What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My pc is infected [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi jeff, I followed your instructions but once i drag and drip CFScript.txt into the combofix icon it starts to run and then says "were you trying to run CFScript" The name CFScript appears to be incorrectly spelt! Any ideas why it is not working??? Cheers Dom
Post #17
Hi dom,

Please delete your copy of ComboFix and download a fresh copy from:
Link 1
Link 2

Once you get that downloaded attempt to run the script I provided you again. :)
Post #18
Hello again Jeffce, Tha same thing is happening….CFScript is spelt incorrectly. I tried both links and i created a new CFScript txt file but get the same result.
Post #19
Hi dom,

I would like for you to remove your copy of ComboFix from your Desktop and place it in your C:\ folder and then do the same for the ComboFix script we created. Once they are both there, please attempt to run the ComboFix script again. :)
Post #21
Hi dom, Ok…you are on a Vista operating system so this means that you will have to have administrator rights to do this. You are logged in as an Administrator or your account has administrator rights correct? :) ———- You are correct at where I want you to copy/paste ComboFix. Open your C:\ folder (where your operating system is) and then copy and paste ComboFix in there. If you still have problems we can go another way. :thumbup:
Post #22
Hi Jeffce, sorry for the delay. here is the requested log

ComboFix 11-12-05.01 - DOM&EDYTA 05/12/2011 15:08:19.2.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2813.1689 [GMT 0:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\CFScript.txt.txt
AV: Virgin Media Security Anti-Virus *Disabled/Updated* {A61154FD-4365-E00F-9A33-13A09AD54B56}
FW: Virgin Media Security Firewall *Disabled* {9E2AD5D8-090A-E157-B16C-BA9564060C2D}
SP: Virgin Media Security Anti-Spyware *Disabled/Updated* {1D70B519-655F-EF81-A083-28D2E15201EB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\Ask.com\GenericAskToolbar.dll"
"c:\users\DOM&EDYTA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini"
"c:\users\DOM&EDYTA\AppData\Roaming\inst.exe"
"c:\users\DOM&EDYTA\AppData\Roaming\pcouffin.cat"
"c:\users\DOM&EDYTA\AppData\Roaming\pcouffin.inf"
"c:\windows\System32\BMXState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx"
"c:\windows\System32\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx"
"c:\windows\System32\DVCState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe
c:\users\DOM&EDYTA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
c:\users\DOM&EDYTA\AppData\Roaming\inst.exe
c:\users\DOM&EDYTA\AppData\Roaming\pcouffin.cat
c:\users\DOM&EDYTA\AppData\Roaming\pcouffin.inf
c:\windows\System32\BMXState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
c:\windows\System32\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
c:\windows\System32\DVCState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
.
.
((((((((((((((((((((((((( Files Created from 2011-11-05 to 2011-12-05 )))))))))))))))))))))))))))))))
.
.
2011-12-05 15:21 . 2011-12-05 15:21 ——– d—–w- c:\users\DOM&EDYTA\AppData\Local\temp
2011-12-05 15:21 . 2011-12-05 15:21 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-05 14:55 . 2011-12-05 14:55 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EECB0C4A-DD18-4175-A517-2D535EEB954A}\offreg.dll
2011-12-03 01:00 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EECB0C4A-DD18-4175-A517-2D535EEB954A}\mpengine.dll
2011-11-25 14:28 . 2011-11-25 14:28 388096 —-a-r- c:\users\DOM&EDYTA\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-24 23:21 . 2011-11-24 23:21 ——– d—–w- c:\program files\iPod
2011-11-24 23:21 . 2011-11-24 23:22 ——– d—–w- c:\program files\iTunes
2011-11-16 00:22 . 2009-06-30 10:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-11-09 03:03 . 2011-11-09 03:03 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-11-09 03:03 . 2011-11-09 03:03 ——– d—–w- c:\program files\QuickTime
2011-11-08 23:52 . 2011-10-17 11:41 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-11-08 23:52 . 2011-09-20 21:02 905088 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-08 23:52 . 2011-09-30 15:57 707584 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-07 21:28 . 2011-11-07 21:28 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-08 01:08 . 2011-06-17 22:29 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-24 14:29 . 2011-10-24 14:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 14:29 . 2011-10-24 14:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-03 05:06 . 2010-05-16 16:15 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-01 14:24 . 2011-10-01 14:24 53192 —-a-w- c:\windows\system32\drivers\rp_skt32.sys
2011-10-01 14:23 . 2011-10-01 14:24 48384 —-a-w- c:\windows\system32\drivers\rp_pkt32.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" [2008-05-30 110592]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-25 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Bluetooth HCI Monitor"="HCIMNTR.DLL" [2006-12-07 9728]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13531680]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-01-03 184864]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-06-03 25600]
