Possible rootkits and computer very slow

galaxy Topic Starter

Post #1September 30, 2011, 4:17 AM UTC last edited October 3, 2011, 7:11 PM UTC

Greetings,

My computer is very slow under the administrator login while it works fine on the other login that I have. I am attaching my OTL. It did not save any Extras on my desktop as the instructions say. I started a similar topic for the same computer more than a month ago on this forum:

http://forums.whatthetech.com/index.php?sh…=119886&hl;=

The last post by mowman on this topic was to run combofix. I want to mention that when I ran it, it would never finish. It would just stall and at one point it was stalled overnight and I had manually shut down the computer in the morning. It worked after that restart. I had to go on a business trip and I couldn't reply in time before the topic is closed. I am sure this time I am on a better schedule to have it fixed. Please help.

OTL logfile created on: 9/29/2011 11:53:24 PM - Run 2
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Sameen\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 0.94 Gb Available Physical Memory | 47.10% Memory free
4.21 Gb Paging File | 2.81 Gb Available in Paging File | 66.67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.91 Gb Total Space | 8.30 Gb Free Space | 5.85% Space Free | Partition Type: NTFS

Computer Name: FARAHSIDDIQU-PC | User Name: Farah Siddiqui | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Sameen\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\AIM\aim.exe (AOL Inc.)
PRC - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\TeamViewer3\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AIM\nssckbi.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Nokia\Nokia PC Suite 7\QtCore4.dll ()
MOD - C:\Program Files\Nokia\Nokia PC Suite 7\imageformats\qsvg4.dll ()
MOD - C:\Program Files\Nokia\Nokia PC Suite 7\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Nokia\Nokia PC Suite 7\QtSvg4.dll ()
MOD - C:\Program Files\Nokia\Nokia PC Suite 7\QtGUI4.dll ()
MOD - C:\Program Files\Nokia\Nokia PC Suite 7\QtXml4.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll ()
MOD - C:\Windows\System32\igfxTMM.dll ()
MOD - C:\Program Files\ArcSoft\Software Suite\PhotoImpression\Share\PIHook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (TeamViewer) – C:\Program Files\TeamViewer3\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (VAIO Event Service) – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (ICScsiSV) – C:\Program Files\Sony\Image Converter 3\ICScsiSV.exe (Sony Corporation)
SRV - (IcVzMonLauncher) – C:\Program Files\Sony\Image Converter 3\IcVzMonLauncher.exe (Sony Corporation)
SRV - (Image Converter video recording monitor for VAIO Entertainment) – C:\Program Files\Sony\Image Converter 3\IcVzMon.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (IviRegMgr) – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (MSCSPTISRV) – C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) – C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) – C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
SRV - (Vcsw) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VzFw) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
SRV - (VzCdbSvc) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)

========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\Users\Farah Siddiqui\AppData\Local\Temp\catchme.sys ()
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (sscemdm) – C:\Windows\System32\drivers\sscemdm.sys (MCCI Corporation)
DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) – C:\Windows\System32\drivers\sscebus.sys (MCCI Corporation)
DRV - (sscemdfl) – C:\Windows\System32\drivers\sscemdfl.sys (MCCI Corporation)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (ti21sony) – C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (SonyImgF) – C:\Windows\System32\drivers\SonyImgF.sys (Sony Corporation)
DRV - (R5U870FLx86) – C:\Windows\System32\drivers\R5U870FLx86.sys (Ricoh)
DRV - (R5U870FUx86) – C:\Windows\System32\drivers\R5U870FUx86.sys (Ricoh)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (SNC) – C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation)
DRV - (regi) – C:\Windows\System32\drivers\regi.sys (InterVideo)
DRV - (DMICall) – C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (Afc) – C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (pfc) – C:\Windows\System32\drivers\pfc.sys (Padus, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.723
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {1C0B2648-5A20-4AAB-90EB-FFCA494348A9}:1.9.1
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.1: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2010/03/24 21:02:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011/09/26 15:47:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2011/09/29 23:39:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/04 21:20:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/09 21:05:29 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{f6bf92e0-b190-11dd-ad8b-0800200c9a68}: C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Firefox\Profiles\cw5qmqwr.default\extensions\{f6bf92e0-b190-11dd-ad8b-0800200c9a68}
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ddb7e7f0-96e4-11dd-ad8b-0800200c9a66}: C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Firefox\Profiles\cw5qmqwr.default\extensions\{ddb7e7f0-96e4-11dd-ad8b-0800200c9a66}
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1C0B2648-5A20-4AAB-90EB-FFCA494348A9}: C:\Users\Farah Siddiqui\AppData\Local\{1C0B2648-5A20-4AAB-90EB-FFCA494348A9} [2011/04/24 20:19:44 | 000,000,000 | —D | M]

[2009/10/01 23:32:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Extensions
[2009/01/29 22:24:08 | 000,000,000 | —D | M] (No name found) – C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/05/09 20:35:44 | 000,000,000 | —D | M] (No name found) – C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Firefox\Profiles\cw5qmqwr.default\extensions
[2009/07/08 05:06:07 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Firefox\Profiles\cw5qmqwr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/06/14 22:45:54 | 000,000,310 | —- | M] () – C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Firefox\Profiles\cw5qmqwr.default\searchplugins\aim-search.xml
[2009/11/08 11:20:52 | 000,002,171 | —- | M] () – C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\Firefox\Profiles\cw5qmqwr.default\searchplugins\bing.xml
[2011/09/27 22:50:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/09/27 22:50:27 | 000,000,000 | —D | M] (Click to call with Skype) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/04/24 20:19:44 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\FARAH SIDDIQUI\APPDATA\LOCAL\{1C0B2648-5A20-4AAB-90EB-FFCA494348A9}
[2011/07/04 21:20:27 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/14 14:01:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\mozilla firefox\components\Scriptff.dll
[2007/04/16 13:07:12 | 000,180,293 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npViewpoint.dll
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/02 22:26:23 | 000,001,949 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.60\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.190.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U19 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.60\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.60\gears.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
CHR - plugin: ActiveTouch General Plugin Container (Enabled) = C:\Users\Farah Siddiqui\AppData\Roaming\Mozilla\plugins\npatgpc.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealNetworks Rhapsody Player Engine (Enabled) = C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Entanglement = C:\Users\Farah Siddiqui\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.1.1_0\
CHR - Extension: Poppit = C:\Users\Farah Siddiqui\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

Hosts file not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20110922192343.dll (McAfee, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation)
O4 - HKLM..\Run: [VAIOSecurity] C:\Program Files\Sony\VAIO Security Center\VSC.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [1735190412] C:\Users\Farah Siddiqui\AppData\Local\ssn.exe File not found
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe File not found
O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [Security Protection] C:\Users\Farah Siddiqui\AppData\Roaming\defender.exe File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Transfer by Image Converter 3 - C:\Program Files\Sony\Image Converter 3\menu.htm ()
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{02F566D1-99A5-4755-B2F2-89DA15B95B15}: DhcpNameServer = 192.168.1.1 [removed]
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Farah Siddiqui\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Farah Siddiqui\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{2e53c86e-e287-11dc-83d6-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{2e53c86e-e287-11dc-83d6-0013a9f15182}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{4d87b7ab-2322-11df-81e1-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{4d87b7ab-2322-11df-81e1-0013a9f15182}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{8b44bc09-7807-11dc-9e45-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{8b44bc09-7807-11dc-9e45-0013a9f15182}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{ab71b122-0d1c-11df-a4aa-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{ab71b122-0d1c-11df-a4aa-0013a9f15182}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell\Auto\command - "" = setup.exe
O33 - MountPoints2\F\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (SsiEfr.exe)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.dvsd - C:\Program Files\Common Files\Sony Shared\VideoLib\sonydv.dll (Sony Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/29 23:37:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011/09/28 21:25:11 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/09/27 23:21:08 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/09/27 23:21:08 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/09/27 23:21:08 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/09/27 23:20:50 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/09/27 22:49:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/09/27 22:42:29 | 000,000,000 | —D | C] – C:\Qoobox
[2011/09/22 19:21:44 | 000,180,072 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeavfk.sys
[2011/09/14 00:06:33 | 000,000,000 | —D | C] – C:\cccd5645e53cd7bbcbbf8547a0
[2011/09/11 23:29:12 | 000,000,000 | —D | C] – C:\Users\Farah Siddiqui\Desktop\HAP 645
[2011/09/11 23:29:03 | 000,000,000 | —D | C] – C:\Users\Farah Siddiqui\Desktop\HAP 651
[2 C:\Users\Farah Siddiqui\Desktop\*.tmp files -> C:\Users\Farah Siddiqui\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Farah Siddiqui\Documents\*.tmp files -> C:\Users\Farah Siddiqui\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/29 23:35:09 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/29 23:34:44 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/29 23:34:44 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/29 23:34:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/09/29 15:29:15 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/19 19:16:21 | 000,000,104 | —- | M] () – C:\Users\Farah Siddiqui\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet - Shortcut.lnk
[2011/09/15 15:03:55 | 000,053,248 | —- | M] () – C:\Users\Farah Siddiqui\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/14 00:00:54 | 000,660,446 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/09/14 00:00:54 | 000,126,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[2 C:\Users\Farah Siddiqui\Desktop\*.tmp files -> C:\Users\Farah Siddiqui\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Farah Siddiqui\Documents\*.tmp files -> C:\Users\Farah Siddiqui\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/27 23:21:08 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/09/27 23:21:08 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/09/27 23:21:08 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/09/27 23:21:08 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/09/27 23:21:08 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/09/19 19:16:21 | 000,000,104 | —- | C] () – C:\Users\Farah Siddiqui\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet - Shortcut.lnk
[2011/07/04 21:19:11 | 000,011,720 | -HS- | C] () – C:\Users\Farah Siddiqui\AppData\Local\7q4da2444o4nswy
[2011/07/04 21:19:11 | 000,011,720 | -HS- | C] () – C:\ProgramData\7q4da2444o4nswy
[2011/05/13 14:58:43 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2011/04/24 20:19:54 | 000,000,000 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\Tluxag.bin
[2011/04/24 20:19:53 | 000,000,120 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\Izohequbef.dat
[2010/12/20 01:03:14 | 000,027,043 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Roaming\UserTile.png
[2010/07/03 13:28:36 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/10/12 20:44:09 | 000,000,112 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Roaming\wklnhst.dat
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/31 20:12:44 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/07/31 20:12:44 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/03/05 12:41:15 | 000,000,552 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\d3d8caps.dat
[2009/01/14 18:28:23 | 000,000,011 | —- | C] () – C:\Windows\OSA.INI
[2008/09/05 08:10:48 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/08/26 18:10:25 | 000,000,000 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\prvlcl.dat
[2008/08/03 01:16:57 | 000,139,788 | —- | C] () – C:\Windows\hpoins15.dat
[2008/08/03 01:16:57 | 000,001,039 | —- | C] () – C:\Windows\hpomdl15.dat
[2008/05/25 10:17:37 | 000,001,356 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\d3d9caps.dat
[2007/10/25 17:26:10 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2007/09/07 00:59:59 | 000,001,165 | —- | C] () – C:\Windows\mozver.dat
[2007/08/23 21:00:25 | 000,053,248 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/08/22 14:07:01 | 000,000,510 | —- | C] () – C:\Windows\ODBC.INI
[2007/08/20 14:26:37 | 000,000,335 | —- | C] () – C:\Windows\nsreg.dat
[2007/08/20 00:07:01 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2007/08/20 00:07:00 | 000,111,932 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2007/08/20 00:07:00 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2007/08/20 00:07:00 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2007/08/20 00:07:00 | 000,026,154 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2007/08/20 00:07:00 | 000,024,903 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2007/08/20 00:07:00 | 000,021,390 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2007/08/20 00:07:00 | 000,020,148 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2007/08/20 00:07:00 | 000,011,811 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2007/08/20 00:07:00 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2007/08/20 00:07:00 | 000,001,146 | —- | C] () – C:\Windows\System32\EPPICPresetData_DU.dat
[2007/08/20 00:07:00 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2007/08/20 00:07:00 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2007/08/20 00:07:00 | 000,001,136 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2007/08/20 00:07:00 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2007/08/20 00:07:00 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2007/08/20 00:07:00 | 000,001,120 | —- | C] () – C:\Windows\System32\EPPICPresetData_IT.dat
[2007/08/20 00:07:00 | 000,001,107 | —- | C] () – C:\Windows\System32\EPPICPresetData_GE.dat
[2007/08/20 00:07:00 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2007/05/19 09:12:38 | 000,019,968 | —- | C] () – C:\Windows\System32\Cpuinf32.dll
[2007/05/19 08:59:35 | 000,532,480 | —- | C] () – C:\Windows\System32\CddbPlaylist2Sony.dll
[2007/05/03 15:26:45 | 000,000,000 | —- | C] () – C:\Windows\VAIOUpdt.INI
[2007/05/03 14:48:06 | 000,000,031 | —- | C] () – C:\Windows\System32\elcric.dat
[2007/05/03 13:37:57 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2007/05/03 13:35:17 | 000,910,304 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2007/05/03 13:35:17 | 000,249,856 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2007/05/03 13:35:17 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1230.dll
[2006/11/02 08:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,385,320 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,660,446 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,126,350 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/04/30 20:02:32 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\804C226038464C2ED867D0559D635CF5
[2007/08/20 21:26:26 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\acccore
[2011/04/10 12:06:46 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Arwe
[2009/03/05 01:31:36 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\DAEMON Tools Pro
[2010/01/28 22:06:47 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\GetRightToGo
[2007/09/02 22:00:22 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\InterVideo
[2009/10/26 19:25:12 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Juniper Networks
[2010/07/23 00:01:19 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Nokia
[2007/08/20 21:59:21 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Panasonic
[2010/03/24 22:28:01 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\PC Suite
[2010/12/20 01:03:13 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\PeerNetworking
[2011/04/30 20:02:33 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Qusi
[2011/07/26 15:59:07 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Samsung
[2010/04/17 12:58:34 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Save
[2008/12/06 15:50:15 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\TeamViewer
[2009/10/12 20:44:17 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\Template
[2007/08/22 14:10:14 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\VSO
[2010/04/23 16:58:54 | 000,000,000 | —D | M] – C:\Users\Farah Siddiqui\AppData\Roaming\webex
[2011/09/28 18:11:17 | 000,032,646 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/12/15 03:32:49 | 000,000,440 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{5C606944-8435-4009-A2B0-0557C93411E2}.job
[2010/12/15 03:24:59 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{6BB66262-F182-4ED1-A8B8-5EFA96E7E1D4}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 17:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2007/05/03 14:02:39 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2005/01/03 09:37:18 | 000,000,017 | -H– | M] () – C:\initrd.pam
[2009/01/14 18:26:54 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/02/21 02:07:39 | 000,001,642 | -H– | M] () – C:\IPH.PH
[2007/01/15 21:13:14 | 000,000,068 | -H– | M] () – C:\kernel.pam
[2009/01/14 18:26:54 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/11/10 13:37:22 | 000,000,938 | —- | M] () – C:\MUST_Update_Verification_Log.txt
[2011/09/29 23:34:33 | 2451,243,008 | -HS- | M] () – C:\pagefile.sys
[2008/01/11 15:01:35 | 000,000,000 | -H– | M] () – C:\ProgramData.LOG1
[2008/01/11 15:01:35 | 000,000,000 | -H– | M] () – C:\ProgramData.LOG2
[2011/01/26 18:37:19 | 000,000,370 | —- | M] () – C:\rkill.log
[2007/09/07 02:14:18 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2007/09/15 20:21:30 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2007/09/15 20:38:46 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2007/09/29 13:50:49 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2007/10/23 11:01:57 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2007/10/29 23:38:21 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2007/11/04 01:56:01 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2007/11/08 04:48:18 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2007/08/31 00:50:17 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2007/08/31 18:15:10 | 000,000,268 | -H– | M] () – C:\sqmdata09.sqm
[2007/09/02 10:55:44 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2007/09/02 12:16:45 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2007/09/02 22:45:43 | 000,000,268 | -H– | M] () – C:\sqmdata12.sqm
[2007/09/03 01:38:38 | 000,000,268 | -H– | M] () – C:\sqmdata13.sqm
[2007/09/03 01:56:19 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2007/09/04 03:07:42 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2007/09/04 10:45:52 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2007/09/04 18:58:34 | 000,000,268 | -H– | M] () – C:\sqmdata17.sqm
[2007/09/05 14:40:33 | 000,000,268 | -H– | M] () – C:\sqmdata18.sqm
[2007/09/05 21:12:27 | 000,000,268 | -H– | M] () – C:\sqmdata19.sqm
[2007/09/07 02:14:18 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2007/09/15 20:21:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2007/09/15 20:38:46 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2007/09/29 13:50:49 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2007/10/23 11:01:57 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2007/10/29 23:38:20 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2007/11/04 01:56:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2007/11/08 04:48:17 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2007/08/31 00:50:17 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2007/08/31 18:15:10 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2007/09/02 10:55:44 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2007/09/02 12:16:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2007/09/02 22:45:43 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2007/09/03 01:38:38 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2007/09/03 01:56:19 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2007/09/04 03:07:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2007/09/04 10:45:52 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2007/09/04 18:58:34 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2007/09/05 14:40:33 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2007/09/05 21:12:27 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2009/12/05 19:51:13 | 000,000,000 | —- | M] () – C:\t1fg.1
[2011/08/11 18:51:44 | 000,133,378 | —- | M] () – C:\TDSSKiller.2.5.15.0_11.08.2011_18.44.20_log.txt
[2007/05/19 09:20:43 | 000,390,034 | —- | M] () – C:\vcredist_x86.log
[2008/08/29 00:08:41 | 000,000,144 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/11/02 17:41:15 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/03/28 13:57:34 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpzpp5ha.dll
[2008/01/19 03:34:28 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 01:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/09/04 07:05:41 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 06:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 06:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 06:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/03 19:56:14 | 000,000,286 | -HS- | M] () – C:\Users\Farah Siddiqui\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 2
"UseWUServer" = 0
"RescheduleWaitTime" = 30
"NoAutoRebootWithLoggedOnUsers" = 0

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-09-28 19:24:31

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:A8ADE5D8

< End of report >

Attachments:

📎OTL.Txt

mowman

Post #2October 1, 2011, 2:43 PM UTC

Hello again,please delete the copy of Combofix you have and download a fresh one from the links below,post the log please.

Link 1
Link 2

The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

galaxy

Post #3October 3, 2011, 6:09 AM UTC

I tried running a fresh copy of combofix but it had my computer stalled for 1.5 hours and then I manually shut it down and restarted it. It works the same. Once I start combofix, it doesn't go past to another screen or anything of the sotr. It just stays there. Any advice on how to get it run or if we can try somethign else?

mowman

Post #4October 3, 2011, 7:06 PM UTC

Try to run it in safe mode.

Boot into Safe Mode using the following method
Reboot the system. As soon as system starts up repeatedly tap the F8 Function key.
Once you have Advanced Bootup Options menu, select Safe Mode

galaxy

Post #5October 6, 2011, 1:09 PM UTC

Please give me two more days.

galaxy

Post #6October 9, 2011, 6:07 AM UTC

I ran combofix on safe mode. It went further than it did earlier running on normal settings. However, it said it is preparing a log file and that's when it froze. I waited more than an hour for it to pass but it did not do anything. I shut down the computer and turned it back on but nothing was saved on the desktop (where I had saved combofix). The computer is running as usual. Very slow on administrator login and I can't browse the internet or use any messengers. I am not able to use some applications either.

mowman

Post #7October 9, 2011, 2:12 PM UTC

See if you can find the log from Combofix,it should be at C:\ Combofix.txt

Drive C: | 141.91 Gb Total Space | 8.30 Gb Free Space | 5.85% Space Free | Partition Type: NTFS

You do not have enough free space on your hard drive,remove any unused programs,etc as this will slow down your machine.

galaxy

Post #8October 12, 2011, 6:11 AM UTC

No, I couldn't find it at all. I searched for it using search and manually looked into the folders where combofix is downloaded. I went ahead with show hidden files and folders and I still couldn't find it. I logged into the infected account from safe mode and ran the combofix again. I ran the most updated version that you give me recently. The blue screen came up and the computer froze for 1.5 hours. I have tried running combofix at least 8-10 times and it has consumed a lot of my time but to no avail. Please suggest something else so I can run that. Thanks a lot for sticking with me on this one.

mowman

Post #9October 12, 2011, 9:18 AM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Otl
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKCU..\Run: [1735190412] C:\Users\Farah Siddiqui\AppData\Local\ssn.exe File not found
O33 - MountPoints2\{2e53c86e-e287-11dc-83d6-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{2e53c86e-e287-11dc-83d6-0013a9f15182}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{4d87b7ab-2322-11df-81e1-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{4d87b7ab-2322-11df-81e1-0013a9f15182}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{8b44bc09-7807-11dc-9e45-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{8b44bc09-7807-11dc-9e45-0013a9f15182}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{ab71b122-0d1c-11df-a4aa-0013a9f15182}\Shell - "" = AutoRun
O33 - MountPoints2\{ab71b122-0d1c-11df-a4aa-0013a9f15182}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell\Auto\command - "" = setup.exe
O33 - MountPoints2\F\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
[2011/07/04 21:19:11 | 000,011,720 | -HS- | C] () – C:\Users\Farah Siddiqui\AppData\Local\7q4da2444o4nswy
[2011/07/04 21:19:11 | 000,011,720 | -HS- | C] () – C:\ProgramData\7q4da2444o4nswy
[2011/04/24 20:19:54 | 000,000,000 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\Tluxag.bin
[2011/04/24 20:19:53 | 000,000,120 | —- | C] () – C:\Users\Farah Siddiqui\AppData\Local\Izohequbef.dat


:Commands
[resethosts]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Also tell me how the computer is running now.

galaxy

Post #10October 16, 2011, 7:51 AM UTC

Please give me 2-3 days.

mowman

Post #11October 16, 2011, 4:06 PM UTC

Ok.

galaxy

Post #12October 21, 2011, 5:56 PM UTC

I will have the logs during this weekend. Please don't close the topic without confirming with me. I am trying my best to find time out for the logs.

mowman

Post #13November 2, 2011, 3:44 PM UTC

It has been 3 weeks since my last instructions,please post the logs in the next 3 days or I will have to close this topic.

mowman

Post #14November 5, 2011, 11:47 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

✨ Ask AI

Ask AI