Spyware / Malware / Virus Removal

Please help - possible tdss.serv infection

17 min read

Looking for the outcome? Ask AI

dawooksta Topic Starter

Post #1July 5, 2011, 8:49 AM UTC

Hello

I really need some help with a tricky viris / trojan. I believe my pc is infected with tdss.serv - it will only boot into safe mode now and many files are hidden / missing. That's a pain because all the photo's of our 2 year old daughter are missing (only 2/3rds are backed up!) and my gf is giving me a hard time about it :-). In an effort to get the photo's back I connected the hard drives (2 x 500gb in raid 0) to another machine (with good AV protection). I couldn't access thefiles on the drives but Norton detected tdss.serv infection of the MBR. Both drives are back in the old machine now and I'm using it to post to this forum (from safe mode).

As suggested, I've run OTL, HijackThis and DDS. Here are the logs from the first two. Any help is very appreciated.

OTL logfile created on: 05/07/2011 07:40:38 - Run 2
OTL by OldTimer - Version 3.2.26.0 Folder = C:\Users\Shane\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.41 Gb Available Physical Memory | 70.56% Memory free
2.17 Gb Paging File | 1.72 Gb Available in Paging File | 79.15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931.52 Gb Total Space | 499.10 Gb Free Space | 53.58% Space Free | Partition Type: NTFS
Drive D: | 2.49 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive E: | 931.51 Gb Total Space | 628.76 Gb Free Space | 67.50% Space Free | Partition Type: NTFS
Drive F: | 495.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 483.20 Mb Total Space | 481.79 Mb Free Space | 99.71% Space Free | Partition Type: FAT

Computer Name: SHANE-PC | User Name: Shane | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (TunngleService) – C:\Program Files\Tunngle\TnglCtrl.exe (Tunngle.net GmbH)

========== Driver Services (SafeList) ==========

DRV - (NTIOLib_1_0_8) – C:\Program Files\MSI\MSIWDev\NTIOLib.sys (MSI)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) – C:\Windows\System32\drivers\AtihdLH3.sys (Advanced Micro Devices)
DRV - (MSI_MSIBIOS_010507) – C:\Program Files\MSI\MSIWDev\msibios32_100507.sys (Your Corporation)
DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) – C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net)
DRV - (Point32) – C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50242

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.co.uk"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/04/18 21:45:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/04/18 21:45:10 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]

[2011/02/27 02:46:59 | 000,000,000 | -H-D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions
[2008/07/15 22:13:53 | 000,000,000 | -H-D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/02/27 15:37:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions
[2010/10/23 20:15:49 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/20 14:52:17 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/07 23:44:07 | 000,000,000 | -H-D | M] (New Tab Homepage) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2009/09/24 20:07:37 | 000,000,000 | -H-D | M] (20-20 3D Viewer) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]
[2011/07/04 07:02:49 | 000,000,000 | —D | M] (@@toolbarname@@) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]
[2011/05/12 18:56:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions
[2011/07/04 07:02:49 | 000,000,000 | —D | M] (EPUBReader) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2011/01/31 14:24:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/20 14:51:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/14 19:22:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/26 21:14:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) –
[2011/07/04 07:02:44 | 000,000,000 | —D | M] (Java Console) – C:\PROGRAM FILES\MOZILLA FIREFOX 4.0 BETA 12\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/07/04 07:02:48 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\SHANE\APPDATA\LOCAL\{034E3327-F8AE-440B-B24A-96500EDA13CA}
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\{66E978CD-981F-47DF-AC42-E3CF417C1467}.XPI
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\[removed]
[2011/02/28 01:29:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2010/10/22 19:08:15 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/10/22 19:08:15 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/10/22 19:08:15 | 000,000,769 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/10/22 19:08:15 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

Hosts file not found
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Cdcrtmm] C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll ()
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: com ([www.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnl…CAB/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/11/02 21:00:00 | 000,000,043 | R— | M] () - D:\autorun.inf – [ UDF ]
O32 - AutoRun File - [2008/12/15 10:52:18 | 000,000,080 | —- | M] () - E:\Autorun.inf – [ NTFS ]
O32 - AutoRun File - [2007/07/01 07:22:48 | 000,000,000 | —D | M] - F:\AutoRunSource – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 000,011,478 | R— | M] () - F:\Autorun.ico – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 002,256,896 | R— | M] (Longtion) - F:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:09 | 000,000,047 | R— | M] () - F:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:10 | 000,462,809 | R— | M] () - F:\autorun.tgt – [ CDFS ]
O33 - MountPoints2\{0304ec01-4a9a-11e0-9994-001d9232be54}\Shell - "" = AutoRun
O33 - MountPoints2\{0304ec01-4a9a-11e0-9994-001d9232be54}\Shell\AutoRun\command - "" = F:\autorun.exe – [2007/06/28 19:06:56 | 002,256,896 | R— | M] (Longtion)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3fhg - C:\Windows\System32\mp3fhg.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2011/07/05 07:32:42 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/05 07:31:44 | 000,000,000 | —D | C] – C:\Users\Shane\What the tech
[2011/07/05 06:28:45 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/07/05 06:28:45 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/07/05 06:28:45 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/07/05 06:28:45 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/07/05 06:28:40 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/07/05 06:28:39 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/07/05 06:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2011/07/05 06:28:32 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/07/04 18:00:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2011/07/04 18:00:17 | 000,000,000 | —D | C] – C:\Program Files\Recuva
[2011/07/04 18:00:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/07/02 06:26:41 | 000,000,000 | —D | C] – C:\NBRT

========== Files - Modified Within 30 Days ==========

[2011/07/05 07:34:13 | 000,625,664 | —- | M] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 07:32:42 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:10 | 000,679,678 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/05 07:32:10 | 000,130,040 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/05 07:32:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/05 07:27:41 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/05 07:27:19 | 268,435,456 | -HS- | M] () – C:\Windows\System32\temppf.sys
[2011/07/04 18:00:18 | 000,001,634 | —- | M] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | M] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/26 07:45:56 | 000,256,000 | —- | M] () – C:\Windows\PEV.exe

========== Files Created - No Company Name ==========

[2011/07/05 07:34:13 | 000,625,664 | —- | C] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 06:28:45 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/07/05 06:28:45 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/07/05 06:28:45 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/07/05 06:28:45 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/07/05 06:28:45 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | C] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | C] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/03 22:05:15 | 268,435,456 | -HS- | C] () – C:\Windows\System32\temppf.sys
[2011/06/01 00:41:14 | 000,000,152 | -H– | C] () – C:\ProgramData\~23256848r
[2011/06/01 00:41:14 | 000,000,136 | -H– | C] () – C:\ProgramData\~23256848
[2011/06/01 00:41:02 | 000,000,344 | -H– | C] () – C:\ProgramData\23256848
[2011/05/28 02:14:54 | 000,003,994 | -HS- | C] () – C:\Users\Shane\AppData\Local\s7846w86gi86yo4j3444wfp8hl
[2011/05/28 02:14:54 | 000,003,994 | -HS- | C] () – C:\ProgramData\s7846w86gi86yo4j3444wfp8hl
[2011/05/28 02:12:56 | 000,002,136 | -H– | C] () – C:\Users\Shane\AppData\Roaming\610E.259
[2011/05/28 00:01:21 | 000,000,120 | -H– | C] () – C:\Users\Shane\AppData\Local\Djuja.dat
[2011/05/28 00:01:21 | 000,000,000 | -H– | C] () – C:\Users\Shane\AppData\Local\Vziboqe.bin
[2011/05/27 23:57:06 | 000,011,362 | -HS- | C] () – C:\Users\Shane\AppData\Local\6a5067824fd3almxx8y1pfab70vt7oa2j152
[2011/05/27 23:57:06 | 000,011,362 | -HS- | C] () – C:\ProgramData\6a5067824fd3almxx8y1pfab70vt7oa2j152
[2011/04/19 23:19:22 | 000,175,616 | —- | C] () – C:\Windows\System32\unrar.dll
[2011/04/19 23:19:21 | 000,631,808 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/04/19 23:19:21 | 000,243,200 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/04/19 23:19:21 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2011/04/19 23:19:20 | 000,080,896 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2011/03/15 22:07:21 | 000,000,000 | —- | C] () – C:\Windows\System32\Access.dat
[2011/03/02 20:20:30 | 000,000,223 | —- | C] () – C:\Users\Shane\AppData\Roaming\burnaware.ini
[2011/02/27 22:05:34 | 000,139,128 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2011/02/27 22:05:33 | 000,138,056 | —- | C] () – C:\Users\Shane\AppData\Roaming\PnkBstrK.sys
[2011/02/27 22:04:58 | 000,215,128 | —- | C] () – C:\Windows\System32\PnkBstrB.exe
[2011/02/27 22:04:57 | 000,075,064 | —- | C] () – C:\Windows\System32\PnkBstrA.exe
[2011/02/27 22:04:56 | 002,434,856 | —- | C] () – C:\Windows\System32\pbsvc_bc2.exe
[2011/02/27 09:38:36 | 000,040,960 | —- | C] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/27 02:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/02/27 02:03:00 | 000,001,356 | -H– | C] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/01/26 23:11:58 | 000,023,040 | —- | C] () – C:\Windows\System32\atitmpxx.dll
[2010/12/21 03:27:20 | 000,003,113 | —- | C] () – C:\Windows\System32\atipblag.dat
[2010/12/17 17:00:44 | 000,227,587 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2010/11/28 13:01:35 | 000,000,178 | -H– | C] () – C:\Users\Shane\AppData\Roaming\default.rss
[2010/04/21 01:27:01 | 000,030,498 | -HS- | C] () – C:\Users\Shane\AppData\Local\J50Ev7evclyS4
[2009/08/06 23:55:36 | 001,871,758 | -H– | C] () – C:\Users\Shane\AppData\Roaming\NMM-MetaData.db
[2009/08/04 22:59:28 | 000,000,036 | -H– | C] () – C:\Users\Shane\AppData\Local\housecall.guid.cache
[2008/01/23 21:52:53 | 000,000,134 | -H– | C] () – C:\Users\Shane\AppData\Roaming\AVSDVDPlayer.m3u
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,257,720 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,679,678 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,130,040 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 08:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 08:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin

========== LOP Check ==========

[2009/08/19 20:47:05 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Bioshock
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\BitTyrant
[2011/04/25 20:42:35 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\calibre
[2010/04/04 15:34:03 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Canon
[2011/02/26 18:18:42 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Dropbox
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Facebook
[2008/06/23 19:10:06 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\FrostWire
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\GetRightToGo
[2010/12/16 23:15:40 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\HandBrake
[2008/01/20 14:02:10 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\InterTrust
[2009/06/01 00:21:32 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\IrfanView
[2008/06/26 09:43:53 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Juniper Networks
[2008/04/19 10:59:00 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Leadertech
[2009/08/06 23:55:38 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Nokia
[2010/11/22 20:33:28 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Nokia Multimedia Player
[2011/05/24 19:32:36 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\OpenOffice.org
[2008/06/23 23:35:27 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Opera
[2009/07/22 20:10:43 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\PC Suite
[2011/07/04 07:02:49 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\PhotoScape
[2008/04/05 13:35:31 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\SoundSpectrum
[2011/05/26 02:16:34 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\tixati
[2008/03/02 02:40:15 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\TomTom
[2011/07/04 07:02:49 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Tunngle
[2009/05/24 19:10:12 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Unity
[2010/11/11 21:12:15 | 000,000,000 | -H-D | M] – C:\Users\Shane\AppData\Roaming\Vso
[2011/05/28 02:00:38 | 000,032,598 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/05/27 20:50:09 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{68CE3089-3D62-473A-AB30-5F54F790FC1F}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2006/11/02 10:53:57 | 000,438,840 | RHS- | M] () – C:\bootmgr
[2011/02/27 09:51:22 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/04/21 03:18:57 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2011/05/31 21:54:21 | 2460,680,192 | -HS- | M] () – C:\pagefile.sys
[2011/02/07 20:48:15 | 000,057,074 | —- | M] () – C:\TDSSKiller.2.5.8.0_07.02.2011_19.47.38_log.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 13:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/04/30 20:00:00 | 000,027,136 | —- | M] (CANON INC.) – C:\Windows\system32\spool\prtprocs\w32x86\CNMPD92.DLL
[2007/04/30 20:00:00 | 000,069,632 | —- | M] (CANON INC.) – C:\Windows\system32\spool\prtprocs\w32x86\CNMPP92.DLL
[2006/11/02 13:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/02/27 19:20:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/02/27 19:23:28 | 000,000,286 | -HS- | M] () – C:\Users\Shane\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/07/05 07:32:42 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 19:53:35

< End of report >

HijackThis
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 07:59:51, on 05/07/2011
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\explorer.exe
C:\Users\Shane\Desktop\HiJackThis.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugin-container.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:50242
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Tracker Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Cdcrtmm] rundll32.exe "C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll",smpPadvga eapAuthenticationLite
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnl…CAB/install.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files\Tunngle\TnglCtrl.exe

–
End of file - 5465 bytes

Satchfan

Post #2July 5, 2011, 11:12 AM UTC

Hello dawooksta and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan

Satchfan

Post #3July 5, 2011, 12:35 PM UTC

Hello again dawooksta

NOTE: DO NOT run any programs unless they are requested, especially temporary file cleaners or you could lose all your files/folders.

===================================================

Before we start getting this sorted out there are a couple of things to bring to your attention:

First

The ASK toolbar comes bundled with many third-party applications, is considered as Spyware and comes with vulnerabilities.

See the following links and decide yourself whether or not you want to keep it.:

http://secunia.com/advisories/product/15810/
http://www.benedelman.org/spyware/ask-toolbars/

Next

Proxy settings

Please let me know if you set these:

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50242

Finally

P2P - I see you have P2P software, (FrostWire), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

OK, you have some work to do now

There are some files/folders that need investigated but I’d like to get some more scans first to see exactly what we’re dealing with.

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

===================================================

Run RogueKiller

Note: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

Download RogueKiller to your desktop.
close all running programs
for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
when prompted, type 1 and press Enter
the RKreport.txt will be generated next to the executable, (on the desktop).
If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

Remember: do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

===================================================

Run aswMBR

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
🖼Click to load external image (Posted Image)

On completion of the scan click save log, save it to your desktop and post in your next reply
🖼Click to load external image (Posted Image)

===================================================

Run Security Check

Download Security Check by screen317 from here or here.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===================================================

Logs to include with next post:

RKreport.txt
aswMBR.txt
checkup.txt

Also, I notice you have run ComboFix which is not recommended. ComboFix is a VERY powerful tool that can reduce a computer to a useless piece of metal without expert guidance.

Please send the log from when you ran it. ComboFix logs are located at c:\combofix.txt, older logs are at c:\qoobox\combofix2.txt, c:\qoobox\ComboFix3.txt etc

Please also remember to tell me about the proxy settings

Thanks

Satchfan

dawooksta

Post #4July 5, 2011, 10:31 PM UTC

Hi Satchfan

First I'd like to say a big thanks - your help is truly appreciated.

In response to some of your points - The ASK toolbar - I agree, it's a pain. If I want to do a net search I'll visit a search engijne homepage; I don't want these toolbars cluttering up my screen but unfortunately it seems they're commonly bundled with other software like drivers. Within a day of setting up my new PC I had the search bars for Google, Yahoo and Ask installed! All got rid of now. I can't seem to get rid of the Ask bar from this PC though…when I try to uninstall I get "The windows installer service could not be accessed. This can occur if the windows installer is not correctly installed". A problem for another day perhaps.

Proxy setttings - not something I've done deliberately. I've used proxy servers to access Pandora internet radio ….last time a couple of years ago. Could it be something to do with a Game playing P2P client I used? (Tunngle). I've uninstalled this now, having read what you said about peer to peer.

Which leads on to P2P - frostwire. I agree it's the most likely candidate for this infection. I downloaded a bunch of ebooks, a couple of which had contents which didn't match the file descriptions and wouldn't open. Learn't my lesson there.

Oh..and regards Combo fix "ComboFix logs are located at c:\combofix.txt, older logs are at c:\qoobox\combofix2.txt, c:\qoobox\ComboFix3.txt etc" Typical of the computer at the mo, there are no text files visible in any of these locations.

RogueKiller V5.2.7 [06/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6000 ) 32 bits version
Started in : Safe mode with network support
User: Shane [Admin rights]
Mode: Scan – Date : 07/05/2011 22:00:36

Bad processes: 0

Registry Entries: 6
[BLACKLIST DLL] HKCU\[…]\Run : Cdcrtmm (rundll32.exe "C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll",smpPadvga eapAuthenticationLite) -> FOUND
[BLACKLIST DLL] HKUS\S-1-5-21-3774678942-341068382-2512915098-1000[…]\Run : Cdcrtmm (rundll32.exe "C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll",smpPadvga eapAuthenticationLite) -> FOUND
[PROXY IE] HKCU\[…]\Internet Settings : ProxyEnable (1) -> FOUND
[PROXY IE] HKCU\[…]\Internet Settings : ProxyServer (http=127.0.0.1:50242) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

HOSTS File:

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

aswMBR version 0.9.7.705 Copyright© 2011 AVAST Software
Run date: 2011-07-05 22:02:59
—————————–
22:02:59.713 OS Version: Windows 6.0.6000
22:02:59.713 Number of processors: 2 586 0xF0D
22:02:59.714 ComputerName: SHANE-PC UserName: Shane
22:03:02.779 Initialize success
22:03:07.344 AVAST engine download error: 0
22:03:12.310 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
22:03:12.313 Disk 0 Vendor: Intel___ 1.0. Size: 953875MB BusType: 8
22:03:12.326 Disk 0 MBR read successfully
22:03:12.332 Disk 0 MBR scan
22:03:12.336 Disk 0 unknown MBR code
22:03:12.361 Disk 0 scanning sectors +1953533952
22:03:12.389 Disk 0 scanning C:\Windows\system32\drivers
22:03:18.242 Service scanning
22:03:18.553 Service fdc C:\Windows\system32\DRIVERS\fdc.sys **HIDDEN**
22:03:18.560 Service flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys **HIDDEN**
22:03:18.572 Service i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys **HIDDEN**
22:03:19.205 Disk 0 trace - called modules:
22:03:19.239 ntoskrnl.exe CLASSPNP.SYS disk.sys iastorv.sys hal.dll
22:03:19.246 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84693030]
22:03:19.253 3 ntoskrnl.exe[81ca80af] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8421e030]
22:03:19.271 Scan finished successfully
22:03:49.299 Disk 0 MBR has been saved successfully to "C:\Users\Shane\What the tech\MBR.dat"
22:03:49.308 The log file has been saved successfully to "C:\Users\Shane\What the tech\aswMBR.txt"

Results of screen317's Security Check version 0.99.17
Windows Vista (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 22
Out of date Java installed!
Adobe Flash Player 10.3.181.14
Mozilla Firefox (x86 en-GB..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````

Satchfan

Post #5July 6, 2011, 2:06 PM UTC

Hello dawooksta

Don't worry about the Ask entries - e'll sort that out later.

Run Unhide

Download Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.

===================================================

Run RogueKiller

Close all running programs and run RogueKiller once again. 1. For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
2. When prompted, type 2 and then press Enter
3. The RKreport.txt will be generated next to RogueKiller.exe (on the desktop, if that is where you saved the program
4. If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

===================================================

Run DDS

Please run DDS again.

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

• disable any script blocking protection (How to Disable your Security Programs)
• double click DDS icon to run the tool (may take up to 3 minutes to run)
• when done, DDS.txt will open.
• after a few moments, attach.txt will open in a second window.
• save both reports to your desktop.
• Post the contents of the DDS.txt and Attach.txt reports in your next reply
===================================================

Please let me know if you can now see your missing files/folders

Thanks

Satchfan

dawooksta

Post #6July 6, 2011, 8:02 PM UTC

Hi Satchfan

Great news - the photo'sand vids are back.. Phew!

Here are the logs from Rogue Killer and DDS

RogueKiller V5.2.7 [06/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6000 ) 32 bits version
Started in : Safe mode with network support
User: Shane [Admin rights]
Mode: Remove – Date : 07/06/2011 19:13:55

Bad processes: 0

Registry Entries: 6
[BLACKLIST DLL] HKCU\[…]\Run : Cdcrtmm (rundll32.exe "C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll",smpPadvga eapAuthenticationLite) -> DELETED
[PROXY IE] HKCU\[…]\Internet Settings : ProxyEnable (1) -> NOT REMOVED, USE PROXYFIX
[PROXY IE] HKCU\[…]\Internet Settings : ProxyServer (http=127.0.0.1:50242) -> NOT REMOVED, USE PROXYFIX
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[FILE ASSO] HKLM\[…]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command : (C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe) -> REPLACED : ("")

HOSTS File:

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

.
DDS (Ver_2011-06-23.01) - NTFSx86 NETWORK
Internet Explorer: 7.0.6000.16982 BrowserJavaVersion: 1.6.0_22
Run by [removed] at 18:32:52 on 2011-07-06
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2047.1365 [GMT 1:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\explorer.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:50242
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Tracker Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Tracker Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Cdcrtmm] rundll32.exe "c:\users\shane\appdata\local\bluetoothhelpinit\Cdcrtmm.dll",smpPadvga eapAuthenticationLite
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\shane\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe
StartupFolder: c:\users\shane\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
Trusted Zone: com\www.msi
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/RELEASECAB/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{09DF9C1E-146C-402D-A798-33404C809D5D} : DhcpNameServer = [removed]
TCP: Interfaces\{BC5CC73E-EA81-46E3-AD8E-539F60078C68} : DhcpNameServer = [removed] [removed]
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\shane\appdata\roaming\mozilla\firefox\profiles\qohvf8o3.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox 4.0 beta 12\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox 4.0 beta 12\plugins\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\tracker software\pdf viewer\npPDFXCviewNPPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [2011-3-15 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-1-26 176128]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 TunngleService;TunngleService;c:\program files\tunngle\tnglctrl.exe –> c:\program files\tunngle\TnglCtrl.exe [?]
S3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-1-27 7566848]
S3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-1-26 238592]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-11-17 97296]
S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\progra~1\msi\msiwdev\msibios32_100507.sys [2010-5-10 25912]
S3 NTIOLib_1_0_8;NTIOLib_1_0_8;c:\progra~1\msi\msiwdev\NTIOLib.sys [2011-1-27 7680]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-07-06 16:18:49 6962000 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{79bf18b2-9bac-4946-a176-ebb8ce3ac80d}\mpengine.dll
2011-07-05 06:31:44 ——– d—–w- c:\users\shane\What the tech
2011-07-02 05:26:41 ——– d—–w- C:\NBRT
.
==================== Find3M ====================
.
2011-06-26 06:45:56 256000 —-a-w- c:\windows\PEV.exe
2011-05-27 22:52:34 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-24 18:28:41 472808 —-a-w- c:\windows\system32\deployJava1.dll
.
============= FINISH: 18:33:05.29 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 27/02/2011 00:55:14
System Uptime: 06/07/2011 17:17:44 (1 hours ago)
.
Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | MS-7345
Processor: Intel® Pentium® Dual CPU E2140 @ 1.60GHz | CPU 1 | 1606/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 932 GiB total, 498.96 GiB free.
D: is CDROM (UDF)
E: is FIXED (NTFS) - 932 GiB total, 576.548 GiB free.
F: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
AC3Filter 1.63b
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
ATI Catalyst Install Manager
ATI Catalyst Registration
ATI Stream SDK v2 Developer
Battlefield: Bad Company 2
BioShock
Bonjour
BurnAware Free 3.1.4
calibre
Canon Easy-PhotoPrint EX
Canon iP4500 series
Canon My Printer
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
ccc-core-static
ccc-utility
CCC Help English
DivX Setup
Dungeon Keeper 2
HandBrake 0.9.5
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iTunes
Java Auto Updater
Java™ 6 Update 22
K-Lite Mega Codec Pack 7.1.0
Left 4 Dead 2
MagicDisc 2.7.106
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft IntelliPoint 7.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
MobileMe Control Panel
Mozilla Firefox 5.0 (x86 en-GB)
OpenOffice.org 3.3
PDF-Viewer
PunkBuster Services
QuickTime
Safari
Steam
Supreme Commander 2
The Extractor
The Lord of the Rings FREE Trial
Tixati
Tunngle beta
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VC80CRTRedist - 8.0.50727.4053
.
==== End Of File ===========================

Satchfan

Post #7July 6, 2011, 10:19 PM UTC

Hi dawooksta

Good news about the photos and videos.

Run RogueKiller

Close all running programs and run RogueKiller once again. • for Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
• when prompted, type 4 and then press Enter
• the RKreport.txt will be generated next to RogueKiller.exe (on the desktop, if that is where you saved the program
• if the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

Run ComboFix

If it is still there, delete the version of ComboFix you have on your desktop and download a new one from one of the following locations:

Link1
Link2
Link3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Close any open browser windows
Double click on combofix.exe and follow the prompts.

When finished, it will produce a report for you. Please include it in your next reply.

Note:Do not mouseclick combofix's window while it's running. That may cause it to stall

Please remember to also include RKreport.txt and let me know how your computer is running now.

Thanks

Satchfan

dawooksta

Post #8July 7, 2011, 6:48 PM UTC

Hi Satchfan

Thanks again for your ongoing help

RK ran smoothly. Combofix ran and produced the report but did say at a couple of points "Access denied. Administrator permissions are needed to use the selected options. Use an administrator command prompt to complete these tasks" despite me right clicking on the program and choosing "run as administrator".

Here are the logs :

RogueKiller V5.2.7 [06/30/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6000 ) 32 bits version
Started in : Safe mode with network support
User: Shane [Admin rights]
Mode: Scan – Date : 07/07/2011 17:57:44

Bad processes: 0

Registry Entries: 4
[PROXY IE] HKCU\[…]\Internet Settings : ProxyEnable (1) -> FOUND
[PROXY IE] HKCU\[…]\Internet Settings : ProxyServer (http=127.0.0.1:50242) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

HOSTS File:

Finished : << RKreport[1].txt >>
RKreport[1].txt

ComboFix 11-07-07.03 - Shane 07/07/2011 18:01:31.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2047.1588 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\bdvxc23.Bin
c:\bdvxc23.bin\config.bin
c:\users\Shane\AppData\Local\{034E3327-F8AE-440B-B24A-96500EDA13CA}
c:\users\Shane\AppData\Local\{034E3327-F8AE-440B-B24A-96500EDA13CA}\chrome.manifest
c:\users\Shane\AppData\Local\{034E3327-F8AE-440B-B24A-96500EDA13CA}\chrome\content\_cfg.js
c:\users\Shane\AppData\Local\{034E3327-F8AE-440B-B24A-96500EDA13CA}\chrome\content\overlay.xul
c:\users\Shane\AppData\Local\{034E3327-F8AE-440B-B24A-96500EDA13CA}\install.rdf
c:\users\Shane\AppData\Roaming\Adobe\plugs
c:\users\Shane\AppData\Roaming\Adobe\shed
c:\users\Shane\AppData\Roaming\Adobe\shed\thr1.chm
E:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-06-07 to 2011-07-07 )))))))))))))))))))))))))))))))
.
.
2011-07-07 17:08 . 2011-07-07 17:08 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-07-07 17:08 . 2011-07-07 17:08 ——– d—–w- c:\users\Shane\AppData\Local\temp
2011-07-07 16:41 . 2011-05-09 20:46 6962000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8B0D8FE3-8137-4131-A071-0DB2A8C651F4}\mpengine.dll
2011-07-05 06:31 . 2011-07-06 18:14 ——– d—–w- c:\users\Shane\What the tech
2011-07-04 17:00 . 2011-07-04 17:00 ——– d—–w- c:\program files\Recuva
2011-07-02 05:26 . 2011-07-02 05:26 ——– d—–w- C:\NBRT
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-27 23:01 . 2011-05-27 23:01 0 —-a-w- c:\users\Shane\AppData\Local\Vziboqe.bin
2011-05-27 22:52 . 2011-05-20 19:48 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-24 18:28 . 2011-05-24 18:28 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-05-12 17:32 . 2011-05-12 17:32 784136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 21:44 1400712 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2011-02-27 1232896]
"Steam"="c:\program files\Steam\Steam.exe" [2011-02-27 1242448]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-26 2569616]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
c:\users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-3-10 576000]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-3-2 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 176128]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [x]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 7566848]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 238592]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-11-17 97296]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\progra~1\MSI\MSIWDev\msibios32_100507.sys [2010-05-10 25912]
R3 NTIOLib_1_0_8;NTIOLib_1_0_8;c:\progra~1\MSI\MSIWDev\NTIOLib.sys [2011-01-27 7680]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ECACHE
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-04 16:59]
.
2011-05-27 c:\windows\Tasks\User_Feed_Synchronization-{68CE3089-3D62-473A-AB30-5F54F790FC1F}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:50242
Trusted Zone: com\www.msi
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Tunngle beta_is1 - c:\program files\Tunngle\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-07 18:08
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msiserver]
"ImagePath"="%systemroot%\system32\msiexec /V"
.
Completion time: 2011-07-07 18:10:37
ComboFix-quarantined-files.txt 2011-07-07 17:10
.
Pre-Run: 535,697,846,272 bytes free
Post-Run: 536,127,598,592 bytes free
.
- - End Of File - - DA4C21C08FED6D571DE68B35C93A7CE9

Satchfan

Post #9July 8, 2011, 1:35 PM UTC

Dawooksta

ComboFix got rid of a few things but there are others that we need to deal with.

Submit a file to VirusTotal

Go to VirusTotal and submit this file for analysis:

C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll
• click on Browse
• click on the arrow and choose Local Disc (C:)
🖼Click to load external image (Posted Image)
• below, double-click on Shane
• double-click on the AppDatafolder and then the Local, Bluetooth, Helpinit folders
• locate the file Cdcrtmm.dll click on it and then on Open
• click on Send File.
You will get a report back; post the report into this thread for me to see.

Run OTL • Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
• Post the OTL.txt log it produces in your next reply.
Please post back with the log

Thanks

Satchfan

dawooksta

Post #10July 8, 2011, 5:28 PM UTC

Hi again Satchfan
Just had a thought..I should let you know - last week the PC wouldn't boot past "Checking NV RAM". The only way I could get the PC to boot even to safe mode was by using the windows disk to boot to and then use the fixMBR command.

I submitted the file to Virus Total and got the following :

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:
MD5: 8ccc474acac560ee84885a66bf002c12
Date first seen: 2011-06-22 18:55:12 (UTC)
Date last seen: 2011-06-22 18:55:12 (UTC)
Detection ratio: 16/42

………I chose the option "View Last Report" and copied this below ……….

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 1 VT Community user(s) with a total of 5607 reputation credit(s) say(s) this sample is malware.
File name:
4098B39A3DFE1FDCE2F6BDE8DAAC11690E35B3580C2E7180E848B8195E29C1B8
Submission date:
2011-06-22 18:55:12 (UTC)
Current status:
finished
Result:
16 /42 (38.1%)

VT Community

malware
Safety score: 0.0%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.06.23.00 2011.06.22 Malware/Win32.Generic
AntiVir 7.11.10.74 2011.06.22 TR/Sefnit.M.45
Antiy-AVL 2.0.3.7 2011.06.22 -
Avast 4.8.1351.0 2011.06.22 Win32:Malware-gen
Avast5 5.0.677.0 2011.06.22 Win32:Malware-gen
AVG 10.0.0.1190 2011.06.22 Generic22.BNPA
BitDefender 7.2 2011.06.22 Gen:Variant.Kazy.24970
CAT-QuickHeal 11.00 2011.06.22 -
ClamAV 0.97.0.0 2011.06.22 -
Commtouch 5.3.2.6 2011.06.22 -
Comodo 9156 2011.06.22 -
DrWeb 5.0.2.03300 2011.06.22 -
eSafe 7.0.17.0 2011.06.22 -
eTrust-Vet 36.1.8400 2011.06.22 -
F-Prot 4.6.2.117 2011.06.22 -
F-Secure 9.0.16440.0 2011.06.22 Gen:Variant.Kazy.24970
Fortinet 4.2.257.0 2011.06.22 -
GData 22 2011.06.22 Gen:Variant.Kazy.24970
Ikarus T3.1.1.104.0 2011.06.22 Trojan.SuspectCRC
Jiangmin 13.0.900 2011.06.22 -
K7AntiVirus 9.106.4834 2011.06.22 -
Kaspersky 9.0.0.837 2011.06.22 -
McAfee 5.400.0.1158 2011.06.22 Artemis!8CCC474ACAC5
McAfee-GW-Edition 2010.1D 2011.06.22 Artemis!8CCC474ACAC5
Microsoft 1.7000 2011.06.22 Trojan:Win32/Sefnit.M
NOD32 6229 2011.06.22 -
Norman 6.07.10 2011.06.22 -
nProtect 2011-06-22.02 2011.06.22 Gen:Variant.Kazy.24970
Panda 10.0.3.5 2011.06.22 Trj/CI.A
PCTools 8.0.0.5 2011.06.22 -
Prevx 3.0 2011.06.22 -
Rising 23.63.02.03 2011.06.22 -
Sophos 4.66.0 2011.06.22 -
SUPERAntiSpyware 4.40.0.1006 2011.06.22 -
Symantec 20111.1.0.186 2011.06.22 -
TheHacker 6.7.0.1.237 2011.06.22 -
TrendMicro 9.200.0.1012 2011.06.22 -
TrendMicro-HouseCall 9.200.0.1012 2011.06.22 -
VBA32 3.12.16.2 2011.06.22 -
VIPRE 9660 2011.06.22 Trojan.Win32.Generic!BT
ViRobot 2011.6.22.4527 2011.06.22 -
VirusBuster 14.0.91.1 2011.06.22 Trojan.Sefnit!VdaJywWcJL4
Additional information
MD5 : 8ccc474acac560ee84885a66bf002c12
SHA1 : 71297965d54f343cf80cc3dace2cad0d2e50c103
SHA256: 4098b39a3dfe1fdce2f6bde8daac11690e35b3580c2e7180e848b8195e29c1b8

VT Community

User:
Xylitol
Reputation:
5607 credits
Comment date:
2011-06-23 19:52:02 (UTC)
This file was uploaded by the Faggot crawler [MAD plugin] #fag #MAD
Tags: Malware, fag, MAD, kazy, 24970, sefnit

I've run OTL - when I press "Quick Scan" the LOP Check and Purity boxes are automatically checked. I choose "Minimal Output"

OTL logfile created on: 08/07/2011 16:53:49 - Run 1
OTL by OldTimer - Version 3.2.26.0 Folder = C:\Users\Shane\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.39 Gb Available Physical Memory | 69.39% Memory free
2.17 Gb Paging File | 1.72 Gb Available in Paging File | 79.21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931.52 Gb Total Space | 506.84 Gb Free Space | 54.41% Space Free | Partition Type: NTFS
Drive D: | 2.49 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 495.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SHANE-PC | User Name: Shane | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugin-container.exe (Mozilla Corporation)
PRC - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (TunngleService) – File not found
SRV - (PnkBstrA) – File not found
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)

========== Driver Services (SafeList) ==========

DRV - (NTIOLib_1_0_8) – C:\Program Files\MSI\MSIWDev\NTIOLib.sys (MSI)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) – C:\Windows\System32\drivers\AtihdLH3.sys (Advanced Micro Devices)
DRV - (MSI_MSIBIOS_010507) – C:\Program Files\MSI\MSIWDev\msibios32_100507.sys (Your Corporation)
DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) – C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net)
DRV - (Point32) – C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50242

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.co.uk"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/07/06 17:19:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/07/06 17:19:58 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]

[2011/02/27 02:46:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions
[2008/07/15 22:13:53 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/02/27 15:37:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions
[2010/10/23 20:15:49 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/20 14:52:17 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/07 23:44:07 | 000,000,000 | —D | M] (New Tab Homepage) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2009/09/24 20:07:37 | 000,000,000 | —D | M] (20-20 3D Viewer) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]
[2011/07/04 07:02:49 | 000,000,000 | —D | M] (@@toolbarname@@) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]
[2011/05/12 18:56:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions
[2011/07/04 07:02:49 | 000,000,000 | —D | M] (EPUBReader) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2011/01/31 14:24:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/20 14:51:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/14 19:22:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/26 21:14:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) –
[2011/07/04 07:02:44 | 000,000,000 | —D | M] (Java Console) – C:\PROGRAM FILES\MOZILLA FIREFOX 4.0 BETA 12\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\{66E978CD-981F-47DF-AC42-E3CF417C1467}.XPI
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\[removed]
[2011/02/28 01:29:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2010/10/22 19:08:15 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/10/22 19:08:15 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/10/22 19:08:15 | 000,000,769 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/10/22 19:08:15 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/07/07 18:08:37 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..\Toolbar\WebBrowser: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..Trusted Domains: com ([www.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnl…CAB/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/11/02 21:00:00 | 000,000,043 | R— | M] () - D:\autorun.inf – [ UDF ]
O32 - AutoRun File - [2007/07/01 07:22:48 | 000,000,000 | —D | M] - F:\AutoRunSource – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 000,011,478 | R— | M] () - F:\Autorun.ico – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 002,256,896 | R— | M] (Longtion) - F:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:09 | 000,000,047 | R— | M] () - F:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:10 | 000,462,809 | R— | M] () - F:\autorun.tgt – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/07 18:10:39 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/07/07 18:10:39 | 000,000,000 | —D | C] – C:\Users\Shane\AppData\Local\temp
[2011/07/07 18:10:16 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/07/07 17:57:44 | 000,000,000 | —D | C] – C:\Users\Shane\Desktop\RK_Quarantine
[2011/07/07 17:53:34 | 004,135,577 | R— | C] (Swearware) – C:\Users\Shane\Desktop\ComboFix.exe
[2011/07/05 07:32:42 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/05 07:31:44 | 000,000,000 | —D | C] – C:\Users\Shane\What the tech
[2011/07/05 06:28:45 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/07/05 06:28:45 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/07/05 06:28:45 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/07/05 06:28:45 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/07/05 06:28:40 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/07/05 06:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2011/07/04 18:00:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2011/07/04 18:00:17 | 000,000,000 | —D | C] – C:\Program Files\Recuva
[2011/07/04 18:00:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/07/02 06:26:41 | 000,000,000 | —D | C] – C:\NBRT

========== Files - Modified Within 30 Days ==========

[2011/07/08 16:35:03 | 000,679,678 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/08 16:35:03 | 000,130,040 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/08 16:30:33 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/08 16:30:11 | 268,435,456 | -HS- | M] () – C:\Windows\System32\temppf.sys
[2011/07/07 20:01:45 | 000,054,016 | —- | M] () – C:\Windows\System32\drivers\tbmlyorq.sys
[2011/07/07 19:32:15 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/07 18:18:34 | 000,000,007 | —- | M] () – C:\Users\Shane\Desktop\New Rich Text Document.rtf
[2011/07/07 18:08:37 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/07/07 17:53:44 | 004,135,577 | R— | M] (Swearware) – C:\Users\Shane\Desktop\ComboFix.exe
[2011/07/06 22:04:12 | 000,070,144 | —- | M] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/06 17:44:43 | 000,001,356 | —- | M] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/07/05 21:08:59 | 000,000,000 | —- | M] () – C:\Users\Shane\defogger_reenable
[2011/07/05 07:34:13 | 000,625,664 | —- | M] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 07:32:42 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | M] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | M] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/26 07:45:56 | 000,256,000 | —- | M] () – C:\Windows\PEV.exe

========== Files Created - No Company Name ==========

[2011/07/07 20:01:45 | 000,054,016 | —- | C] () – C:\Windows\System32\drivers\tbmlyorq.sys
[2011/07/07 19:32:15 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/07 18:18:34 | 000,000,007 | —- | C] () – C:\Users\Shane\Desktop\New Rich Text Document.rtf
[2011/07/05 21:08:59 | 000,000,000 | —- | C] () – C:\Users\Shane\defogger_reenable
[2011/07/05 07:34:13 | 000,625,664 | —- | C] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 06:28:45 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/07/05 06:28:45 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/07/05 06:28:45 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/07/05 06:28:45 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/07/05 06:28:45 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | C] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | C] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/03 22:05:15 | 268,435,456 | -HS- | C] () – C:\Windows\System32\temppf.sys
[2011/06/01 00:41:14 | 000,000,152 | —- | C] () – C:\ProgramData\~23256848r
[2011/06/01 00:41:14 | 000,000,136 | —- | C] () – C:\ProgramData\~23256848
[2011/06/01 00:41:02 | 000,000,344 | —- | C] () – C:\ProgramData\23256848
[2011/05/28 02:14:54 | 000,003,994 | -HS- | C] () – C:\Users\Shane\AppData\Local\s7846w86gi86yo4j3444wfp8hl
[2011/05/28 02:14:54 | 000,003,994 | -HS- | C] () – C:\ProgramData\s7846w86gi86yo4j3444wfp8hl
[2011/05/28 02:12:56 | 000,002,136 | —- | C] () – C:\Users\Shane\AppData\Roaming\610E.259
[2011/05/28 00:01:21 | 000,000,120 | —- | C] () – C:\Users\Shane\AppData\Local\Djuja.dat
[2011/05/28 00:01:21 | 000,000,000 | —- | C] () – C:\Users\Shane\AppData\Local\Vziboqe.bin
[2011/05/27 23:57:06 | 000,011,362 | -HS- | C] () – C:\Users\Shane\AppData\Local\6a5067824fd3almxx8y1pfab70vt7oa2j152
[2011/05/27 23:57:06 | 000,011,362 | -HS- | C] () – C:\ProgramData\6a5067824fd3almxx8y1pfab70vt7oa2j152
[2011/04/19 23:19:22 | 000,175,616 | —- | C] () – C:\Windows\System32\unrar.dll
[2011/04/19 23:19:21 | 000,631,808 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/04/19 23:19:21 | 000,243,200 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/04/19 23:19:21 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2011/04/19 23:19:20 | 000,080,896 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2011/03/15 22:07:21 | 000,000,000 | —- | C] () – C:\Windows\System32\Access.dat
[2011/03/02 20:20:30 | 000,000,223 | —- | C] () – C:\Users\Shane\AppData\Roaming\burnaware.ini
[2011/02/27 22:05:33 | 000,138,056 | —- | C] () – C:\Users\Shane\AppData\Roaming\PnkBstrK.sys
[2011/02/27 22:04:56 | 002,434,856 | —- | C] () – C:\Windows\System32\pbsvc_bc2.exe
[2011/02/27 09:38:36 | 000,070,144 | —- | C] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/27 02:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/02/27 02:03:00 | 000,001,356 | —- | C] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/01/26 23:11:58 | 000,023,040 | —- | C] () – C:\Windows\System32\atitmpxx.dll
[2010/12/21 03:27:20 | 000,003,113 | —- | C] () – C:\Windows\System32\atipblag.dat
[2010/12/17 17:00:44 | 000,227,587 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2010/11/28 13:01:35 | 000,000,178 | —- | C] () – C:\Users\Shane\AppData\Roaming\default.rss
[2010/04/21 01:27:01 | 000,030,498 | -HS- | C] () – C:\Users\Shane\AppData\Local\J50Ev7evclyS4
[2009/08/06 23:55:36 | 001,871,758 | —- | C] () – C:\Users\Shane\AppData\Roaming\NMM-MetaData.db
[2009/08/04 22:59:28 | 000,000,036 | —- | C] () – C:\Users\Shane\AppData\Local\housecall.guid.cache
[2008/01/23 21:52:53 | 000,000,134 | —- | C] () – C:\Users\Shane\AppData\Roaming\AVSDVDPlayer.m3u
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,257,720 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,679,678 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,130,040 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 08:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 08:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin

========== LOP Check ==========

[2009/08/19 20:47:05 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Bioshock
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\BitTyrant
[2011/04/25 20:42:35 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\calibre
[2010/04/04 15:34:03 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Canon
[2011/02/26 18:18:42 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Dropbox
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Facebook
[2008/06/23 19:10:06 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\FrostWire
[2011/07/04 07:02:48 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\GetRightToGo
[2010/12/16 23:15:40 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\HandBrake
[2008/01/20 14:02:10 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\InterTrust
[2009/06/01 00:21:32 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\IrfanView
[2008/06/26 09:43:53 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Juniper Networks
[2008/04/19 10:59:00 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Leadertech
[2009/08/06 23:55:38 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Nokia
[2010/11/22 20:33:28 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Nokia Multimedia Player
[2011/05/24 19:32:36 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\OpenOffice.org
[2008/06/23 23:35:27 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Opera
[2009/07/22 20:10:43 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\PC Suite
[2011/07/04 07:02:49 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\PhotoScape
[2008/04/05 13:35:31 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\SoundSpectrum
[2011/05/26 02:16:34 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\tixati
[2008/03/02 02:40:15 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\TomTom
[2011/07/04 07:02:49 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Tunngle
[2009/05/24 19:10:12 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Unity
[2010/11/11 21:12:15 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\Vso
[2011/05/28 02:00:38 | 000,032,598 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/05/27 20:50:09 | 000,000,418 | —- | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{68CE3089-3D62-473A-AB30-5F54F790FC1F}.job

========== Purity Check ==========

< End of report >

Satchfan

Post #11July 9, 2011, 11:15 AM UTC

Hi dawooksta

Run aswMBR

re-Run aswMBR
click Scan
on completion of the scan click the Fix button

🖼Click to load external image (Posted Image)

Save the log as before and post in your next reply

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50242 [2011/07/04 07:02:49 | 000,000,000 | —D | M] (@@toolbarname@@) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed] O2 - BHO: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-3774678942-341068382-2512915098-1000\..\Toolbar\WebBrowser: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) [2011/06/01 00:41:14 | 000,000,152 | —- | C] () – C:\ProgramData\~23256848r [2011/06/01 00:41:14 | 000,000,136 | —- | C] () – C:\ProgramData\~23256848 [2011/06/01 00:41:02 | 000,000,344 | —- | C] () – C:\ProgramData\23256848 [2011/05/28 02:14:54 | 000,003,994 | -HS- | C] () – C:\Users\Shane\AppData\Local\s7846w86gi86yo4j3444wfp8hl [2011/05/28 02:14:54 | 000,003,994 | -HS- | C] () – C:\ProgramData\s7846w86gi86yo4j3444wfp8hl [2011/05/28 02:12:56 | 000,002,136 | —- | C] () – C:\Users\Shane\AppData\Roaming\610E.259 [2011/05/28 00:01:21 | 000,000,120 | —- | C] () – C:\Users\Shane\AppData\Local\Djuja.dat [2011/05/28 00:01:21 | 000,000,000 | —- | C] () – C:\Users\Shane\AppData\Local\Vziboqe.bin [2011/05/27 23:57:06 | 000,011,362 | -HS- | C] () – C:\Users\Shane\AppData\Local\6a5067824fd3almxx8y1pfab70vt7oa2j152 [2011/05/27 23:57:06 | 000,011,362 | -HS- | C] () – C:\ProgramData\6a5067824fd3almxx8y1pfab70vt7oa2j152 [2008/06/23 19:10:06 | 000,000,000 | —D | M] – C:\Users\Shane\AppData\Roaming\FrostWire :Reg :Files ipconfig /flushdns /c :Commands [purity] [CreateRestorePoint] [ResetHosts] [EmptyFlash] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Logs to include in next post:

aswMBR log
OTL fix lo
New OTL log

Satchfan

dawooksta

Post #12July 9, 2011, 10:20 PM UTC

Hi Satchfan

Just managed to get my daughter off to bed - been looking after her alll day as the GF is at a hen-day/party, so this is the fiirst time I'm able to look at the PC.

I couldn't past the OTL fix log though …it was automaticaly copied to the clipboard but the system rebooted before I was able to paste and save it.

Here are the other logs :

aswMBR version 0.9.7.705 Copyright© 2011 AVAST Software
Run date: 2011-07-09 14:59:06
—————————–
14:59:06.192 OS Version: Windows 6.0.6000
14:59:06.192 Number of processors: 2 586 0xF0D
14:59:06.192 ComputerName: SHANE-PC UserName: Shane
14:59:09.317 Initialize success
14:59:46.395 AVAST engine defs: 11070900
15:00:06.661 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
15:00:06.661 Disk 0 Vendor: Intel___ 1.0. Size: 953875MB BusType: 8
15:00:06.676 Disk 0 MBR read successfully
15:00:06.692 Disk 0 MBR scan
15:00:06.692 Disk 0 unknown MBR code
15:00:06.707 Disk 0 scanning sectors +1953533952
15:00:06.723 Disk 0 scanning C:\Windows\system32\drivers
15:00:16.207 Service scanning
15:00:16.551 Service fdc C:\Windows\system32\DRIVERS\fdc.sys **HIDDEN**
15:00:16.551 Service flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys **HIDDEN**
15:00:16.567 Service i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys **HIDDEN**
15:00:17.239 Disk 0 trace - called modules:
15:00:17.239 ntoskrnl.exe CLASSPNP.SYS disk.sys iastorv.sys hal.dll
15:00:17.254 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84697030]
15:00:17.254 3 ntoskrnl.exe[81ca80af] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84222030]
15:00:20.364 AVAST engine scan C:\
16:13:08.000 File: C:\ProgramData\AppData\Local\Temp\Macromedia\swfupdate\swfupdate.dll **INFECTED** Win32:Malware-gen
16:16:26.437 File: C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll **INFECTED** Win32:Malware-gen
16:19:45.047 File: C:\Users\Shane\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\141956b8-1f77ebcd **INFECTED** Win32:Downloader-HLP [Trj]
16:48:40.764 File: C:\Windows\System32\config\systemprofile\AppData\Local\amehapuvebuqavi.dll **INFECTED** Win32:MalOb-GC [Cryp]
17:05:18.152 Disk 0 Windows 600 MBR fixed successfully
17:05:28.626 File: C:\Windows\System32\config\systemprofile\AppData\Local\shneri.dll **INFECTED** Win32:MalOb-DT [Cryp]
19:40:52.571 Scan finished successfully
20:58:30.178 Disk 0 MBR has been saved successfully to "C:\Users\Shane\What the tech\MBR.dat"
20:58:30.190 The log file has been saved successfully to "C:\Users\Shane\What the tech\aswMBR.txt"
21:02:11.879 Disk 0 MBR has been saved successfully to "C:\Users\Shane\Desktop\MBR.dat"
21:02:11.906 The log file has been saved successfully to "C:\Users\Shane\Desktop\aswMBR.txt"

OTL logfile created on: 09/07/2011 21:38:52 - Run 2
OTL by OldTimer - Version 3.2.26.0 Folder = C:\Users\Shane\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 77.80% Memory free
2.17 Gb Paging File | 1.87 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931.52 Gb Total Space | 506.45 Gb Free Space | 54.37% Space Free | Partition Type: NTFS
Drive D: | 2.49 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 495.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SHANE-PC | User Name: Shane | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (TunngleService) – File not found
SRV - (PnkBstrA) – File not found
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)

========== Driver Services (SafeList) ==========

DRV - (NTIOLib_1_0_8) – C:\Program Files\MSI\MSIWDev\NTIOLib.sys (MSI)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) – C:\Windows\System32\drivers\AtihdLH3.sys (Advanced Micro Devices)
DRV - (MSI_MSIBIOS_010507) – C:\Program Files\MSI\MSIWDev\msibios32_100507.sys (Your Corporation)
DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) – C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net)
DRV - (Point32) – C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.co.uk"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/07/06 17:19:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/07/06 17:19:58 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]

[2011/02/27 02:46:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions
[2008/07/15 22:13:53 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/07/09 21:09:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions
[2010/10/23 20:15:49 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/20 14:52:17 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/07 23:44:07 | 000,000,000 | —D | M] (New Tab Homepage) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2009/09/24 20:07:37 | 000,000,000 | —D | M] (20-20 3D Viewer) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]
[2011/05/12 18:56:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions
[2011/07/04 07:02:49 | 000,000,000 | —D | M] (EPUBReader) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2011/01/31 14:24:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/20 14:51:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/14 19:22:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/26 21:14:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) –
[2011/07/04 07:02:44 | 000,000,000 | —D | M] (Java Console) – C:\PROGRAM FILES\MOZILLA FIREFOX 4.0 BETA 12\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\{66E978CD-981F-47DF-AC42-E3CF417C1467}.XPI
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\[removed]
[2011/02/28 01:29:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2010/10/22 19:08:15 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/10/22 19:08:15 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/10/22 19:08:15 | 000,000,769 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/10/22 19:08:15 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/07/09 21:09:32 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - File not found
O3 - HKLM\..\Toolbar: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - File not found
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: com ([www.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnl…CAB/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/11/02 21:00:00 | 000,000,043 | R— | M] () - D:\autorun.inf – [ UDF ]
O32 - AutoRun File - [2007/07/01 07:22:48 | 000,000,000 | —D | M] - F:\AutoRunSource – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 000,011,478 | R— | M] () - F:\Autorun.ico – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 002,256,896 | R— | M] (Longtion) - F:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:09 | 000,000,047 | R— | M] () - F:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:10 | 000,462,809 | R— | M] () - F:\autorun.tgt – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/09 21:09:27 | 000,000,000 | —D | C] – C:\_OTL
[2011/07/07 18:10:39 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/07/07 18:10:39 | 000,000,000 | —D | C] – C:\Users\Shane\AppData\Local\temp
[2011/07/07 18:10:16 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/07/07 17:57:44 | 000,000,000 | —D | C] – C:\Users\Shane\Desktop\RK_Quarantine
[2011/07/07 17:53:34 | 004,135,577 | R— | C] (Swearware) – C:\Users\Shane\Desktop\ComboFix.exe
[2011/07/05 21:27:11 | 001,925,512 | —- | C] (AVAST Software) – C:\Users\Shane\Desktop\aswMBR.exe
[2011/07/05 07:32:42 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/05 07:31:44 | 000,000,000 | —D | C] – C:\Users\Shane\What the tech
[2011/07/05 06:28:45 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/07/05 06:28:45 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/07/05 06:28:45 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/07/05 06:28:45 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/07/05 06:28:40 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/07/05 06:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2011/07/04 18:00:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2011/07/04 18:00:17 | 000,000,000 | —D | C] – C:\Program Files\Recuva
[2011/07/04 18:00:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/07/02 06:26:41 | 000,000,000 | —D | C] – C:\NBRT

========== Files - Modified Within 30 Days ==========

[2011/07/09 21:31:53 | 000,679,678 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/09 21:31:53 | 000,130,040 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/09 21:27:31 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/09 21:27:09 | 268,435,456 | -HS- | M] () – C:\Windows\System32\temppf.sys
[2011/07/09 21:09:32 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2011/07/09 21:02:11 | 000,000,512 | —- | M] () – C:\Users\Shane\Desktop\MBR.dat
[2011/07/07 20:01:45 | 000,054,016 | —- | M] () – C:\Windows\System32\drivers\tbmlyorq.sys
[2011/07/07 19:32:15 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/07 18:18:34 | 000,000,007 | —- | M] () – C:\Users\Shane\Desktop\New Rich Text Document.rtf
[2011/07/07 17:53:44 | 004,135,577 | R— | M] (Swearware) – C:\Users\Shane\Desktop\ComboFix.exe
[2011/07/06 22:04:12 | 000,070,144 | —- | M] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/06 17:44:43 | 000,001,356 | —- | M] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/07/05 21:27:17 | 001,925,512 | —- | M] (AVAST Software) – C:\Users\Shane\Desktop\aswMBR.exe
[2011/07/05 21:08:59 | 000,000,000 | —- | M] () – C:\Users\Shane\defogger_reenable
[2011/07/05 07:34:13 | 000,625,664 | —- | M] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 07:32:42 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | M] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | M] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/26 07:45:56 | 000,256,000 | —- | M] () – C:\Windows\PEV.exe

========== Files Created - No Company Name ==========

[2011/07/09 21:02:11 | 000,000,512 | —- | C] () – C:\Users\Shane\Desktop\MBR.dat
[2011/07/07 20:01:45 | 000,054,016 | —- | C] () – C:\Windows\System32\drivers\tbmlyorq.sys
[2011/07/07 19:32:15 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/07 18:18:34 | 000,000,007 | —- | C] () – C:\Users\Shane\Desktop\New Rich Text Document.rtf
[2011/07/05 21:08:59 | 000,000,000 | —- | C] () – C:\Users\Shane\defogger_reenable
[2011/07/05 07:34:13 | 000,625,664 | —- | C] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 06:28:45 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/07/05 06:28:45 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/07/05 06:28:45 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/07/05 06:28:45 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/07/05 06:28:45 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | C] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | C] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/03 22:05:15 | 268,435,456 | -HS- | C] () – C:\Windows\System32\temppf.sys
[2011/04/19 23:19:22 | 000,175,616 | —- | C] () – C:\Windows\System32\unrar.dll
[2011/04/19 23:19:21 | 000,631,808 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/04/19 23:19:21 | 000,243,200 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/04/19 23:19:21 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2011/04/19 23:19:20 | 000,080,896 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2011/03/15 22:07:21 | 000,000,000 | —- | C] () – C:\Windows\System32\Access.dat
[2011/03/02 20:20:30 | 000,000,223 | —- | C] () – C:\Users\Shane\AppData\Roaming\burnaware.ini
[2011/02/27 22:05:33 | 000,138,056 | —- | C] () – C:\Users\Shane\AppData\Roaming\PnkBstrK.sys
[2011/02/27 22:04:56 | 002,434,856 | —- | C] () – C:\Windows\System32\pbsvc_bc2.exe
[2011/02/27 09:38:36 | 000,070,144 | —- | C] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/27 02:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/02/27 02:03:00 | 000,001,356 | —- | C] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/01/26 23:11:58 | 000,023,040 | —- | C] () – C:\Windows\System32\atitmpxx.dll
[2010/12/21 03:27:20 | 000,003,113 | —- | C] () – C:\Windows\System32\atipblag.dat
[2010/12/17 17:00:44 | 000,227,587 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2010/11/28 13:01:35 | 000,000,178 | —- | C] () – C:\Users\Shane\AppData\Roaming\default.rss
[2010/04/21 01:27:01 | 000,030,498 | -HS- | C] () – C:\Users\Shane\AppData\Local\J50Ev7evclyS4
[2009/08/06 23:55:36 | 001,871,758 | —- | C] () – C:\Users\Shane\AppData\Roaming\NMM-MetaData.db
[2009/08/04 22:59:28 | 000,000,036 | —- | C] () – C:\Users\Shane\AppData\Local\housecall.guid.cache
[2008/01/23 21:52:53 | 000,000,134 | —- | C] () – C:\Users\Shane\AppData\Roaming\AVSDVDPlayer.m3u
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,257,720 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,679,678 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,130,040 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 08:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 08:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin

< End of report >

Satchfan

Post #13July 10, 2011, 9:24 AM UTC last edited July 10, 2011, 9:36 AM UTC

Hope your daughter has had a good sleep and the GF not feeling too bad after the hen night

===================================================

The OTL fix log can be found at C:\_OTL\MovedFiles. The file name will consist of numbers that reflect the date and time the fix was run. It will be something like 09072011_111009.log. Please copy and paste the contents into your next reply

===================================================

Submit a file to VirusTotal

Go to VirusTotal and submit this file for analysis:

C:\Windows\System32\drivers\tbmlyorq.sys• click on Browse
• click on the arrow and choose Local Disc (C:)
🖼Click to load external image (Posted Image)
• below, double-click on Windows
• double-click on the System32folder and then the Drivers folder
• locate the file tbmlyorq.sys click on it and then on Open
• click on Send File.
You will get a report back; post the report into this thread for me to see.

===================================================

Run aswMBR

double click aswMBR.exe to run it
on completion of the scan click Save log
save it to your desktop and post in your next reply

===================================================

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :Reg [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"=- [-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [-HKEY_CLASSES_ROOT\Tracker Toolbar] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"=- :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

===================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include in next post:

aswMBR log
2 OTL fix logs
New OTL log
Mbam log

Please tell me how your computer is running now

Satchfan

dawooksta

Post #14July 10, 2011, 6:18 PM UTC

Hi Satchfan

The GF told me she was going to take it easy - yeah right…spent most of the morning groaning and bent over the toilet. I must admitt to getting some satisfaction after having no sympathy for years when I've been in a similar situation :-)

Here's the OTL log from yesterday. Todyas logs will follow in another post.

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
HKU\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\searchplugins folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\defaults\preferences folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\defaults folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\chrome\temp folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\chrome\skin folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\chrome\content folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]\chrome folder moved successfully.
C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed] folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-3774678942-341068382-2512915098-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
C:\ProgramData\~23256848r moved successfully.
C:\ProgramData\~23256848 moved successfully.
C:\ProgramData\23256848 moved successfully.
C:\Users\Shane\AppData\Local\s7846w86gi86yo4j3444wfp8hl moved successfully.
C:\ProgramData\s7846w86gi86yo4j3444wfp8hl moved successfully.
C:\Users\Shane\AppData\Roaming\610E.259 moved successfully.
C:\Users\Shane\AppData\Local\Djuja.dat moved successfully.
C:\Users\Shane\AppData\Local\Vziboqe.bin moved successfully.
C:\Users\Shane\AppData\Local\6a5067824fd3almxx8y1pfab70vt7oa2j152 moved successfully.
C:\ProgramData\6a5067824fd3almxx8y1pfab70vt7oa2j152 moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\xml\schemas folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\xml\misc folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\xml\data folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\xml folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\themes\frostwire_theme folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\themes folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\.NetworkShare\Incomplete folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire\.NetworkShare folder moved successfully.
C:\Users\Shane\AppData\Roaming\FrostWire folder moved successfully.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Shane\Desktop\cmd.bat deleted successfully.
C:\Users\Shane\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 2913 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Shane
->Flash cache emptied: 312595 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users
->Temp folder emptied: 74820 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Shane
->Temp folder emptied: 45044309 bytes
->Temporary Internet Files folder emptied: 60932470 bytes
->Java cache emptied: 69756743 bytes
->FireFox cache emptied: 264854544 bytes
->Google Chrome cache emptied: 1905008 bytes
->Apple Safari cache emptied: 6583296 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2242 bytes
RecycleBin emptied: 607017 bytes

Total Files Cleaned = 429.00 mb

OTL by OldTimer - Version 3.2.26.0 log created on 07092011_210927

Satchfan

Post #15July 10, 2011, 10:37 PM UTC

Todyas logs will follow in another post.

Who was out last night?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please help - possible tdss.serv infection

✨ Ask AI

Ask AI