"ServiceManager.exe"="c:\program files\Virgin Media\Service Manager\ServiceManager.exe" [2011-03-25 4371768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-13 715568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Radialpoint Security Services]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^DOM&EDYTA^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\DOM&EDYTA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 11:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-09-27 06:22 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DHSClient.exe]
2011-03-23 13:12 2032952 —-a-w- c:\program files\Virgin Media\Digital Home Support\DHSClient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-09-25 01:14 29744 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 11:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-11-13 00:24 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-07-26 19:23 958352 —-a-w- c:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2011-07-26 19:23 20880 —-a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-07-26 19:23 3507088 —-a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-08-31 16:00 449608 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-08-31 16:00 1047208 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-10 01:54 4240760 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 14:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-06-15 14:02 15141768 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-09-25 01:14 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9f379c900cf25;Google Update Service (gupdate1c9f379c900cf25);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
R3 Creative ALchemy AL1 Licensing Service;Creative ALchemy AL1 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL1Licensing.exe [2008-09-25 79360]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2009-06-03 171032]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2009-06-03 1324056]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2009-06-03 72728]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-07-20 77624]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2009-07-18 47360]
R3 RapportKELL;RapportKELL;c:\windows\system32\Drivers\RapportKELL.sys [2011-11-07 56208]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-07-20 181432]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2009-11-02 25608]
S1 RapportBuka;RapportBuka;c:\windows\system32\drivers\RapportBuka.sys [2010-02-25 390528]
S1 RapportCerberus_32301;RapportCerberus_32301;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys [2011-11-07 227312]
S1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2011-11-07 71440]
S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2011-11-07 164112]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 HsdService;HsdService;c:\program files\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Radialpoint Security Services;Virgin Media Security;c:\program files\Virgin Media\Security\RpsSecurityAwareR.exe [2010-01-04 165408]
S2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe RadialpointIDSAgent [x]
S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-11-07 931640]
S2 ServicepointService;ServicepointService;c:\program files\Virgin Media\Service Manager\ServicepointService.exe [2011-03-25 689464]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2009-06-03 171032]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2009-06-03 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2009-06-03 72728]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [2009-11-02 122376]
S3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSFilter.sys [2009-11-02 30216]
S3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys [2009-11-02 27800]
S3 RapportIaso;RapportIaso;c:\programdata\trusteer\rapport\store\exts\rapportms\28896\rapportiaso.sys [2011-08-08 21520]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 4875C546
*NewlyCreated* - 731BC824
*Deregistered* - 4875c546
*Deregistered* - 731bc824
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bdx REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-25 09:20]
.
2011-12-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 20:41]
.
2011-12-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-22 20:41]
.
2011-12-03 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]
.
2011-12-05 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.bbc.co.uk/news/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-05 15:21
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-12-05 15:24:10
ComboFix-quarantined-files.txt 2011-12-05 15:24
ComboFix2.txt 2011-12-01 19:01
.
Pre-Run: 611,058,950,144 bytes free
Post-Run: 611,018,653,696 bytes free
.
- - End Of File - - 2EFC9CAC600AF941D40AEB29FE6E4959
Post #23
Hi dom,

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.


  • Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
———-

In your next reply please post the logs created by Malwarebytes and ESET online scanner. :)
Post #24
Hey Jeffce here are the Logs as requested Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8323 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 06/12/2011 15:37:22 mbam-log-2011-12-06 (15-37-22).txt Scan type: Quick scan Objects scanned: 173434 Time elapsed: 4 minute(s), 3 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESETScan C:\Users\DOM&EDYTA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\1829cae4-4535c711 a variant of Java/TrojanDownloader.OpenConnection.AQ trojan I hope I did this correctly Regards Dom
Post #25
Hi dom,

Yep…you did that just fine. :thumbup:
————–

Please download JavaRa to your desktop and unzip it to its own
folder
  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
    click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
    Java Runtime Environment (JRE) version for your computer.
———-

After you get that completed please run a fresh scan with OTL and post the results into your next reply. :)
Post #26
Fresh OTL Reoprt


OTL logfile created on: 06/12/2011 20:57:11 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\DOM&EDYTA;\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 37.50% Memory free
5.71 Gb Paging File | 3.62 Gb Available in Paging File | 63.39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 921.44 Gb Total Space | 567.40 Gb Free Space | 61.58% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.82 Gb Free Space | 48.18% Space Free | Partition Type: NTFS

Computer Name: DOM-PC | User Name: DOM&EDYTA; | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\DOM&EDYTA;\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil11c_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe (Radialpoint Inc.)
PRC - C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Service Manager\ServiceManagerComHandler.exe (Radialpoint Inc.)
PRC - C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe (Virgin Media)
PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files\Virgin Media\Security\RPS.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Security\RpsSecurityAwareR.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Security\Fws.exe (Virgin Media)
PRC - C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
PRC - C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)
PRC - C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Trusteer\Rapport\bin\js32.dll ()
MOD - C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\28896\RapportMS.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\APOMngr.DLL ()
MOD - C:\Windows\System32\CmdRtr.DLL ()
MOD - C:\Windows\CTXFIRES.DLL ()
MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\Windows\System32\btwhidcs.dll ()


========== Win32 Services (SafeList) ==========

SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (scan) – C:\Program Files\Virgin Media\Security\BitDefender\scan.dll (S.C. BitDefender S.R.L)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ServicepointService) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe (Radialpoint Inc.)
SRV - (HsdService) – C:\Program Files\Virgin Media\Digital Home Support\HsdService.exe (Virgin Media)
SRV - (NAUpdate) – C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (Radialpoint Security Services) – C:\Program Files\Virgin Media\Security\RpsSecurityAwareR.exe (Virgin Media)
SRV - (RP_FWS) – C:\Program Files\Virgin Media\Security\Fws.exe (Virgin Media)
SRV - (RadialpointIDSAgent) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (PDEngine) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
SRV - (PDAgent) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
SRV - (Creative ALchemy AL1 Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (nTuneService) – C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (libusbd) – C:\Windows\System32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Driver Services (SafeList) ==========

DRV - (RapportCerberus_32301) – C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys ()
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\Windows\System32\drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (RPSKT) Security Services Driver (x86) – C:\Windows\System32\drivers\rp_skt32.sys (Radialpoint Inc.)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (RapportIaso) – c:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\28896\RapportIaso.sys (Trusteer Ltd.)
DRV - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) – C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (RapportBuka) – C:\Windows\System32\drivers\RapportBuka.sys (Trusteer Ltd.)
DRV - (Trufos) – C:\Program Files\Virgin Media\Security\BitDefender\trufos.sys (BitDefender S.R.L.)
DRV - (Profos) – C:\Program Files\Virgin Media\Security\BitDefender\profos.sys (BitDefender S.R.L.)
DRV - (RadialpointIDSDriver) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys (AVG Technologies )
DRV - (RadialpointIDSFilter) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys (AVG Technologies )
DRV - (RadialpointIDSShim) – C:\Program Files\Virgin Media\Security\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys (AVG Technologies )
DRV - (RadialpointIDSEH) – C:\Windows\system32\drivers\AVGIDSEH.sys (AVG Technologies )
DRV - (bdfsfltr) – C:\Windows\system32\drivers\bdfsfltr.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (pavboot) – C:\Windows\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (DefragFS) – C:\Windows\System32\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV - (ha20x2k) – C:\Windows\System32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTEXFIFX.SYS) – C:\Windows\System32\drivers\CTEXFIFX.SYS (Creative Technology Ltd.)
DRV - (CTEXFIFX) – C:\Windows\System32\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV - (CTHWIUT.SYS) – C:\Windows\System32\drivers\CTHWIUT.SYS (Creative Technology Ltd.)
DRV - (CTHWIUT) – C:\Windows\System32\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV - (CT20XUT.SYS) – C:\Windows\System32\drivers\CT20XUT.SYS (Creative Technology Ltd.)
DRV - (CT20XUT) – C:\Windows\System32\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (NVR0Dev) – C:\Windows\nvoclock.sys (NVidia Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (NWADI) – C:\Windows\System32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort) – C:\Windows\System32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\Windows\System32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)
DRV - (ElbyDelay) – C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (libusb0) – C:\Windows\System32\drivers\libusb0.sys ()
DRV - (Afc) – C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (ASPI32) – C:\Windows\System32\drivers\ASPI32.SYS (Adaptec)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/news/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\gcswf32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.106\pdf.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/12/05 15:21:39 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [Bluetooth HCI Monitor] C:\Windows\System32\HCIMNTR.DLL (Logitech Inc.)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [NVIDIA nTune] C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe (NVIDIA)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F2CB22CF-5321-40F2-A621-99E752E4851B}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\DOM&EDYTA;\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\DOM&EDYTA;\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (PDBoot.exe)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/06 20:41:15 | 000,000,000 | —D | C] – C:\Users\DOM&EDYTA;\Desktop\JavaRa
[2011/12/06 15:41:50 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/12/05 15:24:15 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/05 15:24:12 | 000,000,000 | —D | C] – C:\Users\DOM&EDYTA;\AppData\Local\temp
[2011/12/05 15:04:49 | 000,000,000 | —D | C] – C:\ComboFix
[2011/12/05 15:03:07 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/12/05 15:02:24 | 004,327,724 | R— | C] (Swearware) – C:\ComboFix.exe
[2011/12/05 14:43:21 | 004,327,724 | R— | C] (Swearware) – C:\Users\DOM&EDYTA;\Desktop\ComboFix.exe
[2011/12/01 18:20:12 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/12/01 18:20:12 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/12/01 18:20:05 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/12/01 18:20:00 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/01 15:31:00 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\DOM&EDYTA;\Desktop\OTL.exe
[2011/11/24 23:22:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/11/24 23:21:30 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/11/24 23:21:28 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/11/21 20:36:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011/11/16 00:22:02 | 000,028,552 | —- | C] (Panda Security, S.L.) – C:\Windows\System32\drivers\pavboot.sys
[2011/11/15 13:34:04 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/11/15 13:34:04 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/11/15 13:34:04 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/11/09 03:03:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/11/09 03:03:07 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/11/07 21:28:38 | 000,056,208 | —- | C] (Trusteer Ltd.) – C:\Windows\System32\drivers\RapportKELL.sys
[2009/07/18 18:12:41 | 000,047,360 | —- | C] (VSO Software) – C:\Users\DOM&EDYTA;\AppData\Roaming\pcouffin.sys
[2009/06/03 12:21:54 | 000,060,928 | —- | C] ( ) – C:\Windows\System32\a3d.dll
[2009/06/03 11:56:56 | 000,012,800 | —- | C] ( ) – C:\Windows\System32\killapps.exe
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/06 20:40:34 | 000,160,350 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\JavaRa.zip
[2011/12/06 20:35:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/06 20:27:54 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/06 20:27:53 | 000,000,680 | —- | M] () – C:\Users\DOM&EDYTA;\AppData\Local\d3d9caps.dat
[2011/12/06 19:19:53 | 000,055,468 | —- | M] () – C:\Windows\System32\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/06 19:19:53 | 000,055,468 | —- | M] () – C:\Windows\System32\BMXState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/06 19:19:53 | 000,000,788 | —- | M] () – C:\Windows\System32\DVCState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/06 17:57:42 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/06 17:57:42 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/06 14:13:13 | 000,000,506 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2011/12/06 13:57:17 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/06 13:57:06 | 2950,139,904 | -HS- | M] () – C:\hiberfil.sys
[2011/12/06 08:45:11 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/12/05 20:58:54 | 000,004,608 | —- | M] () – C:\Users\DOM&EDYTA;\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/05 18:10:31 | 000,000,248 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\oakfurnitureland.co.uk-furniture-tokyo-solid-oak-large-sideboard-oaktok007.html.url
[2011/12/05 18:10:31 | 000,000,000 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\Tokyo Solid Oak Large Sideboard from the Tokyo Solid Oak range.url
[2011/12/05 18:09:37 | 000,000,266 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\Tokyo Brown Teak Mango Widescreen TV or DVD Cabinet from the Tokyo Brown Teak solid Mango range.url
[2011/12/05 15:21:39 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/12/05 14:43:22 | 004,327,724 | R— | M] (Swearware) – C:\Users\DOM&EDYTA;\Desktop\ComboFix.exe
[2011/12/05 14:43:22 | 004,327,724 | R— | M] (Swearware) – C:\ComboFix.exe
[2011/12/03 20:03:49 | 000,615,806 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/12/03 20:03:49 | 000,111,056 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/12/03 18:27:08 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/12/03 13:07:01 | 000,000,820 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/12/01 15:31:00 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\DOM&EDYTA;\Desktop\OTL.exe
[2011/12/01 15:15:46 | 001,008,114 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\rkill.exe
[2011/11/30 19:52:22 | 000,294,216 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\gmer.zip
[2011/11/25 14:31:15 | 000,002,531 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\HiJackThis.lnk
[2011/11/24 23:22:13 | 000,001,666 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/11/23 21:12:05 | 000,000,000 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\Baxi UK.url
[2011/11/21 20:36:58 | 000,002,075 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/18 11:36:18 | 000,001,973 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/11/09 03:03:21 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/11/08 01:08:00 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/11/07 23:04:43 | 000,000,203 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\southernnet.southernrailway.com-.url
[2011/11/07 23:04:43 | 000,000,000 | —- | M] () – C:\Users\DOM&EDYTA;\Desktop\Staff Login Southern Railways.url
[2011/11/07 21:28:38 | 000,056,208 | —- | M] (Trusteer Ltd.) – C:\Windows\System32\drivers\RapportKELL.sys
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/06 20:40:34 | 000,160,350 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\JavaRa.zip
[2011/12/05 20:58:50 | 000,004,608 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/05 18:10:31 | 000,000,248 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\oakfurnitureland.co.uk-furniture-tokyo-solid-oak-large-sideboard-oaktok007.html.url
[2011/12/05 18:10:31 | 000,000,000 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\Tokyo Solid Oak Large Sideboard from the Tokyo Solid Oak range.url
[2011/12/05 18:09:37 | 000,000,266 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\Tokyo Brown Teak Mango Widescreen TV or DVD Cabinet from the Tokyo Brown Teak solid Mango range.url
[2011/12/05 16:08:11 | 000,055,468 | —- | C] () – C:\Windows\System32\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/05 16:08:11 | 000,055,468 | —- | C] () – C:\Windows\System32\BMXState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/05 16:08:11 | 000,000,788 | —- | C] () – C:\Windows\System32\DVCState-{00000003-00000000-00000007-00001102-00000005-60021102}.rfx
[2011/12/05 14:55:50 | 2950,139,904 | -HS- | C] () – C:\hiberfil.sys
[2011/12/01 18:20:12 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/12/01 18:20:12 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/12/01 18:20:12 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/12/01 18:20:12 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/12/01 18:20:12 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/12/01 15:15:45 | 001,008,114 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\rkill.exe
[2011/11/30 19:52:55 | 000,302,592 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\gmer.exe
[2011/11/30 19:52:22 | 000,294,216 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\gmer.zip
[2011/11/24 23:22:13 | 000,001,666 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/11/23 21:12:05 | 000,000,000 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\Baxi UK.url
[2011/11/21 20:36:58 | 000,002,075 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/09 03:03:21 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/11/07 23:04:43 | 000,000,203 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\southernnet.southernrailway.com-.url
[2011/11/07 23:04:43 | 000,000,000 | —- | C] () – C:\Users\DOM&EDYTA;\Desktop\Staff Login Southern Railways.url
[2011/11/01 18:24:49 | 000,043,286 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\UserTile.png
[2011/07/26 16:26:48 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2011/07/26 16:26:46 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2011/07/26 16:26:46 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2011/07/26 16:26:46 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2011/07/26 16:26:46 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2010/09/06 15:05:49 | 000,000,981 | —- | C] () – C:\Windows\eReg.dat
[2010/06/21 17:47:57 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/06/21 17:36:51 | 000,000,768 | —- | C] () – C:\Windows\System32\Remover.ini
[2010/04/30 19:17:11 | 000,033,792 | —- | C] () – C:\Windows\System32\drivers\libusb0.sys
[2010/03/11 21:52:05 | 000,004,984 | —- | C] () – C:\Windows\System32\drivers\nvphy.bin
[2010/02/25 18:40:33 | 000,000,085 | -HS- | C] () – C:\ProgramData\.zreglib
[2009/12/27 14:29:48 | 000,000,036 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Local\housecall.guid.cache
[2009/11/29 11:45:51 | 000,001,057 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\vso_ts_preview.xml
[2009/11/08 16:09:21 | 000,000,013 | —- | C] () – C:\Windows\msgtn.ini
[2009/10/21 12:20:08 | 000,005,504 | —- | C] () – C:\Windows\System32\drivers\StarOpen_x86.sys
[2009/09/24 20:24:12 | 000,003,654 | —- | C] () – C:\Windows\System32\drivers\Sonyhcp.dll
[2009/09/23 22:49:19 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/23 22:49:19 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/07 07:01:50 | 000,000,097 | —- | C] () – C:\Windows\System32\SETUP.DAT
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/18 18:12:41 | 000,087,608 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\ezpinst.exe
[2009/07/16 09:21:30 | 000,001,492 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Roaming\wklnhst.dat
[2009/06/17 06:57:08 | 000,000,680 | —- | C] () – C:\Users\DOM&EDYTA;\AppData\Local\d3d9caps.dat
[2009/06/16 16:32:22 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/06/03 13:00:30 | 000,026,928 | —- | C] () – C:\Windows\System32\instwdm.ini
[2009/06/03 13:00:28 | 000,000,054 | —- | C] () – C:\Windows\System32\ctzapxx.ini
[2009/06/03 12:19:42 | 000,002,560 | —- | C] () – C:\Windows\System32\CtxfiRes.dll
[2009/06/03 12:00:34 | 000,016,384 | —- | C] () – C:\Windows\System32\regplib.exe
[2009/06/03 11:57:12 | 000,007,680 | —- | C] () – C:\Windows\System32\enlocstr.exe
[2009/05/26 10:56:08 | 000,000,297 | —- | C] () – C:\Windows\System32\kill.ini
[2008/09/25 09:48:32 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/09/25 09:48:31 | 000,321,512 | —- | C] () – C:\Windows\System32\ctdlang.dat
[2008/09/25 09:48:31 | 000,056,509 | —- | C] () – C:\Windows\System32\ctdnlstr.dat
[2008/09/25 01:54:44 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/09/25 01:10:02 | 000,002,560 | —- | C] () – C:\Windows\CTXFIRES.DLL
[2008/09/25 01:09:56 | 000,148,480 | —- | C] () – C:\Windows\System32\APOMngr.DLL
[2008/09/25 01:09:56 | 000,073,728 | —- | C] () – C:\Windows\System32\CmdRtr.DLL
[2008/02/03 23:11:25 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2007/08/16 04:23:28 | 000,040,960 | —- | C] () – C:\Windows\System32\gpyapi.dll
[2007/03/20 15:44:02 | 000,000,566 | —- | C] () – C:\Windows\System32\SP7302.ini
[2007/02/13 10:14:18 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2006/11/02 12:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 000,380,440 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,615,806 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,111,056 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 10:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 10:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 08:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/09/13 11:06:10 | 000,045,056 | —- | C] () – C:\Windows\System32\gtapi.dll
[2005/12/15 05:17:00 | 000,159,744 | —- | C] () – C:\Windows\System32\EPSPTDV.DLL
[2001/11/14 11:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2010/09/14 22:35:30 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Audacity
[2011/12/01 15:51:56 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Azureus
[2010/03/29 14:29:00 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/12/01 15:42:46 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\HandBrake
[2009/10/02 23:36:23 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Microgaming
[2011/01/12 21:51:22 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\PCDr
[2009/11/08 16:08:41 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\ppstream
[2011/10/01 17:52:54 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Radialpoint
[2011/08/12 12:41:33 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Samsung
[2009/08/20 19:47:16 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Template
[2011/07/21 17:33:07 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Tific
[2010/01/23 18:10:49 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Trusteer
[2011/02/04 21:24:16 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\TuneUp Software
[2010/09/08 12:55:03 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Uniblue
[2011/09/13 12:27:28 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\uTorrent
[2011/10/01 15:41:57 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Virgin Media
[2011/10/29 07:56:34 | 000,000,000 | —D | M] – C:\Users\DOM&EDYTA;\AppData\Roaming\Vso
[2011/12/03 18:27:08 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/12/06 08:45:12 | 000,032,646 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/06 14:13:13 | 000,000,506 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6971CCC5

< End of report >
Post #28
Hi, jeffce, my system seems ok but I have a couple of questions. Has the Trojan found by the esetscanner been cleaned?? Or do we still need to do that??
Post #29
Hi dom,

Good question. :) It will be removed when we clean-up but you can do the following as well and we will flush the DNS on your system as well.

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptyjava]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done

No need to run another scan after running the fix above. Just let me know when it has been completed. :thumbup:
Post #30
Hey Jeffce, I ran the fix and upon reboot, a log was presented

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\DOM&EDYTA\Desktop\cmd.bat deleted successfully.
C:\Users\DOM&EDYTA\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: DOM&EDYTA
->Java cache emptied: 12524158 bytes

User: Public

Total Java Files Cleaned = 12.00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: DOM&EDYTA
->Temp folder emptied: 4655252 bytes
->Temporary Internet Files folder emptied: 16654787 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 42100 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 48 bytes
%systemroot%\System32 .tmp files removed: 378021 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11697 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 21.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 12062011_233211

Files\Folders moved on Reboot…
File\Folder C:\Users\DOM&EDYTA\AppData\Local\Temp\~DFA389.tmp not found!
File\Folder C:\Users\DOM&EDYTA\AppData\Local\Temp\~DFA85E.tmp not found!
C:\Users\DOM&EDYTA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\DOM&EDYTA\AppData\Local\Trusteer\Rapport\user\logs\koan.4120.log moved successfully.
C:\Users\DOM&EDYTA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PHQGJ3PO\iframe[3].htm moved successfully.
C:\Users\DOM&EDYTA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6THDTOAA\index[3].htm moved successfully.
C:\Users\DOM&EDYTA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\DOM&EDYTA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
C:\Windows\temp\ZKT{76765E90-57FD-401B-ADEE-8131B767C613}.tmp moved successfully.

Registry entries deleted on Reboot…


Cheers Dom

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI