 16:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-12-25 16:23 . 2010-12-25 16:33 ——– d—–w- c:\program files\Yahoo!
2010-12-25 14:23 . 2006-05-29 04:21 ——– d—–w- c:\program files\Starcraft
2010-12-25 14:21 . 2010-12-25 14:21 ——– d—–w- c:\program files\Alcohol Soft
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 05:33 . 2004-08-11 22:12 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-11 22:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-11 22:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2004-08-11 22:00 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-11 22:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2004-08-11 22:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-11 22:00 385024 —-a-w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-11 22:00 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-11 22:00 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-15 12:56 . 2004-08-11 22:00 290432 —-a-w- c:\windows\system32\atmfd.dll
2011-02-11 13:25 . 2004-08-11 22:11 229888 —-a-w- c:\windows\system32\fxscover.exe
2011-02-09 13:53 . 2004-08-11 22:00 270848 —-a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-11 22:00 186880 —-a-w- c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-08-11 22:00 978944 —-a-w- c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-08-11 22:00 974848 —-a-w- c:\windows\system32\mfc42u.dll
2011-01-21 14:44 . 2004-08-11 22:00 439296 —-a-w- c:\windows\system32\shimgvw.dll
2010-12-22 12:34 . 2004-08-11 22:00 301568 —-a-w- c:\windows\system32\kerberos.dll
2010-12-22 11:20 . 2004-08-11 22:11 2690560 —-a-w- c:\windows\system32\mstscax.dll
2010-12-21 11:26 . 2004-08-11 22:11 1034240 —-a-w- c:\windows\system32\mstsc.exe
2010-12-20 17:26 . 2004-08-11 22:00 730112 —-a-w- c:\windows\system32\lsasrv.dll
2010-12-09 15:15 . 2004-08-11 22:00 718336 —-a-w- c:\windows\system32\ntdll.dll
2010-12-09 14:30 . 2004-08-11 22:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2010-12-09 13:42 . 2004-08-11 22:00 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07 . 2004-08-04 03:59 2027008 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-11-18 18:12 . 2004-08-11 22:12 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-11 22:00 249856 —-a-w- c:\windows\system32\odbc32.dll
2010-11-02 15:17 . 2004-08-11 22:00 40960 —-a-w- c:\windows\system32\drivers\ndproxy.sys
2010-09-18 06:53 . 2004-08-11 22:00 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-11 22:00 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-08-27 08:02 . 2004-08-11 22:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-11 22:00 99840 —-a-w- c:\windows\system32\srvsvc.dll
2010-08-23 16:12 . 2004-08-11 22:00 617472 —-a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-11 22:00 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-11 22:00 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-16 12:05 . 2004-08-11 22:00 1288192 —-a-w- c:\windows\system32\ole32.dll
2010-06-30 12:31 . 2004-08-11 22:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-18 17:45 . 2004-08-11 22:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2010-06-17 14:03 . 2004-08-11 22:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 16:17 . 2004-08-11 22:00 143422 —-a-w- c:\windows\system32\l3codecx.ax
2010-06-14 14:31 . 2004-08-11 22:12 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-11 22:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-04-16 15:36 . 2004-08-11 22:00 406016 —-a-w- c:\windows\system32\usp10.dll
2010-03-30 05:52 . 2004-08-11 22:00 262416 —-a-w- c:\windows\system32\mpg4ds32.ax
2010-02-12 04:33 . 2004-08-11 22:00 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-11 22:00 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-05 18:27 . 2004-08-11 22:00 1291776 —-a-w- c:\windows\system32\quartz.dll
2010-01-29 14:43 . 2004-08-11 22:00 307260 —-a-w- c:\windows\system32\l3codeca.acm
2010-01-13 14:01 . 2004-08-11 22:00 86016 —-a-w- c:\windows\system32\cabview.dll
2009-12-24 06:59 . 2004-08-11 22:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2009-12-16 18:43 . 2004-08-11 22:11 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-11-27 17:11 . 2004-08-04 05:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2004-08-11 22:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-18 03:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2004-08-11 22:00 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-11 22:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 05:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2004-08-11 22:00 471552 —-a-w- c:\windows\apppatch\aclayers.dll
2009-10-21 05:38 . 2004-08-11 22:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-11 22:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 04:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-15 16:28 . 2004-08-11 22:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-10-13 10:30 . 2004-08-11 22:00 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-11 22:00 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-11 22:00 79872 —-a-w- c:\windows\system32\raschap.dll
2009-10-08 19:57 . 2004-08-11 22:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2009-10-08 19:56 . 2004-08-11 22:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2009-09-11 14:18 . 2004-08-11 22:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2004-08-11 22:00 58880 —-a-w- c:\windows\system32\msasn1.dll
2009-09-01 14:46 . 2004-08-11 22:00 282654 —-a-w- c:\windows\system32\msaud32.acm
2009-08-26 08:00 . 2004-08-11 22:00 247326 —-a-w- c:\windows\system32\strmdll.dll
2009-08-25 09:17 . 2004-08-11 22:00 354816 —-a-w- c:\windows\system32\winhttp.dll
2009-08-06 23:24 . 2004-08-11 22:12 327896 —-a-w- c:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2004-08-11 22:12 209632 —-a-w- c:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2005-05-26 09:16 44768 —-a-w- c:\windows\system32\wups2.dll
2009-08-06 23:24 . 2004-08-11 22:12 35552 —-a-w- c:\windows\system32\wups.dll
2009-08-06 23:24 . 2004-08-11 22:12 217816 —-a-w- c:\windows\system32\wuaucpl.cpl
2009-08-06 23:24 . 2004-08-11 22:12 53472 —-a-w- c:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2004-08-11 22:00 96480 —-a-w- c:\windows\system32\cdm.dll
2009-08-06 23:23 . 2004-08-11 22:12 575704 —-a-w- c:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2004-08-11 22:12 1929952 —-a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2004-08-11 22:00 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-11 22:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-17 16:22 . 2004-08-11 22:00 1435648 —-a-w- c:\windows\system32\query.dll
2009-07-14 03:43 . 2004-08-11 22:00 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-06-25 08:25 . 2004-08-11 22:00 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-11 22:00 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-24 11:18 . 2004-08-11 22:00 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-12 12:31 . 2004-08-11 22:00 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-11 22:00 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 06:14 . 2004-08-11 22:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-05-07 15:32 . 2004-08-11 22:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-20 17:17 . 2004-08-11 22:00 45568 —-a-w- c:\windows\system32\dnsrslvr.dll
2009-04-02 03:02 . 2004-08-11 22:00 604160 —-a-w- c:\windows\system32\wmspdmod.dll
2009-03-08 08:33 . 2004-08-11 22:00 18944 —-a-w- c:\windows\system32\corpol.dll
2009-03-08 08:32 . 2004-08-11 22:00 72704 —-a-w- c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2004-08-11 22:00 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2004-08-11 22:00 34816 —-a-w- c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2004-08-11 22:00 48128 —-a-w- c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2004-08-11 22:00 45568 —-a-w- c:\windows\system32\mshta.exe
2009-03-08 08:31 . 2004-08-11 22:00 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2009-12-11 13:07 . 2008-09-09 13:26 119808 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-12-09 17:51 3911776 —-a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
2010-12-01 16:27 2735200 —-a-w- c:\program files\Zynga\tbZyng.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 17:51 3911776 —-a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
"{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files\Zynga\tbZyng.dll" [2010-12-01 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
"{7B13EC3E-999A-4B70-B9CB-2617B8323822}"= "c:\program files\Zynga\tbZyng.dll" [2010-12-01 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-04-20 399736]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-07 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Discovery User Input"="c:\discovery\User Input\userin32.exe" [2007-10-12 233472]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-08-24 623960]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-24 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-24 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-24 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]
.
c:\documents and settings\heather\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2011-5-21 225280]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2009-8-24 1799512]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2010-12-24 91440]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-12-24 805392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 07:42 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-425749604-506086566-924725345-1002\Scripts\Logoff\0\0]
"Script"=\\10.1.1.14\FightVir\Clean-Downadup-v1.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-425749604-506086566-924725345-1002\Scripts\Logon\0\0]
"Script"=\\10.1.1.14\FightVir\Clean-Downadup-v1.bat
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 04:46 57344 —-a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-11-15 09:42 33120 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 ——w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2009-12-11 13:07 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-10-30 14:36 256576 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-10-25 23:58 282624 —-a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-08-07 13:06 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\WildTangent Games\\Blackhawk Striker 2\\Blackhawk2.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\heather\\My Documents\\Downloads\\AOE2\\Age of Empires II\\MYTH-age2_x1.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57673:TCP"= 57673:TCP:Pando Media Booster
"57673:UDP"= 57673:UDP:Pando Media Booster
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [3/18/2011 5:39 AM 13496]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/25/2010 10:10 AM 697328]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/13/2011 3:45 AM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/13/2011 3:45 AM 20560]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/4/2010 3:27 PM 135664]
S2 ksopt;Image System;c:\windows\system32\svchost.exe -k netsvcs [8/11/2004 6:00 PM 14336]
S2 ugris;Shell Driver;c:\windows\system32\svchost.exe -k netsvcs [8/11/2004 6:00 PM 14336]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [4/19/2011 1:40 AM 23456]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [1/10/2007 12:18 AM 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/4/2010 3:27 PM 135664]
S3 PTDLBus;PANTECH UM175AL Composite Device Driver;c:\windows\system32\drivers\PTDLBus.sys [12/24/2010 11:31 PM 32256]
S3 PTDLMdm;PANTECH UM175AL Drivers;c:\windows\system32\drivers\PTDLMdm.sys [12/24/2010 11:31 PM 41344]
S3 PTDLVsp;PANTECH UM175AL Diagnostic Port;c:\windows\system32\drivers\PTDLVsp.sys [12/24/2010 11:31 PM 39936]
S3 PTDLWWAN;PANTECH UM175AL WWAN Driver;c:\windows\system32\drivers\PTDLWWAN.sys [12/24/2010 11:31 PM 59776]
S3 VPREMOTE;VPRemote Install Bootstrap Service;c:\temp\Clt-Inst\vpremote.exe [6/18/2009 3:20 PM 141752]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ugris
ksopt
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 22:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.speedbit.com/?aff=113
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\heather\Application Data\Mozilla\Firefox\Profiles\o6ohppju.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-DATAMNGR - c:\progra~1\WI371A~1\Datamngr\DATAMN~1.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2006-06-02 16:35
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(484)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'explorer.exe'(3276)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\mslbui.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\System32\wudfhost.exe
c:\centenn.ial\AUDIT\cagent32.exe
c:\centenn.ial\AUDIT\xferwan.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
.
**************************************************************************
.
Completion time: 2006-06-02 16:41:38 - machine was rebooted
ComboFix-quarantined-files.txt 2006-06-02 20:41
.
Pre-Run: 118,712,766,464 bytes free
Post-Run: 118,764,539,904 bytes free
.
- - End Of File - - 9CB14B1F17542D777735402051FA60FB
Post #13 last edited
Hi Jimmy

IObit

You have IObit Security 360 on your computer. Please see this link and decide if you want to keep or remove it:

http://www.systemlookup.com/lists.php?list…ch=iobit&s=

===================================================

Your scans reveal that the Date/Time on your computer is not set correctly.

Please click on the time at the bottom right and reset the Date/Time to current.

Also make sure that Date and Time Settings has the correct Time Zone.

===================================================

Open ComboFix

Please do the following:• Close any open browsers.
• Close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\afqfo.dll
c:\program files\Internet Explorer\afqfo.dll


Driver::
Ksopt
Ugris

NetSvc::
Ksopt
Ugris

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

Satchfan
Post #14
Hello jimmyroberts1991 It has been several days since I sent my last post with instructions to help with your computer problem.. Please let me know if you are having problems and still need help. Thanks Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI