What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

'rootkit'! Help!

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi My Avast free antivirus suddenly showed a warning about a rootkit, so I deleted it and was instructed to reboot which I did. Then a few minutes later it did the same thing. It has done it another time within a couple of hours since then. I don't know where to start. I have tried researching on forums, but the terminology is way to complicated for me. Please I need help to check the problem and solve it. I am running windows 7 on a compaq presario CQ62 laptop. Thanks
Post #2
Here is the OTL log for my pc. No 'extras' log was created when I ran it as administrator


OTL logfile created on: 2011/6/2 下午 01:56:45 - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\COMPAQ\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000404 | Country: 台灣 | Language: CHT | Date Format: yyyy/M/d

2.00 Gb Total Physical Memory | 0.83 Gb Available Physical Memory | 41.56% Memory free
3.99 Gb Paging File | 2.64 Gb Available in Paging File | 66.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 50.00 Gb Total Space | 4.52 Gb Free Space | 9.05% Space Free | Partition Type: NTFS
Drive D: | 401.11 Gb Total Space | 85.11 Gb Free Space | 21.22% Space Free | Partition Type: NTFS

Computer Name: COMPAQ-PC | User Name: COMPAQ | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\COMPAQ\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\UnHackMe\hackmon.exe (Greatis Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
PRC - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe (Andrea Electronics Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\COMPAQ\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2
a\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2
a\msvcp90.dll (Microsoft Corporation)
MOD - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome10browserrecordhelper.dll (RealNetworks, Inc.)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (NVF) – C:\Users\COMPAQ\AppData\Local\Temp\NVF.exe (Sysinternals - www.sysinternals.com)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\stacsv.exe (IDT, Inc.)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe (Andrea Electronics Corporation)


========== Driver Services (SafeList) ==========

DRV - (RegGuard) – C:\Windows\System32\drivers\regguard.sys (Greatis Software)
DRV - (Partizan) – C:\Windows\system32\drivers\Partizan.sys (Greatis Software)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (ivusb) – C:\Windows\System32\drivers\ivusb.sys (Initio Corporation)
DRV - (AtiHdmiService) – C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (TPkd) – C:\Windows\System32\drivers\TPkd.sys (PACE Anti-Piracy, Inc.)
DRV - (usbfilter) – C:\Windows\System32\drivers\usbfilter.sys (Advanced Micro Devices)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\system32\DRIVERS\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (WDC_SAM) – C:\Windows\System32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (HpqKbFiltr) – C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&am;…amp;affID=17981
IE - HKLM\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof2.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am;…amp;affID=17981
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://tw.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = zh-tw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 50 A5 71 75 2B 59 CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof2.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/10/10 20:38:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/21 09:51:20 | 000,000,000 | —D | M]

[2010/08/05 13:13:25 | 000,000,000 | —D | M] (No name found) – C:\Users\COMPAQ\AppData\Roaming\Mozilla\Extensions
[2010/08/05 13:13:25 | 000,000,000 | —D | M] (No name found) – C:\Users\COMPAQ\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/05/06 22:26:28 | 000,002,428 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2009/06/11 05:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof2.dll (Conduit Ltd.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\tbSof2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found
O4 - HKLM..\RunOnceEx: [Title] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Silver Sands Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Silver Sands Poker\GameClient.exe ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: pps.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ppstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 05:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{446c1618-ea63-11df-8ff5-c80aa991d6fe}\Shell - "" = AutoRun
O33 - MountPoints2\{446c1618-ea63-11df-8ff5-c80aa991d6fe}\Shell\AutoRun\command - "" = G:\autorun.exe
O33 - MountPoints2\{79532974-f143-11df-af51-c80aa991d6fe}\Shell - "" = AutoRun
O33 - MountPoints2\{79532974-f143-11df-af51-c80aa991d6fe}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{7953299a-f143-11df-af51-c80aa991d6fe}\Shell - "" = AutoRun
O33 - MountPoints2\{7953299a-f143-11df-af51-c80aa991d6fe}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (Partizan) - C:\Windows\System32\Partizan.exe (Greatis Software)
O34 - HKLM BootExecute: (ootExecute settings…) - File not found
O34 - HKLM BootExecute: (ount) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.CSM0 - C:\Windows\System32\CSMX.dll ()
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.VMnc - C:\Windows\System32\vmnc.dll (VMware, Inc.)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP62 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP70 - C:\Windows\System32\vp7vfw.dll (On2.com)
Drivers32: VIDC.WMV3 - C:\Windows\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: VIDC.X264 - C:\Windows\System32\x264vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/06/02 13:05:25 | 000,000,000 | —D | C] – C:\2011-06-02-COMPAQ-PC
[2011/06/02 12:53:55 | 000,024,416 | —- | C] (Greatis Software) – C:\Windows\System32\drivers\regguard.sys
[2011/06/02 12:43:03 | 000,039,192 | —- | C] (Greatis Software) – C:\Windows\System32\Partizan.exe
[2011/06/02 12:43:03 | 000,035,816 | —- | C] (Greatis Software) – C:\Windows\System32\drivers\Partizan.sys
[2011/06/02 12:42:57 | 000,000,000 | —D | C] – C:\Users\COMPAQ\Documents\RegRun2
[2011/06/02 12:42:55 | 000,012,808 | —- | C] (Greatis Software, LLC.) – C:\Windows\System32\drivers\UnHackMeDrv.sys
[2011/06/02 12:42:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UnHackMe
[2011/06/02 12:42:55 | 000,000,000 | —D | C] – C:\Users\Public\Documents\regruninfo
[2011/06/02 12:42:52 | 000,000,000 | —D | C] – C:\Program Files\UnHackMe
[2011/06/02 07:09:28 | 000,334,720 | —- | C] (Sysinternals - www.sysinternals.com) – C:\Program Files\RootkitRevealer.exe
[2011/06/01 23:54:20 | 002,486,352 | —- | C] (Trend Micro Inc.) – C:\RootkitBuster.exe
[2011/05/28 22:29:42 | 000,000,000 | —D | C] – C:\Users\COMPAQ\AppData\Roaming\HPAppData
[2011/05/25 12:51:20 | 000,026,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\Diskdump.sys
[2011/05/23 21:16:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LUXONIX
[2011/05/23 21:10:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kuassa
[2011/05/23 20:10:45 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2011/05/23 20:10:45 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/05/23 20:10:45 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/05/23 20:10:45 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/05/23 20:10:45 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/05/23 20:10:45 | 000,580,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/05/23 20:10:45 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2011/05/23 20:10:45 | 000,420,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/05/23 20:10:45 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/05/23 20:10:45 | 000,353,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2011/05/23 20:10:45 | 000,353,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/05/23 20:10:45 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/05/23 20:10:45 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2011/05/23 20:10:45 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2011/05/23 20:10:45 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/05/23 20:10:45 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2011/05/23 20:10:45 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2011/05/23 20:10:45 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2011/05/23 20:10:45 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2011/05/23 20:10:45 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2011/05/23 20:10:45 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/05/23 20:10:45 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2011/05/23 20:10:45 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/05/23 20:10:45 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2011/05/23 20:10:45 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2011/05/23 20:10:45 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/05/23 20:10:45 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2011/05/23 20:10:45 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2011/05/23 20:10:45 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2011/05/23 20:10:45 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/05/23 20:10:45 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/05/23 20:10:45 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/05/23 20:10:45 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2011/05/23 20:10:45 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2011/05/23 20:10:45 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/05/23 20:10:45 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2011/05/23 20:10:45 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/05/23 20:10:45 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/05/23 20:10:45 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/05/23 20:06:36 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2011/05/21 18:13:20 | 000,000,000 | —D | C] – C:\Users\COMPAQ\Documents\KRISTAL Media Files
[2011/05/21 18:02:03 | 000,000,000 | —D | C] – C:\Program Files\Kreatives.org
[2011/05/21 17:11:46 | 000,000,000 | —D | C] – C:\Program Files\Audacity 1.3 Beta (Unicode)
[2011/05/21 13:50:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antares Audio Technologies
[2011/05/21 13:50:19 | 000,000,000 | —D | C] – C:\Users\COMPAQ\AppData\Roaming\Antares
[2011/05/21 13:50:15 | 000,000,000 | —D | C] – C:\Program Files\Antares Audio Technologies
[2011/05/21 13:19:43 | 000,000,000 | —D | C] – C:\Users\COMPAQ\AppData\Roaming\PACE Anti-Piracy
[2011/05/21 13:19:43 | 000,000,000 | —D | C] – C:\Users\COMPAQ\AppData\Local\PACE Anti-Piracy
[2011/05/21 13:19:43 | 000,000,000 | —D | C] – C:\ProgramData\PACE Anti-Piracy
[2011/05/21 13:19:43 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PACE Anti-Piracy
[2011/05/21 13:17:17 | 000,000,000 | —D | C] – C:\Program Files\InterLok
[2011/05/21 09:51:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2011/05/11 23:01:58 | 003,957,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/05/11 23:01:57 | 003,901,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/05/06 22:26:28 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/05/06 22:26:27 | 000,000,000 | —D | C] – C:\Program Files\BabylonToolbar
[2011/05/05 15:04:53 | 000,000,000 | —D | C] – C:\Users\COMPAQ\AppData\Roaming\Audacity
[2011/05/03 21:49:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth

========== Files - Modified Within 30 Days ==========

[2011/06/02 13:50:00 | 000,000,556 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000UA.job
[2011/06/02 13:04:04 | 000,014,224 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/02 13:04:04 | 000,014,224 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/02 13:02:03 | 000,000,530 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/02 13:01:10 | 000,618,912 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/02 13:01:10 | 000,388,224 | —- | M] () – C:\Windows\System32\prfh0404.dat
[2011/06/02 13:01:10 | 000,364,672 | —- | M] () – C:\Windows\System32\prfh0804.dat
[2011/06/02 13:01:10 | 000,107,232 | —- | M] () – C:\Windows\System32\prfc0404.dat
[2011/06/02 13:01:10 | 000,107,232 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/02 13:01:10 | 000,105,092 | —- | M] () – C:\Windows\System32\prfc0804.dat
[2011/06/02 12:56:36 | 000,000,526 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/02 12:56:26 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/02 12:56:23 | 1606,598,656 | -HS- | M] () – C:\hiberfil.sys
[2011/06/02 12:53:55 | 000,024,416 | —- | M] (Greatis Software) – C:\Windows\System32\drivers\regguard.sys
[2011/06/02 12:43:03 | 000,039,192 | —- | M] (Greatis Software) – C:\Windows\System32\Partizan.exe
[2011/06/02 12:43:03 | 000,035,816 | —- | M] (Greatis Software) – C:\Windows\System32\drivers\Partizan.sys
[2011/06/02 12:42:58 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2011/06/02 12:42:58 | 000,001,688 | —- | M] () – C:\Windows\System32\autoexec.nt
[2011/06/02 12:42:58 | 000,000,002 | RHS- | M] () – C:\Windows\winstart.bat
[2011/06/02 12:42:56 | 000,000,881 | —- | M] () – C:\Users\COMPAQ\Desktop\UnHackMe.lnk
[2011/06/01 23:45:35 | 000,001,035 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/31 18:50:00 | 000,000,504 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000Core.job
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/29 00:15:13 | 000,208,066 | —- | M] () – C:\Windows\hpoins40.dat
[2011/05/23 20:11:57 | 000,001,375 | —- | M] () – C:\Users\COMPAQ\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/23 20:10:45 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2011/05/23 20:10:45 | 002,382,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/05/23 20:10:45 | 001,797,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/05/23 20:10:45 | 001,427,456 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/05/23 20:10:45 | 000,716,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/05/23 20:10:45 | 000,580,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/05/23 20:10:45 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2011/05/23 20:10:45 | 000,420,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/05/23 20:10:45 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/05/23 20:10:45 | 000,353,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2011/05/23 20:10:45 | 000,353,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/05/23 20:10:45 | 000,231,936 | —- | M] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/05/23 20:10:45 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2011/05/23 20:10:45 | 000,223,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2011/05/23 20:10:45 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/05/23 20:10:45 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2011/05/23 20:10:45 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2011/05/23 20:10:45 | 000,161,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2011/05/23 20:10:45 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2011/05/23 20:10:45 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2011/05/23 20:10:45 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/05/23 20:10:45 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2011/05/23 20:10:45 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/05/23 20:10:45 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2011/05/23 20:10:45 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2011/05/23 20:10:45 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/05/23 20:10:45 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2011/05/23 20:10:45 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2011/05/23 20:10:45 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2011/05/23 20:10:45 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/05/23 20:10:45 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/05/23 20:10:45 | 000,072,822 | —- | M] () – C:\Windows\System32\ieuinit.inf
[2011/05/23 20:10:45 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/05/23 20:10:45 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2011/05/23 20:10:45 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2011/05/23 20:10:45 | 000,041,472 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/05/23 20:10:45 | 000,035,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2011/05/23 20:10:45 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/05/23 20:10:45 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/05/23 20:10:45 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/05/21 18:02:05 | 000,001,190 | —- | M] () – C:\Users\COMPAQ\Desktop\KRISTAL.lnk
[2011/05/21 17:11:53 | 000,001,070 | —- | M] () – C:\Users\COMPAQ\Desktop\Audacity 1.3 Beta (Unicode).lnk
[2011/05/21 09:51:33 | 000,001,874 | —- | M] () – C:\Users\Public\Desktop\Free Movies & Games.lnk
[2011/05/21 09:51:33 | 000,001,016 | —- | M] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/05/21 09:51:16 | 000,198,848 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\rmoc3260.dll
[2011/05/21 09:51:09 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/05/21 09:51:09 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/05/21 09:51:08 | 000,272,896 | —- | M] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/05/18 10:53:18 | 000,012,808 | —- | M] (Greatis Software, LLC.) – C:\Windows\System32\drivers\UnHackMeDrv.sys
[2011/05/10 20:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2011/05/10 20:10:55 | 000,199,304 | —- | M] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2011/05/10 20:03:54 | 000,441,176 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2011/05/10 20:03:44 | 000,307,928 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2011/05/10 20:02:37 | 000,049,240 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2011/05/10 19:59:56 | 000,025,432 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2011/05/10 19:59:44 | 000,053,592 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2011/05/10 19:59:35 | 000,019,544 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2011/05/06 22:25:47 | 015,588,219 | —- | M] () – C:\Users\COMPAQ\Desktop\PowerSoundEditorFree.exe
[2011/05/03 21:49:29 | 000,002,210 | —- | M] () – C:\Users\Public\Desktop\Google 地球.lnk

========== Files Created - No Company Name ==========

[2011/06/02 12:42:58 | 000,000,002 | RHS- | C] () – C:\Windows\winstart.bat
[2011/06/02 12:42:56 | 000,000,881 | —- | C] () – C:\Users\COMPAQ\Desktop\UnHackMe.lnk
[2011/06/02 07:09:28 | 000,102,160 | —- | C] () – C:\Program Files\RootkitRevealer.chm
[2011/06/01 23:45:35 | 000,001,035 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/23 20:10:45 | 000,072,822 | —- | C] () – C:\Windows\System32\ieuinit.inf
[2011/05/21 18:02:05 | 000,001,202 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KRISTAL.lnk
[2011/05/21 18:02:05 | 000,001,190 | —- | C] () – C:\Users\COMPAQ\Desktop\KRISTAL.lnk
[2011/05/21 17:11:53 | 000,001,082 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity 1.3 Beta (Unicode).lnk
[2011/05/21 17:11:53 | 000,001,070 | —- | C] () – C:\Users\COMPAQ\Desktop\Audacity 1.3 Beta (Unicode).lnk
[2011/05/21 16:51:16 | 003,683,520 | —- | C] () – C:\Program Files\KRISTAL_AE_Setup.exe
[2011/05/21 09:51:33 | 000,001,016 | —- | C] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/05/06 22:25:23 | 015,588,219 | —- | C] () – C:\Users\COMPAQ\Desktop\PowerSoundEditorFree.exe
[2011/05/03 21:49:29 | 000,002,210 | —- | C] () – C:\Users\Public\Desktop\Google 地球.lnk
[2011/03/14 20:51:50 | 000,007,609 | —- | C] () – C:\Users\COMPAQ\AppData\Local\Resmon.ResmonCfg
[2010/12/22 17:37:10 | 000,004,608 | —- | C] () – C:\Users\COMPAQ\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/07 20:16:32 | 000,000,980 | —- | C] () – C:\Windows\eReg.dat
[2010/10/10 20:33:34 | 000,208,066 | —- | C] () – C:\Windows\hpoins40.dat
[2010/10/10 20:33:34 | 000,000,918 | —- | C] () – C:\Windows\hpomdl40.dat
[2010/07/16 06:57:13 | 000,000,046 | —- | C] () – C:\Windows\System32\imon1.dat
[2010/06/27 11:44:14 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/06/27 11:31:12 | 000,201,264 | -H– | C] () – C:\Windows\System32\mlfcache.dat
[2010/02/25 15:55:48 | 000,201,875 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2010/02/23 12:15:02 | 000,001,105 | —- | C] () – C:\Windows\System32\atipblag.dat
[2009/12/03 22:12:51 | 000,364,672 | —- | C] () – C:\Windows\System32\prfh0804.dat
[2009/12/03 22:12:51 | 000,111,310 | —- | C] () – C:\Windows\System32\prfi0804.dat
[2009/12/03 22:12:51 | 000,105,092 | —- | C] () – C:\Windows\System32\prfc0804.dat
[2009/12/03 22:12:51 | 000,031,548 | —- | C] () – C:\Windows\System32\prfd0804.dat
[2009/10/30 14:37:00 | 000,000,055 | —- | C] () – C:\Windows\srstati.ini
[2009/10/30 14:14:26 | 000,073,728 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2009/10/30 13:15:53 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/08/19 22:03:50 | 002,341,888 | —- | C] () – C:\Windows\System32\x264vfw.dll
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/14 16:31:08 | 000,388,224 | —- | C] () – C:\Windows\System32\prfh0404.dat
[2009/07/14 16:31:08 | 000,117,840 | —- | C] () – C:\Windows\System32\prfi0404.dat
[2009/07/14 16:31:08 | 000,107,232 | —- | C] () – C:\Windows\System32\prfc0404.dat
[2009/07/14 16:31:08 | 000,031,548 | —- | C] () – C:\Windows\System32\prfd0404.dat
[2009/07/14 12:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 12:33:53 | 000,457,120 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 10:05:48 | 000,618,912 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 10:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 10:05:48 | 000,107,232 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 10:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 10:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 10:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 08:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/14 07:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 07:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 07:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/11 05:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2009/06/02 18:11:16 | 000,085,504 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/05/30 05:37:40 | 000,205,824 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/05/30 05:31:52 | 000,881,664 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009/02/18 17:55:22 | 000,294,912 | —- | C] () – C:\Windows\System32\ATIODE.exe
[2009/02/03 20:52:04 | 000,045,056 | —- | C] () – C:\Windows\System32\ATIODCLI.exe
[2008/11/07 00:37:32 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2003/09/27 15:00:48 | 000,073,728 | —- | C] () – C:\Windows\System32\CSMX.dll
[2003/08/21 09:08:18 | 000,155,136 | —- | C] () – C:\Windows\System32\UNRAR.DLL
[2003/07/09 15:19:54 | 000,405,558 | —- | C] () – C:\Windows\System32\Esdll.dll
[2002/05/15 12:58:38 | 000,122,880 | —- | C] () – C:\Windows\System32\v2k2_dec.dll

========== LOP Check ==========

[2011/05/21 13:50:19 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\Antares
[2011/05/21 20:58:18 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\Audacity
[2011/03/27 19:39:07 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\Azureus
[2010/11/07 20:02:34 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\DAEMON Tools Lite
[2010/11/07 19:54:27 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\DAEMON Tools Pro
[2010/10/28 23:21:27 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\foobar2000
[2011/05/21 13:20:03 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\PACE Anti-Piracy
[2011/03/28 08:56:21 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\PPStream
[2009/10/30 16:37:16 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\URSoft
[2011/05/31 20:15:43 | 000,000,000 | —D | M] – C:\Users\COMPAQ\AppData\Roaming\uTorrent
[2011/05/19 14:33:02 | 000,032,642 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/11 05:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/14 09:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2009/10/30 13:13:01 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/06/11 05:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2009/10/30 13:17:38 | 000,171,136 | RHS- | M] () – C:\grldr
[2011/06/02 12:56:23 | 1606,598,656 | -HS- | M] () – C:\hiberfil.sys
[2009/10/30 16:31:00 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/10/30 16:31:00 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/06/02 12:56:23 | 2142,134,272 | -HS- | M] () – C:\pagefile.sys
[2010/12/07 18:05:04 | 002,486,352 | —- | M] (Trend Micro Inc.) – C:\RootkitBuster.exe
[2009/10/30 14:22:31 | 000,006,355 | —- | M] () – C:\WPI_Log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 12:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 12:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 12:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 12:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 05:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/04/16 14:08:20 | 000,312,832 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpfpp70v.dll
[2009/07/14 09:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/14 09:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 20:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 12:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2006/07/28 08:32:44 | 000,007,005 | —- | M] () – C:\Program Files\Eula.txt
[2006/11/26 14:21:08 | 003,683,520 | —- | M] () – C:\Program Files\KRISTAL_AE_Setup.exe
[2005/12/07 14:19:40 | 000,102,160 | —- | M] () – C:\Program Files\RootkitRevealer.chm
[2006/11/01 13:07:06 | 000,334,720 | —- | M] (Sysinternals - www.sysinternals.com) – C:\Program Files\RootkitRevealer.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/23 20:11:57 | 000,000,221 | -HS- | M] () – C:\Users\COMPAQ\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/05/06 22:25:47 | 015,588,219 | —- | M] () – C:\Users\COMPAQ\Desktop\PowerSoundEditorFree.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2003/06/13 17:23:00 | 000,004,304 | —- | M] () – C:\Windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 16:53:30

========== Files - Unicode (All) ==========
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度工具?) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度工具栏

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34
@Alternate Data Stream - 1234 bytes -> C:\ProgramData\Microsoft:3bVefQO9VNKVjmKZjMcMtrYUS9Zm
@Alternate Data Stream - 1117 bytes -> C:\Program Files\Common Files\microsoft shared:dPnp9MlNQYDcpZxQZTKF
@Alternate Data Stream - 1112 bytes -> C:\ProgramData\Microsoft:NzaGOvk0wkmQeym5vD2TGDhJ
@Alternate Data Stream - 1029 bytes -> C:\Users\COMPAQ\AppData\Local\CR5yRYpC:poiFEql2NfWr0lcGRq7cXQHsIk2l9
@Alternate Data Stream - 1017 bytes -> C:\ProgramData\Microsoft:HIQ4yKr1jWPIrZjCSilvXubI

< End of report >
Post #3
Hi thedude17,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

The Extras.txt file is only produced the first time you run OTL. You've ran it twice.

OTL logfile created on: 2011/6/2 下午 01:56:45 - Run 2


Double click on OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Processes

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&am…amp;affID=17981
IE - HKLM\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\tbSof2.dll (Conduit Ltd.)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am…amp;affID=17981
[2011/05/06 22:26:28 | 000,002,428 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
[2011/05/06 22:26:27 | 000,000,000 | —D | C] – C:\Program Files\BabylonToolbar
O33 - MountPoints2\{446c1618-ea63-11df-8ff5-c80aa991d6fe}\Shell - "" = AutoRun
O33 - MountPoints2\{446c1618-ea63-11df-8ff5-c80aa991d6fe}\Shell\AutoRun\command - "" = G:\autorun.exe
O33 - MountPoints2\{79532974-f143-11df-af51-c80aa991d6fe}\Shell - "" = AutoRun
O33 - MountPoints2\{79532974-f143-11df-af51-c80aa991d6fe}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{7953299a-f143-11df-af51-c80aa991d6fe}\Shell - "" = AutoRun
O33 - MountPoints2\{7953299a-f143-11df-af51-c80aa991d6fe}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found
O4 - HKLM..\RunOnceEx: [Title] File not found

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL log.
Post #4
Hi Tomk Thanks so much for your help. I ran otl the first time, but not as administrator so i ran it again. Anyway, i followed your instructions. When I ran otl, my avast quarantined the otl.exe file as malware???? so i restored it to do the scan by deactivating avast. then I ran the scan and the only things that appeared after the reboot were the following two files ALSO: I'm sorry, but I will be away until Monday so I won't be able to respond to any posts until then. Thanks for your understanding and help. both File names: desktop.ini [LocalizedFileNames] Norton Internet Security.lnk=@C:\PROGRA~1\NORTON~2\Branding\muis.dll,-102 [.ShellClassInfo] LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769 IconResource=%SystemRoot%\system32\imageres.dll,-183 There was no new scan log??? As I said I am away until Monday, but please don't think I am ignoring you! Thanks
Post #5
thedude17,

Remember to run this tool as Administrator.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #6
Hi Tomk Thanks for your patience I tried to run OTL as admin again, but didn't give me a log. So, I downloaded combofix - here's the log ComboFix 11-06-05.06 - COMPAQ 1/06/06 週一 13:16:51.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.[removed].18.2043.1050 [GMT 8:00] 執行位置: c:\users\COMPAQ\Downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb c:\windows\system32\1.txt . . ((((((((((((((((((((((((( 2011-05-06 至 2011-06-06 的新的檔案 ))))))))))))))))))))))))))))))) . . 2011-06-06 05:25 . 2011-06-06 05:25 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-06-03 23:11 . 2011-06-03 23:11 ——– d—–w- C:\_OTL 2011-06-03 11:30 . 2011-05-09 20:46 6962000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CBD6EB01-2B55-4256-8EC0-85474BC5B057}\mpengine.dll 2011-06-03 05:12 . 2011-06-03 05:12 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-06-02 14:07 . 2011-06-02 14:07 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\SUPERAntiSpyware.com 2011-06-02 14:07 . 2011-06-02 14:07 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2011-06-02 14:07 . 2011-06-02 14:08 ——– d—–w- c:\program files\SUPERAntiSpyware 2011-06-02 14:01 . 2011-06-02 14:01 ——– d—–w- c:\users\COMPAQ\AppData\Local\Conduit 2011-06-02 13:40 . 2011-05-04 03:36 27192 —-a-w- c:\windows\system32\drivers\rspSanity32.sys 2011-06-02 13:40 . 2011-06-02 13:40 ——– d—–w- c:\program files\SanityCheck 2011-06-02 13:31 . 2011-06-02 13:31 ——– d—–w- c:\windows\system32\SPReview 2011-06-02 13:30 . 2011-06-02 13:30 ——– d—–w- c:\windows\system32\EventProviders 2011-06-02 05:05 . 2011-06-02 05:05 ——– d—–w- C:\2011-06-02-COMPAQ-PC 2011-06-02 04:53 . 2011-06-06 05:09 24416 —-a-w- c:\windows\system32\drivers\regguard.sys 2011-06-02 04:43 . 2011-06-02 04:43 39192 —-a-w- c:\windows\system32\Partizan.exe 2011-06-02 04:43 . 2011-06-02 04:43 35816 —-a-w- c:\windows\system32\drivers\Partizan.sys 2011-06-02 04:42 . 2011-06-02 04:42 2 –shatr- c:\windows\winstart.bat 2011-06-02 04:42 . 2011-05-18 02:53 12808 —-a-w- c:\windows\system32\drivers\UnHackMeDrv.sys 2011-06-02 04:42 . 2011-06-06 05:07 ——– d—–w- c:\program files\UnHackMe 2011-06-01 23:09 . 2006-11-01 05:07 334720 —-a-w- c:\program files\RootkitRevealer.exe 2011-06-01 21:53 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\system32\dfshim.dll 2011-06-01 21:53 . 2010-11-20 12:19 53760 —-a-w- c:\windows\system32\LSCSHostPolicy.dll 2011-06-01 21:53 . 2010-11-20 10:24 52224 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys 2011-06-01 21:53 . 2010-11-20 12:21 11776 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2011-06-01 21:53 . 2010-11-20 12:19 3215872 —-a-w- c:\windows\system32\mstscax.dll 2011-06-01 21:51 . 2010-11-20 12:21 444928 —-a-w- c:\windows\system32\wvc.dll 2011-06-01 21:50 . 2010-11-20 12:21 351232 —-a-w- c:\windows\system32\wmicmiplugin.dll 2011-06-01 21:50 . 2010-11-20 12:21 780288 —-a-w- c:\windows\system32\wbem\wbemcore.dll 2011-06-01 21:50 . 2010-11-20 12:21 363008 —-a-w- c:\windows\system32\wbemcomn.dll 2011-06-01 21:50 . 2010-11-20 12:19 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll 2011-06-01 21:50 . 2010-11-20 12:21 697344 —-a-w- c:\windows\system32\SmiEngine.dll 2011-06-01 21:50 . 2010-11-20 12:21 189952 —-a-w- c:\windows\system32\wdscore.dll 2011-06-01 21:50 . 2010-11-20 12:17 209920 —-a-w- c:\windows\system32\PkgMgr.exe 2011-06-01 21:49 . 2010-11-20 12:18 323072 —-a-w- c:\windows\system32\drvstore.dll 2011-06-01 21:49 . 2010-11-20 12:18 257024 —-a-w- c:\windows\system32\dpx.dll 2011-06-01 15:54 . 2010-12-07 10:05 2486352 —-a-w- C:\RootkitBuster.exe 2011-05-25 04:51 . 2011-04-22 19:14 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2011-05-23 12:06 . 2011-04-09 05:56 123904 —-a-w- c:\windows\system32\poqexec.exe 2011-05-21 10:02 . 2011-05-21 10:02 ——– d—–w- c:\program files\Kreatives.org 2011-05-21 09:11 . 2011-05-21 09:17 ——– d—–w- c:\program files\Audacity 1.3 Beta (Unicode) 2011-05-21 08:51 . 2006-11-26 06:21 3683520 —-a-w- c:\program files\KRISTAL_AE_Setup.exe 2011-05-21 05:50 . 2011-05-21 05:50 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\Antares 2011-05-21 05:50 . 2011-05-21 05:50 ——– d—–w- c:\program files\Antares Audio Technologies 2011-05-21 05:19 . 2011-05-21 05:20 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:20 ——– d—–w- c:\programdata\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:19 ——– d—–w- c:\users\COMPAQ\AppData\Local\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:19 ——– d—–w- c:\program files\Common Files\PACE Anti-Piracy 2011-05-21 05:17 . 2011-05-21 05:17 ——– d—–w- c:\program files\InterLok 2011-05-21 01:51 . 2011-05-21 01:51 ——– d—–w- c:\program files\Common Files\xing shared 2011-05-11 15:01 . 2011-04-09 06:02 3967872 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-05-11 15:01 . 2011-04-09 06:02 3912576 —-a-w- c:\windows\system32\ntoskrnl.exe . . . (((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-02 13:40 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-05-29 01:11 . 2010-07-01 14:05 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 01:11 . 2010-07-01 14:05 22712 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-05-21 01:51 . 2004-01-11 22:00 348160 —-a-w- c:\windows\system32\msvcr71.dll 2011-05-21 01:51 . 2003-03-19 03:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2011-05-10 12:10 . 2010-06-30 03:58 40112 —-a-w- c:\windows\avastSS.scr 2011-05-10 12:10 . 2010-06-30 03:58 199304 —-a-w- c:\windows\system32\aswBoot.exe 2011-05-10 12:03 . 2011-02-24 23:49 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2011-05-10 12:03 . 2010-06-30 03:58 307928 —-a-w- c:\windows\system32\drivers\aswSP.sys 2011-05-10 12:02 . 2010-06-30 03:58 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2011-05-10 11:59 . 2010-06-30 03:58 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys 2011-05-10 11:59 . 2010-06-30 03:58 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-05-10 11:59 . 2010-06-30 03:58 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-03-12 11:23 . 2011-04-27 08:04 870912 —-a-w- c:\windows\system32\XpsPrint.dll 2011-03-11 05:39 . 2011-04-27 08:04 148864 —-a-w- c:\windows\system32\drivers\storport.sys 2011-03-11 05:39 . 2011-04-27 08:04 143744 —-a-w- c:\windows\system32\drivers\nvstor.sys 2011-03-11 05:39 . 2011-04-27 08:04 1211264 —-a-w- c:\windows\system32\drivers\ntfs.sys 2011-03-11 05:39 . 2011-04-27 08:04 117120 —-a-w- c:\windows\system32\drivers\nvraid.sys 2011-03-11 05:38 . 2011-04-27 08:04 332160 —-a-w- c:\windows\system32\drivers\iaStorV.sys 2011-03-11 05:33 . 2011-04-27 08:04 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-03-11 05:33 . 2011-04-27 08:04 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-03-11 05:33 . 2011-04-27 08:04 1699328 —-a-w- c:\windows\system32\esent.dll 2011-03-11 05:31 . 2011-04-27 08:04 74240 —-a-w- c:\windows\system32\fsutil.exe 2011-03-08 05:28 . 2011-04-27 08:04 741376 —-a-w- c:\windows\system32\inetcomm.dll . . ((((((((((((((((((((((((((((((((((((( 重要登入點 )))))))))))))))))))))))))))))))))))))))))))))))))) . . *注意* 空白與合法缺省登錄將不會被顯示 REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2011-05-17 05:29 1490312 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-05-10 12:10 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-31 39408] "Google Update"="c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-06-28 135664] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-23 2424192] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-05-10 3459712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-10-28 126976] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-10 421160] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "Microsoft Pinyin IME Migration"="c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE" [2008-11-03 33128] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-05-21 273544] "ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-05-17 395144] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . c:\users\COMPAQ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Taskman"="" . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan\0 SetupExecute REG_MULTI_SZ \0 . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-31 08:44 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box] 2010-10-28 23:31 126976 —-a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-06-28 00:20 135664 —-atw- c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2008-10-25 03:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Pinyin IME Migration] 2008-11-03 20:24 33128 —-a-w- c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut] 2008-10-13 12:41 50472 ——w- c:\program files\CyberLink\PowerDVD9\Language\Language.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe] 2009-04-23 02:20 206392 —-a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9] 2009-02-16 01:55 87336 ——w- c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2010-03-10 11:16 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 06:49 249064 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2009-10-31 06:17 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp] 2009-07-22 01:33 458844 —-a-w- c:\program files\IDT\WDM\sttray.exe . R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2011-06-02 35816] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google 更新服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 135664] R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-04-23 239160] R3 gupdatem;Google 更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 135664] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 25112] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 rspSanity;rspSanity;c:\windows\system32\DRIVERS\rspSanity32.sys [2011-05-04 27192] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-13 1343400] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-07 436792] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe [2009-03-02 81920] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-10 172032] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-10 5340160] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-10 152064] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712] S3 RegGuard;RegGuard;c:\windows\system32\Drivers\regguard.sys [2011-06-06 24416] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-05-23 167936] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-21 30392] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . ‘計劃任務’ 文件夾 裡的內容 . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-05-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000Core.job - c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000UA.job - c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . . ——- 而外的掃描 ——- . uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=2e67496900000000000078e40070193e&tlver=1.4.19.19&ss=1&affID=17981 uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Google 網頁註解… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: 匯出至 Microsoft Excel(&X) - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: pps.tv Trusted Zone: ppstream.com Trusted Zone: webscache.com TCP: Interfaces\{2F28A50D-0560-49E4-ABB7-A78F5D08AC49}: NameServer = 61.31.233.1,61.31.1.1 . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file) BHO-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) BHO-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file) Toolbar-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file) Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) WebBrowser-{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - (no file) WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file) MSConfigStartUp-COMODO Internet Security - c:\program files\COMODO\COMODO Internet Security\cfp.exe MSConfigStartUp-nod32kui - c:\program files\Eset\nod32kui.exe MSConfigStartUp-PPS Accelerator - c:\program files\PPStream\ppsap.exe MSConfigStartUp-SynTPEnh - c:\program files\Synaptics\SynTP\SynTPEnh.exe AddRemove-BabylonToolbar - c:\program files\BabylonToolbar\BabylonToolbar\1.4.19.19\uninstall.exe AddRemove-LADSPA_plugins-win_is1 - c:\program files\Audacity 1.3 Beta (Unicode)\Plug-Ins\Plug-Ins\unins000.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities] "ApplicationName"="Google 瀏覽器" "ApplicationIcon"="c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe,0" "ApplicationDescription"="「Google 瀏覽器」開啟網頁和執行應用程式的速度奇快無比！除了執行速度快、穩定且容易使用之外，它還內建防護機制，讓您安心瀏覽網頁，無需擔心受到網路釣魚與惡意軟體的威脅。" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\FileAssociations] ".xhtml"="ChromeHTML" ".xht"="ChromeHTML" ".shtml"="ChromeHTML" ".html"="ChromeHTML" ".htm"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\StartMenu] "StartMenuInternet"="Google 瀏覽器" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\URLAssociations] "https"="ChromeHTML" "http"="ChromeHTML" "ftp"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\DefaultIcon] @="c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe,0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\InstallInfo] "IconsVisible"=dword:00000001 "ShowIconsCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –show-icons" "HideIconsCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –hide-icons" "ReinstallCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –make-default-browser" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\shell\open\command] @="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\"" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsDriver] "printBinNames"=multi:"預設紙匣\00\00" "printColor"=hex:01 "printMaxXExtent"=dword:00000076 "printMaxYExtent"=dword:00000000 "printMinXExtent"=dword:00000076 "printMinYExtent"=dword:00000000 "printMediaSupported"=multi:"Letter\00Tabloid\00Legal\00A3\00A4\00A5\00B4 (JIS)\00B5 (JIS)\00Japanese Postcard\00自訂大小\00\00" "printMediaReady"=multi:"\00\00" "printOrientationsSupported"=multi:"PORTRAIT\00\00" "printMaxResolutionSupported"=dword:0000012c "printLanguage"=multi:"\00\00" "printRateUnit"="" "driverVersion"=dword:00000401 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsSpooler] "driverName"="Send To Microsoft OneNote Driver" "portName"=multi:"Send To Microsoft OneNote Port:\00\00" "printStartTime"=dword:00000000 "printEndTime"=dword:00000000 "printerName"="傳送至 OneNote 2007" "printKeepPrintedJobs"=hex:00 "printSpooling"="PrintWhileSpooling" "priority"=dword:00000001 "uNCName"="\\\\COMPAQ-PC\\傳送至 OneNote 2007" "serverName"="COMPAQ-PC" "shortServerName"="COMPAQ-PC" "versionNumber"=dword:00000004 "flags"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . 完成時間: 2011-06-06 13:29:04 ComboFix-quarantined-files.txt 2011-06-06 05:29 . Pre-Run: 6,723,379,200 bytes free Post-Run: 6,808,518,656 bytes free . - - End Of File - - 841DCEBD86490A71B3E2EFD59A296B46
Post #7
thedude17,

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    DDS::
uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=2e67496900000000000078e40070193e&tlver=1.4.19.19&ss=1&affID=17981

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities]
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\FileAssociations]
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\StartMenu]
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\URLAssociations][HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\DefaultIcon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\InstallInfo]
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\shell\open\command]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsDriver]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsSpooler]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #8
Here's the log ComboFix 11-06-06.02 - COMPAQ 1/06/07 週二 8:01.2.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.[removed].18.2043.947 [GMT 8:00] 執行位置: c:\users\COMPAQ\Desktop\ComboFix.exe Command switches used :: c:\users\COMPAQ\Desktop\CFScript.txt AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( 2011-05-07 至 2011-06-07 的新的檔案 ))))))))))))))))))))))))))))))) . . 2011-06-07 00:08 . 2011-06-07 00:08 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-06-03 23:11 . 2011-06-03 23:11 ——– d—–w- C:\_OTL 2011-06-03 11:30 . 2011-05-09 20:46 6962000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CBD6EB01-2B55-4256-8EC0-85474BC5B057}\mpengine.dll 2011-06-03 05:12 . 2011-06-03 05:12 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-06-02 14:07 . 2011-06-02 14:07 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\SUPERAntiSpyware.com 2011-06-02 14:07 . 2011-06-02 14:07 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2011-06-02 14:07 . 2011-06-02 14:08 ——– d—–w- c:\program files\SUPERAntiSpyware 2011-06-02 14:01 . 2011-06-02 14:01 ——– d—–w- c:\users\COMPAQ\AppData\Local\Conduit 2011-06-02 13:40 . 2011-05-04 03:36 27192 —-a-w- c:\windows\system32\drivers\rspSanity32.sys 2011-06-02 13:40 . 2011-06-02 13:40 ——– d—–w- c:\program files\SanityCheck 2011-06-02 13:31 . 2011-06-02 13:31 ——– d—–w- c:\windows\system32\SPReview 2011-06-02 13:30 . 2011-06-02 13:30 ——– d—–w- c:\windows\system32\EventProviders 2011-06-02 05:05 . 2011-06-02 05:05 ——– d—–w- C:\2011-06-02-COMPAQ-PC 2011-06-02 04:53 . 2011-06-06 23:23 24416 —-a-w- c:\windows\system32\drivers\regguard.sys 2011-06-02 04:43 . 2011-06-02 04:43 39192 —-a-w- c:\windows\system32\Partizan.exe 2011-06-02 04:43 . 2011-06-02 04:43 35816 —-a-w- c:\windows\system32\drivers\Partizan.sys 2011-06-02 04:42 . 2011-06-02 04:42 2 –shatr- c:\windows\winstart.bat 2011-06-02 04:42 . 2011-05-18 02:53 12808 —-a-w- c:\windows\system32\drivers\UnHackMeDrv.sys 2011-06-02 04:42 . 2011-06-06 23:15 ——– d—–w- c:\program files\UnHackMe 2011-06-01 23:09 . 2006-11-01 05:07 334720 —-a-w- c:\program files\RootkitRevealer.exe 2011-06-01 21:53 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\system32\dfshim.dll 2011-06-01 21:53 . 2010-11-20 12:19 53760 —-a-w- c:\windows\system32\LSCSHostPolicy.dll 2011-06-01 21:53 . 2010-11-20 10:24 52224 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys 2011-06-01 21:53 . 2010-11-20 12:21 11776 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2011-06-01 21:53 . 2010-11-20 12:19 3215872 —-a-w- c:\windows\system32\mstscax.dll 2011-06-01 21:51 . 2010-11-20 12:21 444928 —-a-w- c:\windows\system32\wvc.dll 2011-06-01 21:50 . 2010-11-20 12:21 351232 —-a-w- c:\windows\system32\wmicmiplugin.dll 2011-06-01 21:50 . 2010-11-20 12:21 780288 —-a-w- c:\windows\system32\wbem\wbemcore.dll 2011-06-01 21:50 . 2010-11-20 12:21 363008 —-a-w- c:\windows\system32\wbemcomn.dll 2011-06-01 21:50 . 2010-11-20 12:19 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll 2011-06-01 21:50 . 2010-11-20 12:21 697344 —-a-w- c:\windows\system32\SmiEngine.dll 2011-06-01 21:50 . 2010-11-20 12:21 189952 —-a-w- c:\windows\system32\wdscore.dll 2011-06-01 21:50 . 2010-11-20 12:17 209920 —-a-w- c:\windows\system32\PkgMgr.exe 2011-06-01 21:49 . 2010-11-20 12:18 323072 —-a-w- c:\windows\system32\drvstore.dll 2011-06-01 21:49 . 2010-11-20 12:18 257024 —-a-w- c:\windows\system32\dpx.dll 2011-06-01 15:54 . 2010-12-07 10:05 2486352 —-a-w- C:\RootkitBuster.exe 2011-05-25 04:51 . 2011-04-22 19:14 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2011-05-23 12:06 . 2011-04-09 05:56 123904 —-a-w- c:\windows\system32\poqexec.exe 2011-05-21 10:02 . 2011-05-21 10:02 ——– d—–w- c:\program files\Kreatives.org 2011-05-21 09:11 . 2011-05-21 09:17 ——– d—–w- c:\program files\Audacity 1.3 Beta (Unicode) 2011-05-21 08:51 . 2006-11-26 06:21 3683520 —-a-w- c:\program files\KRISTAL_AE_Setup.exe 2011-05-21 05:50 . 2011-05-21 05:50 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\Antares 2011-05-21 05:50 . 2011-05-21 05:50 ——– d—–w- c:\program files\Antares Audio Technologies 2011-05-21 05:19 . 2011-05-21 05:20 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:20 ——– d—–w- c:\programdata\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:19 ——– d—–w- c:\users\COMPAQ\AppData\Local\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:19 ——– d—–w- c:\program files\Common Files\PACE Anti-Piracy 2011-05-21 05:17 . 2011-05-21 05:17 ——– d—–w- c:\program files\InterLok 2011-05-21 01:51 . 2011-05-21 01:51 ——– d—–w- c:\program files\Common Files\xing shared 2011-05-11 15:01 . 2011-04-09 06:02 3967872 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-05-11 15:01 . 2011-04-09 06:02 3912576 —-a-w- c:\windows\system32\ntoskrnl.exe . . . (((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-02 13:40 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-05-29 01:11 . 2010-07-01 14:05 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 01:11 . 2010-07-01 14:05 22712 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-05-21 01:51 . 2004-01-11 22:00 348160 —-a-w- c:\windows\system32\msvcr71.dll 2011-05-21 01:51 . 2003-03-19 03:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2011-05-10 12:10 . 2010-06-30 03:58 40112 —-a-w- c:\windows\avastSS.scr 2011-05-10 12:10 . 2010-06-30 03:58 199304 —-a-w- c:\windows\system32\aswBoot.exe 2011-05-10 12:03 . 2011-02-24 23:49 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2011-05-10 12:03 . 2010-06-30 03:58 307928 —-a-w- c:\windows\system32\drivers\aswSP.sys 2011-05-10 12:02 . 2010-06-30 03:58 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2011-05-10 11:59 . 2010-06-30 03:58 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys 2011-05-10 11:59 . 2010-06-30 03:58 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-05-10 11:59 . 2010-06-30 03:58 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-03-12 11:23 . 2011-04-27 08:04 870912 —-a-w- c:\windows\system32\XpsPrint.dll 2011-03-11 05:39 . 2011-04-27 08:04 148864 —-a-w- c:\windows\system32\drivers\storport.sys 2011-03-11 05:39 . 2011-04-27 08:04 143744 —-a-w- c:\windows\system32\drivers\nvstor.sys 2011-03-11 05:39 . 2011-04-27 08:04 1211264 —-a-w- c:\windows\system32\drivers\ntfs.sys 2011-03-11 05:39 . 2011-04-27 08:04 117120 —-a-w- c:\windows\system32\drivers\nvraid.sys 2011-03-11 05:38 . 2011-04-27 08:04 332160 —-a-w- c:\windows\system32\drivers\iaStorV.sys 2011-03-11 05:33 . 2011-04-27 08:04 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-03-11 05:33 . 2011-04-27 08:04 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-03-11 05:33 . 2011-04-27 08:04 1699328 —-a-w- c:\windows\system32\esent.dll 2011-03-11 05:31 . 2011-04-27 08:04 74240 —-a-w- c:\windows\system32\fsutil.exe . . ((((((((((((((((((((((((((((((((((((( 重要登入點 )))))))))))))))))))))))))))))))))))))))))))))))))) . . *注意* 空白與合法缺省登錄將不會被顯示 REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2011-05-17 05:29 1490312 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-05-10 12:10 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-31 39408] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-23 2424192] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-10-28 126976] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-10 421160] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "Microsoft Pinyin IME Migration"="c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE" [2008-11-03 33128] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-05-21 273544] "ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-05-17 395144] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . c:\users\COMPAQ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-31 08:44 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box] 2010-10-28 23:31 126976 —-a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-06-28 00:20 135664 —-atw- c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2008-10-25 03:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Pinyin IME Migration] 2008-11-03 20:24 33128 —-a-w- c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut] 2008-10-13 12:41 50472 ——w- c:\program files\CyberLink\PowerDVD9\Language\Language.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe] 2009-04-23 02:20 206392 —-a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9] 2009-02-16 01:55 87336 ——w- c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2010-03-10 11:16 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 06:49 249064 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2009-10-31 06:17 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp] 2009-07-22 01:33 458844 —-a-w- c:\program files\IDT\WDM\sttray.exe . R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2011-06-02 35816] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google 更新服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 135664] R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-04-23 239160] R3 gupdatem;Google 更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 135664] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 25112] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 RegGuard;RegGuard;c:\windows\system32\Drivers\regguard.sys [2011-06-06 24416] R3 rspSanity;rspSanity;c:\windows\system32\DRIVERS\rspSanity32.sys [2011-05-04 27192] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-13 1343400] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-07 436792] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe [2009-03-02 81920] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-10 172032] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-10 5340160] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-10 152064] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-05-23 167936] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-21 30392] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . ‘計劃任務’ 文件夾 裡的內容 . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000Core.job - c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000UA.job - c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . . ——- 而外的掃描 ——- . uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Google 網頁註解… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: 匯出至 Microsoft Excel(&X) - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: pps.tv Trusted Zone: ppstream.com Trusted Zone: webscache.com TCP: Interfaces\{2F28A50D-0560-49E4-ABB7-A78F5D08AC49}: NameServer = 61.31.233.1,61.31.1.1 . - - - - ORPHANS REMOVED - - - - . BHO-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) BHO-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities] "ApplicationName"="Google 瀏覽器" "ApplicationIcon"="c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe,0" "ApplicationDescription"="「Google 瀏覽器」開啟網頁和執行應用程式的速度奇快無比！除了執行速度快、穩定且容易使用之外，它還內建防護機制，讓您安心瀏覽網頁，無需擔心受到網路釣魚與惡意軟體的威脅。" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\FileAssociations] ".xhtml"="ChromeHTML" ".xht"="ChromeHTML" ".shtml"="ChromeHTML" ".html"="ChromeHTML" ".htm"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\StartMenu] "StartMenuInternet"="Google 瀏覽器" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\URLAssociations] "https"="ChromeHTML" "http"="ChromeHTML" "ftp"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\DefaultIcon] @="c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe,0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\InstallInfo] "IconsVisible"=dword:00000001 "ShowIconsCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –show-icons" "HideIconsCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –hide-icons" "ReinstallCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –make-default-browser" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\shell\open\command] @="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\"" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsDriver] "printBinNames"=multi:"預設紙匣\00\00" "printColor"=hex:01 "printMaxXExtent"=dword:00000076 "printMaxYExtent"=dword:00000000 "printMinXExtent"=dword:00000076 "printMinYExtent"=dword:00000000 "printMediaSupported"=multi:"Letter\00Tabloid\00Legal\00A3\00A4\00A5\00B4 (JIS)\00B5 (JIS)\00Japanese Postcard\00自訂大小\00\00" "printMediaReady"=multi:"\00\00" "printOrientationsSupported"=multi:"PORTRAIT\00\00" "printMaxResolutionSupported"=dword:0000012c "printLanguage"=multi:"\00\00" "printRateUnit"="" "driverVersion"=dword:00000401 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsSpooler] "driverName"="Send To Microsoft OneNote Driver" "portName"=multi:"Send To Microsoft OneNote Port:\00\00" "printStartTime"=dword:00000000 "printEndTime"=dword:00000000 "printerName"="傳送至 OneNote 2007" "printKeepPrintedJobs"=hex:00 "printSpooling"="PrintWhileSpooling" "priority"=dword:00000001 "uNCName"="\\\\COMPAQ-PC\\傳送至 OneNote 2007" "serverName"="COMPAQ-PC" "shortServerName"="COMPAQ-PC" "versionNumber"=dword:00000004 "flags"=dword:00000000 . 完成時間: 2011-06-07 08:11:35 ComboFix-quarantined-files.txt 2011-06-07 00:11 ComboFix2.txt 2011-06-06 05:29 . Pre-Run: 6,714,421,248 bytes free Post-Run: 6,526,623,744 bytes free . - - End Of File - - 27FCBDDB0E4DE1380A541C8989339101
Post #9
ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #10
Hi Tomk I ran the scan. I did not clean the 1 file that it found as you instructed not to. Here is the log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6522 # api_version=3.0.2 # EOSSerial=0236bb72122e03489d47842cf9ecc309 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-06-07 02:47:57 # local_time=2011-06-07 10:47:57 (+0800, Taipei Standard Time) # country="Taiwan" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=768 16777215 100 0 28746680 28746680 0 0 # compatibility_mode=5893 16776574 100 94 351567 59083396 0 0 # compatibility_mode=8192 67108863 100 0 374 374 0 0 # scanned=237528 # found=1 # cleaned=0 # scan_time=5871 C:\Windows\Installer\763830b.msi a variant of Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I
Post #11
thedude17,

How are things running now?

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\Windows\Installer\763830b.msi
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #12
Hi Tomk My computer was never freezing or anything, just doing a few weird things, like changing the default browser homepage. I was worried because of the security problems associated with rootkits and because my antivirus gave the alert for a rootkit. My computer is running a little slow, but i am running a few programs on it, so i thought that was the reason. Anyway, I'm still a little worried that we didn't delete or quarantine the file that eset search picked up as infected. Is that okay? Here's the log ComboFix 11-06-06.07 - COMPAQ 1/06/08 週三 7:20.3.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.[removed].18.2043.1104 [GMT 8:00] 執行位置: c:\users\COMPAQ\Desktop\ComboFix.exe Command switches used :: c:\users\COMPAQ\Desktop\CFScript1.txt AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\Installer\763830b.msi" . . ((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\Installer\763830b.msi . . ((((((((((((((((((((((((( 2011-05-07 至 2011-06-07 的新的檔案 ))))))))))))))))))))))))))))))) . . 2011-06-07 23:27 . 2011-06-07 23:27 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-06-07 12:59 . 2011-06-07 12:59 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\HPAppData 2011-06-03 23:11 . 2011-06-03 23:11 ——– d—–w- C:\_OTL 2011-06-03 11:30 . 2011-05-09 20:46 6962000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CBD6EB01-2B55-4256-8EC0-85474BC5B057}\mpengine.dll 2011-06-03 05:12 . 2011-06-03 05:12 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-06-02 14:07 . 2011-06-02 14:07 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\SUPERAntiSpyware.com 2011-06-02 14:07 . 2011-06-02 14:07 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2011-06-02 14:07 . 2011-06-02 14:08 ——– d—–w- c:\program files\SUPERAntiSpyware 2011-06-02 14:01 . 2011-06-02 14:01 ——– d—–w- c:\users\COMPAQ\AppData\Local\Conduit 2011-06-02 13:40 . 2011-05-04 03:36 27192 —-a-w- c:\windows\system32\drivers\rspSanity32.sys 2011-06-02 13:40 . 2011-06-02 13:40 ——– d—–w- c:\program files\SanityCheck 2011-06-02 13:31 . 2011-06-02 13:31 ——– d—–w- c:\windows\system32\SPReview 2011-06-02 13:30 . 2011-06-02 13:30 ——– d—–w- c:\windows\system32\EventProviders 2011-06-02 05:05 . 2011-06-02 05:05 ——– d—–w- C:\2011-06-02-COMPAQ-PC 2011-06-02 04:53 . 2011-06-07 12:52 24416 —-a-w- c:\windows\system32\drivers\regguard.sys 2011-06-02 04:43 . 2011-06-02 04:43 39192 —-a-w- c:\windows\system32\Partizan.exe 2011-06-02 04:43 . 2011-06-02 04:43 35816 —-a-w- c:\windows\system32\drivers\Partizan.sys 2011-06-02 04:42 . 2011-06-02 04:42 2 –shatr- c:\windows\winstart.bat 2011-06-02 04:42 . 2011-05-18 02:53 12808 —-a-w- c:\windows\system32\drivers\UnHackMeDrv.sys 2011-06-02 04:42 . 2011-06-06 23:15 ——– d—–w- c:\program files\UnHackMe 2011-06-01 23:09 . 2006-11-01 05:07 334720 —-a-w- c:\program files\RootkitRevealer.exe 2011-06-01 21:53 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\system32\dfshim.dll 2011-06-01 21:53 . 2010-11-20 12:19 53760 —-a-w- c:\windows\system32\LSCSHostPolicy.dll 2011-06-01 21:53 . 2010-11-20 10:24 52224 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys 2011-06-01 21:53 . 2010-11-20 12:21 11776 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2011-06-01 21:53 . 2010-11-20 12:19 3215872 —-a-w- c:\windows\system32\mstscax.dll 2011-06-01 21:51 . 2010-11-20 12:21 444928 —-a-w- c:\windows\system32\wvc.dll 2011-06-01 21:50 . 2010-11-20 12:21 351232 —-a-w- c:\windows\system32\wmicmiplugin.dll 2011-06-01 21:50 . 2010-11-20 12:21 780288 —-a-w- c:\windows\system32\wbem\wbemcore.dll 2011-06-01 21:50 . 2010-11-20 12:21 363008 —-a-w- c:\windows\system32\wbemcomn.dll 2011-06-01 21:50 . 2010-11-20 12:19 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll 2011-06-01 21:50 . 2010-11-20 12:21 697344 —-a-w- c:\windows\system32\SmiEngine.dll 2011-06-01 21:50 . 2010-11-20 12:21 189952 —-a-w- c:\windows\system32\wdscore.dll 2011-06-01 21:50 . 2010-11-20 12:17 209920 —-a-w- c:\windows\system32\PkgMgr.exe 2011-06-01 21:49 . 2010-11-20 12:18 323072 —-a-w- c:\windows\system32\drvstore.dll 2011-06-01 21:49 . 2010-11-20 12:18 257024 —-a-w- c:\windows\system32\dpx.dll 2011-06-01 15:54 . 2010-12-07 10:05 2486352 —-a-w- C:\RootkitBuster.exe 2011-05-25 04:51 . 2011-04-22 19:14 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2011-05-23 12:06 . 2011-04-09 05:56 123904 —-a-w- c:\windows\system32\poqexec.exe 2011-05-21 10:02 . 2011-05-21 10:02 ——– d—–w- c:\program files\Kreatives.org 2011-05-21 09:11 . 2011-05-21 09:17 ——– d—–w- c:\program files\Audacity 1.3 Beta (Unicode) 2011-05-21 08:51 . 2006-11-26 06:21 3683520 —-a-w- c:\program files\KRISTAL_AE_Setup.exe 2011-05-21 05:50 . 2011-05-21 05:50 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\Antares 2011-05-21 05:50 . 2011-05-21 05:50 ——– d—–w- c:\program files\Antares Audio Technologies 2011-05-21 05:19 . 2011-05-21 05:20 ——– d—–w- c:\users\COMPAQ\AppData\Roaming\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:20 ——– d—–w- c:\programdata\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:19 ——– d—–w- c:\users\COMPAQ\AppData\Local\PACE Anti-Piracy 2011-05-21 05:19 . 2011-05-21 05:19 ——– d—–w- c:\program files\Common Files\PACE Anti-Piracy 2011-05-21 05:17 . 2011-05-21 05:17 ——– d—–w- c:\program files\InterLok 2011-05-21 01:51 . 2011-05-21 01:51 ——– d—–w- c:\program files\Common Files\xing shared 2011-05-11 15:01 . 2011-04-09 06:02 3967872 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-05-11 15:01 . 2011-04-09 06:02 3912576 —-a-w- c:\windows\system32\ntoskrnl.exe . . . (((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-02 13:40 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-05-29 01:11 . 2010-07-01 14:05 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 01:11 . 2010-07-01 14:05 22712 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-05-21 01:51 . 2004-01-11 22:00 348160 —-a-w- c:\windows\system32\msvcr71.dll 2011-05-21 01:51 . 2003-03-19 03:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2011-05-10 12:10 . 2010-06-30 03:58 40112 —-a-w- c:\windows\avastSS.scr 2011-05-10 12:10 . 2010-06-30 03:58 199304 —-a-w- c:\windows\system32\aswBoot.exe 2011-05-10 12:03 . 2011-02-24 23:49 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2011-05-10 12:03 . 2010-06-30 03:58 307928 —-a-w- c:\windows\system32\drivers\aswSP.sys 2011-05-10 12:02 . 2010-06-30 03:58 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2011-05-10 11:59 . 2010-06-30 03:58 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys 2011-05-10 11:59 . 2010-06-30 03:58 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-05-10 11:59 . 2010-06-30 03:58 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-03-12 11:23 . 2011-04-27 08:04 870912 —-a-w- c:\windows\system32\XpsPrint.dll 2011-03-11 05:39 . 2011-04-27 08:04 148864 —-a-w- c:\windows\system32\drivers\storport.sys 2011-03-11 05:39 . 2011-04-27 08:04 143744 —-a-w- c:\windows\system32\drivers\nvstor.sys 2011-03-11 05:39 . 2011-04-27 08:04 1211264 —-a-w- c:\windows\system32\drivers\ntfs.sys 2011-03-11 05:39 . 2011-04-27 08:04 117120 —-a-w- c:\windows\system32\drivers\nvraid.sys 2011-03-11 05:38 . 2011-04-27 08:04 332160 —-a-w- c:\windows\system32\drivers\iaStorV.sys 2011-03-11 05:33 . 2011-04-27 08:04 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-03-11 05:33 . 2011-04-27 08:04 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-03-11 05:33 . 2011-04-27 08:04 1699328 —-a-w- c:\windows\system32\esent.dll 2011-03-11 05:31 . 2011-04-27 08:04 74240 —-a-w- c:\windows\system32\fsutil.exe . . ((((((((((((((((((((((((((((((((((((( 重要登入點 )))))))))))))))))))))))))))))))))))))))))))))))))) . . *注意* 空白與合法缺省登錄將不會被顯示 REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2011-05-17 05:29 1490312 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-05-10 12:10 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-31 39408] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-23 2424192] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576] "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-10-28 126976] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-10 421160] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "Microsoft Pinyin IME Migration"="c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE" [2008-11-03 33128] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-05-21 273544] "ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-05-17 395144] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . c:\users\COMPAQ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-31 08:44 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box] 2010-10-28 23:31 126976 —-a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-06-28 00:20 135664 —-atw- c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2008-10-25 03:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Pinyin IME Migration] 2008-11-03 20:24 33128 —-a-w- c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut] 2008-10-13 12:41 50472 ——w- c:\program files\CyberLink\PowerDVD9\Language\Language.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe] 2009-04-23 02:20 206392 —-a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9] 2009-02-16 01:55 87336 ——w- c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2010-03-10 11:16 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 06:49 249064 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2009-10-31 06:17 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp] 2009-07-22 01:33 458844 —-a-w- c:\program files\IDT\WDM\sttray.exe . R0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2011-06-02 35816] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google 更新服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 135664] R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-04-23 239160] R3 gupdatem;Google 更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 135664] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 25112] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 RegGuard;RegGuard;c:\windows\system32\Drivers\regguard.sys [2011-06-07 24416] R3 rspSanity;rspSanity;c:\windows\system32\DRIVERS\rspSanity32.sys [2011-05-04 27192] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-12-13 1343400] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-07 436792] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe [2009-03-02 81920] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-10 172032] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-05-10 53592] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-10 5340160] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-10 152064] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-05-23 167936] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-21 30392] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . ‘計劃任務’ 文件夾 裡的內容 . 2011-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000Core.job - c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . 2011-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2879953726-1340501471-3451190216-1000UA.job - c:\users\COMPAQ\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-28 00:20] . . ——- 而外的掃描 ——- . uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=2e67496900000000000078e40070193e&tlver=1.4.19.19&ss=1&affID=17981 uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Google 網頁註解… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: 匯出至 Microsoft Excel(&X) - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: pps.tv Trusted Zone: ppstream.com Trusted Zone: webscache.com TCP: Interfaces\{2F28A50D-0560-49E4-ABB7-A78F5D08AC49}: NameServer = 61.31.233.1,61.31.1.1 . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities] "ApplicationName"="Google 瀏覽器" "ApplicationIcon"="c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe,0" "ApplicationDescription"="「Google 瀏覽器」開啟網頁和執行應用程式的速度奇快無比！除了執行速度快、穩定且容易使用之外，它還內建防護機制，讓您安心瀏覽網頁，無需擔心受到網路釣魚與惡意軟體的威脅。" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\FileAssociations] ".xhtml"="ChromeHTML" ".xht"="ChromeHTML" ".shtml"="ChromeHTML" ".html"="ChromeHTML" ".htm"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\StartMenu] "StartMenuInternet"="Google 瀏覽器" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\Capabilities\URLAssociations] "https"="ChromeHTML" "http"="ChromeHTML" "ftp"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\DefaultIcon] @="c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe,0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\InstallInfo] "IconsVisible"=dword:00000001 "ShowIconsCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –show-icons" "HideIconsCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –hide-icons" "ReinstallCommand"="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\" –make-default-browser" . [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\G*o*o*g*l*e* *p?hV\shell\open\command] @="\"c:\\Users\\COMPAQ\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\"" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsDriver] "printBinNames"=multi:"預設紙匣\00\00" "printColor"=hex:01 "printMaxXExtent"=dword:00000076 "printMaxYExtent"=dword:00000000 "printMinXExtent"=dword:00000076 "printMinYExtent"=dword:00000000 "printMediaSupported"=multi:"Letter\00Tabloid\00Legal\00A3\00A4\00A5\00B4 (JIS)\00B5 (JIS)\00Japanese Postcard\00自訂大小\00\00" "printMediaReady"=multi:"\00\00" "printOrientationsSupported"=multi:"PORTRAIT\00\00" "printMaxResolutionSupported"=dword:0000012c "printLanguage"=multi:"\00\00" "printRateUnit"="" "driverVersion"=dword:00000401 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\袈?*O*n*e*N*o*t*e* *2*0*0*7*\DsSpooler] "driverName"="Send To Microsoft OneNote Driver" "portName"=multi:"Send To Microsoft OneNote Port:\00\00" "printStartTime"=dword:00000000 "printEndTime"=dword:00000000 "printerName"="傳送至 OneNote 2007" "printKeepPrintedJobs"=hex:00 "printSpooling"="PrintWhileSpooling" "priority"=dword:00000001 "uNCName"="\\\\COMPAQ-PC\\傳送至 OneNote 2007" "serverName"="COMPAQ-PC" "shortServerName"="COMPAQ-PC" "versionNumber"=dword:00000004 "flags"=dword:00000000 . 完成時間: 2011-06-08 07:29:49 ComboFix-quarantined-files.txt 2011-06-07 23:29 ComboFix2.txt 2011-06-07 00:11 ComboFix3.txt 2011-06-06 05:29 . Pre-Run: 6,011,838,464 bytes free Post-Run: 5,969,469,440 bytes free . - - End Of File - - B97FFC6217CBC7ACADCF68E64021FE83
Post #13
thedude17,

Anyway, I'm still a little worried that we didn't delete or quarantine the file that eset search picked up as infected. Is that okay?

We took care of it. It is quarantined and will be purged with final housekeeping.

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

  • Double click on OTL to run it.
  • Click on CleanUp!
  • When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #14
OK, done that. Thanks a lot for the help man! I really appreciate it. Just wanted to know what infections were actually found? Was there a rootkit? I'll read that information. I have read up on all sorts of forums about protection and they all give different advice on firewalls and antivirus programs. It really is hard to make sense of it all. But I'll give it a try. Not sure if you can answer this, but is running a free antivirus program not a good idea? Again, there are always conflicting stories in forum articles. thanks again Cheers
Post #15
Avast must have blocked the rootkit. I'm a proponent of free anti -virus programs. That's what I use. I actually run three different ones on three different systems. Avast!, Avira, and Microsoft security essentials. All are good programs. All we removed was some spyware and redirect entries. You are welcome for the guidance. Good luck and be well. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI