mistaben
getting same thing still and im pretty sure the software is off
also…
http://i1127.photobucket.com/albums/l626/t…1/trojanpic.png
also…
http://i1127.photobucket.com/albums/l626/t…1/trojanpic.png
Spyware / Malware / Virus Removal
PING.exe [Closed]
33 min read
ken545
- Please download OTM by OldTimer and save it to your desktop.
- Double click the [external image: Posted Image] icon on your desktop.
- Paste the following code under the [external image: Posted Image] area.
Do not include the word "Code".
:Processes explorer.exe :Services :Reg :Files C\Windows\System32\consrv.dll.vir C:\Program Files (x86)\FoxTabFLVPlayer\FLVPlayer.exe :Commands [purity] [emptytemp] [start explorer] [Reboot]
- Push the large [external image: Posted Image] button.
- OTM may ask to reboot the machine. Please do so if asked.
- Copy/Paste the contents under the [external image: Posted Image] line here in your next reply.
- If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
mistaben
the results was not able to be posted, couldn't copy/paste, do anything except restart machine. ~ this was the notepad displayed on restart:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder C\Windows\System32\consrv.dll.vir not found.
File/Folder C:\Program Files (x86)\FoxTabFLVPlayer\FLVPlayer.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56504 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Tony
->Temp folder emptied: 48681557 bytes
->Temporary Internet Files folder emptied: 287233088 bytes
->Java cache emptied: 3240547 bytes
->FireFox cache emptied: 44178775 bytes
->Flash cache emptied: 57009 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 22747 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50400 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 366.00 mb
OTM by OldTimer - Version 3.1.19.0 log created on 12022011_200421
Files moved on Reboot…
C:\Users\Tony\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot…
mistaben
as a side note… 16,500 posts? wow…. you HAVE done this alot. this is like your primary job isn't it?
ken545
Good Morning,
Actually we are all volunteers on these malware removal forums, we do this in our spare time when we have internet access at home, work or wherever. There are quite a few of us and we make up the malware removal community, we all do this for no pay, why, because we really dislike the miscredients that write this garbage and like helping nice people like your self. Besides this forum most of us are members and help out at other forums as well.
I am not convinced these are gone, the FoxTabFLVPlayer has no uninstall and falls somewhere in the grey area, I would remove it, lets see if we can remove them manually
You need to enable windows to Show all Files and Folders
Instructions for your Operating System HERE
C\Windows\System32\consrv.dll.vir
C:\Program Files (x86)\FoxTabFLVPlayer
If you decide to uninstall this one you can try this program to remove it. All you need is the free version
http://download.cnet.com/Revo-Uninstaller/…4-10687648.html
Run aswMBR one more time and post the NEW log please, then run DDS again and post a new DDS log
Actually we are all volunteers on these malware removal forums, we do this in our spare time when we have internet access at home, work or wherever. There are quite a few of us and we make up the malware removal community, we all do this for no pay, why, because we really dislike the miscredients that write this garbage and like helping nice people like your self. Besides this forum most of us are members and help out at other forums as well.
I am not convinced these are gone, the FoxTabFLVPlayer has no uninstall and falls somewhere in the grey area, I would remove it, lets see if we can remove them manually
You need to enable windows to Show all Files and Folders
Instructions for your Operating System HERE
C\Windows\System32\consrv.dll.vir
C:\Program Files (x86)\FoxTabFLVPlayer
If you decide to uninstall this one you can try this program to remove it. All you need is the free version
http://download.cnet.com/Revo-Uninstaller/…4-10687648.html
Run aswMBR one more time and post the NEW log please, then run DDS again and post a new DDS log
mistaben
oh snap! ~ that's how you do that on windows 7…
… ok anyways… as a side note. i don't see the file listed. and the flv player has a unistall link in the start bar… following it leads to basically a dead folder.
sorry that is to say the uninstaller doesn't see it either.
mistaben
while I am here… the windows firewall is back to working again. thankyou! 
mistaben
one quick question?
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-01 07:37:32
—————————–
07:37:32.236 OS Version: Windows x64 6.1.7601 Service Pack 1
07:37:32.236 Number of processors: 8 586 0x2A07
07:37:32.236 ComputerName: TONY-HP UserName: Tony
07:37:34.030 Initialize success
07:38:50.712 AVAST engine defs: 11120100
07:39:23.877 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
07:39:23.877 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3
07:39:23.893 Disk 0 MBR read successfully
07:39:23.893 Disk 0 MBR scan
07:39:23.893 Disk 0 unknown MBR code
07:39:23.893 Service scanning
07:39:24.876 Modules scanning
07:39:24.876 Disk 0 trace - called modules:
07:39:24.907 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
07:39:24.907 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008030790]
07:39:24.907 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8007f3ab10]
07:39:24.907 5 hpdskflt.sys[fffff88001b98189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007a2f050]
07:39:26.248 AVAST engine scan C:\
07:56:47.655 File: C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir **INFECTED** Win32:Malware-gen
08:00:01.758 File: C:\Windows\assembly\GAC_64\Desktop.ini **INFECTED** Win32:Malware-gen
08:00:51.548 File: C:\Windows\assembly\temp\U\80000032.@ **INFECTED** Win32:DNSChanger-VJ [Trj]
08:39:49.449 Scan finished successfully
08:39:53.817 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat"
08:39:53.817 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt"
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-03 06:51:29
—————————–
06:51:29.631 OS Version: Windows x64 6.1.7601 Service Pack 1
06:51:29.631 Number of processors: 8 586 0x2A07
06:51:29.631 ComputerName: TONY-HP UserName: Tony
06:51:31.534 Initialize success
06:51:55.690 AVAST engine defs: 11120301
06:52:00.931 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
06:52:00.931 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3
06:52:00.947 Disk 0 MBR read successfully
06:52:00.947 Disk 0 MBR scan
06:52:00.947 Disk 0 unknown MBR code
06:52:00.963 Service scanning
06:52:02.242 Modules scanning
06:52:02.242 Disk 0 trace - called modules:
06:52:02.289 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
06:52:02.289 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80098f3790]
06:52:02.289 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8009803b10]
06:52:02.289 5 hpdskflt.sys[fffff88001b7c189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007c55050]
06:52:05.877 AVAST engine scan C:\
07:09:53.539 File: C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir **INFECTED** Win64:Sirefef-C [Drp]
07:13:09.022 File: C:\Windows\assembly\GAC_32\Desktop.ini **INFECTED** Win32:Sirefef-FQ [Drp]
07:13:11.082 File: C:\Windows\assembly\GAC_64\Desktop.ini **INFECTED** Win64:Sirefef-C [Drp]
07:13:59.248 File: C:\Windows\assembly\temp\U\80000032.@ **INFECTED** Win32:DNSChanger-VJ [Trj]
07:54:00.285 Scan finished successfully
07:58:30.000 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat"
07:58:30.000 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt"
ken545
Lets check that file.
You need to enable windows to show all files and folders, instructions Here
Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see. If the site says this file has been checked before, have them check it again
C:\Windows\assembly\GAC_32\Desktop.ini
If the site is busy you can try this one
http://virusscan.jotti.org/en
You need to enable windows to show all files and folders, instructions Here
Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see. If the site says this file has been checked before, have them check it again
C:\Windows\assembly\GAC_32\Desktop.ini
If the site is busy you can try this one
http://virusscan.jotti.org/en
mistaben
hmm… i don't see anything inside of the assembly folder that looks like a folder. i see a series of "assemblies" but nothing resembling files or folders.
like gac 32 or gac 64. i don't see anything like that…
ken545
Download and Run SystemLook
You need the 64 bIT Version
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64 Bit Version
Also, let me see a new DDS log
You need the 64 bIT Version
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64 Bit Version
- Double-click SystemLook.exe to run it.
- Copy the content of the following codebox into the main textfield:
:dir C:\Windows\assembly\GAC_32
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Also, let me see a new DDS log
mistaben
SystemLook 30.07.11 by jpshortstuff
Log created at 15:43 on 03/12/2011 by Tony
Administrator - Elevation successful
========== dir ==========
C:\Windows\assembly\GAC_32 - Parameters: "(none)"
—Files—
Desktop.ini –ahs– 4096 bytes [11:24 20/11/2011] [11:57 01/12/2011]
—Folders—
BDATunePIA d—— [21:38 18/11/2011]
CustomMarshalers d—— [03:20 14/07/2009]
ehexthost32 d—— [21:38 18/11/2011]
HP.TouchSmart.InfoviewWindow d—— [02:15 26/11/2011]
ISymWrapper d—— [03:20 14/07/2009]
mcstoredb d—— [21:38 18/11/2011]
Microsoft.Ink d—— [05:32 14/07/2009]
Microsoft.Interop.Security.AzRoles d—— [03:20 14/07/2009]
Microsoft.Transactions.Bridge.Dtc d—— [05:32 14/07/2009]
Microsoft.Windows.Diagnosis.SDEngine d—— [05:32 14/07/2009]
MSBuild d—— [05:32 14/07/2009]
mscorlib d—— [03:20 14/07/2009]
napcrypt d—— [03:20 14/07/2009]
naphlpr d—— [03:20 14/07/2009]
Policy.1.0.Microsoft.Ink d—— [05:32 14/07/2009]
Policy.1.0.Microsoft.Interop.Security.AzRoles d—— [03:20 14/07/2009]
Policy.1.2.Microsoft.Interop.Security.AzRoles d—— [03:20 14/07/2009]
Policy.1.7.Microsoft.Ink d—— [05:32 14/07/2009]
Policy.6.0.Microsoft.Ink d—— [05:32 14/07/2009]
PresentationCore d—— [05:32 14/07/2009]
System.Data d—— [03:20 14/07/2009]
System.Data.OracleClient d—— [03:20 14/07/2009]
System.EnterpriseServices d—— [03:20 14/07/2009]
System.Printing d—— [05:32 14/07/2009]
System.Transactions d—— [03:20 14/07/2009]
System.Web d—— [03:20 14/07/2009]
-= EOF =-
mistaben
and here we go.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by [removed] at 15:44:27 on 2011-12-03
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.4607 [GMT -7:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskhost.exe
C:\WINDOWS\notepad.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
Trusted Zone: apexfitness.com\my
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1D586EF4-8011-4DD6-BAD2-3280827F2C4D} : DhcpNameServer = 192.168.1.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Hosts: 217.23.4.166 www.google-analytics.com.
Hosts: 217.23.4.166 ad-emea.doubleclick.net.
Hosts: 217.23.4.166 www.statcounter.com.
Hosts: 178.250.45.15 www.google-analytics.com.
Hosts: 178.250.45.15 ad-emea.doubleclick.net.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\
FF - prefs.js: browser.startup.homepage - hxxp://forum.bodybuilding.com/forumdisplay.php?f=19
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys –> C:\Windows\system32\DRIVERS\Lbd.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-11-18 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992]
R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-8-5 681528]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992]
R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-9-28 26680]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-18 13336]
R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-18 2655768]
R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys –> C:\Windows\system32\drivers\btwampfl.sys [?]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]
R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57:59;C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2011-11-18 245232]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-8-18 2152152]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-11-24 17152]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
.
=============== Created Last 30 ================
.
2011-12-03 13:32:24 ——– d—–w- C:\Program Files (x86)\VS Revo Group
2011-12-03 03:07:44 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{47FE8B84-6A46-4D2F-9EAD-8F56F40E0767}\offreg.dll
2011-12-03 03:04:21 ——– d—–w- C:\_OTM
2011-12-02 10:26:59 8822856 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{47FE8B84-6A46-4D2F-9EAD-8F56F40E0767}\mpengine.dll
2011-12-02 01:10:39 ——– d—–w- C:\Program Files (x86)\ESET
2011-12-01 22:46:23 ——– d—–w- C:\_OTL
2011-12-01 17:14:11 ——– d—–w- C:\Users\Tony\AppData\Local\Corel
2011-12-01 16:13:14 ——– d-sh–w- C:\$RECYCLE.BIN
2011-12-01 15:41:42 ——– d—–w- C:\Users\Tony\AppData\Roaming\Malwarebytes
2011-12-01 15:41:39 ——– d—–w- C:\ProgramData\Malwarebytes
2011-12-01 15:41:36 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys
2011-12-01 15:41:36 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-12-01 12:16:54 98816 —-a-w- C:\Windows\sed.exe
2011-12-01 12:16:54 518144 —-a-w- C:\Windows\SWREG.exe
2011-12-01 12:16:54 256000 —-a-w- C:\Windows\PEV.exe
2011-12-01 12:16:54 208896 —-a-w- C:\Windows\MBR.exe
2011-12-01 08:37:06 ——– d—–w- C:\Users\Tony\AppData\Local\ElevatedDiagnostics
2011-12-01 05:51:36 ——– d—–w- C:\Users\Tony\AppData\Roaming\Visan
2011-12-01 05:51:36 ——– d—–w- C:\ProgramData\Visan
2011-12-01 05:49:48 ——– d—–w- C:\ProgramData\WEBREG
2011-12-01 05:47:01 230400 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll
2011-12-01 05:37:25 ——– d—–w- C:\Windows\pss
2011-12-01 05:30:33 902656 —-a-w- C:\Windows\System32\d2d1.dll
2011-12-01 05:30:33 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll
2011-12-01 05:30:33 1544192 —-a-w- C:\Windows\System32\DWrite.dll
2011-12-01 05:30:33 1139200 —-a-w- C:\Windows\System32\FntCache.dll
2011-12-01 05:30:33 1076736 —-a-w- C:\Windows\SysWow64\DWrite.dll
2011-12-01 05:22:47 ——– d—–w- C:\Program Files (x86)\Yahoo!
2011-12-01 05:22:43 ——– d—–w- C:\Users\Tony\AppData\Roaming\HpUpdate
2011-12-01 05:22:34 ——– d—–w- C:\Program Files (x86)\Coupons
2011-12-01 05:21:42 ——– d—–w- C:\Program Files (x86)\Common Files\HP
2011-12-01 05:21:30 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2011-11-29 02:42:08 ——– d—–w- C:\Users\Tony\AppData\Local\Apple Computer
2011-11-29 02:41:40 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2011-11-29 02:41:40 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll
2011-11-29 02:41:40 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll
2011-11-29 02:40:51 ——– d—–w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iTunes
2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iPod
2011-11-29 02:40:51 ——– d—–w- C:\Program Files (x86)\iTunes
2011-11-29 02:40:29 ——– d—–w- C:\Users\Tony\AppData\Local\Apple
2011-11-29 02:40:03 ——– d—–w- C:\Program Files\Bonjour
2011-11-29 02:40:03 ——– d—–w- C:\Program Files (x86)\Bonjour
2011-11-29 02:38:48 ——– d—–w- C:\itunes
2011-11-27 07:05:27 ——– d—–w- C:\Users\Tony\AppData\Local\CyberLink
2011-11-27 07:05:26 ——– d—–w- C:\Users\Tony\AppData\Local\PowerCinema
2011-11-26 02:13:25 8507392 —-a-w- C:\Windows\System32\drivers\NETwNs64.sys
2011-11-26 02:13:25 799232 —-a-w- C:\Windows\System32\NETwNc64.dll
2011-11-26 02:13:25 2750464 —-a-w- C:\Windows\System32\NETwNr64.dll
2011-11-24 14:02:48 16432 —-a-w- C:\Windows\System32\lsdelete.exe
2011-11-24 13:55:32 55384 —-a-w- C:\Windows\System32\drivers\SBREDrv.sys
2011-11-24 13:54:10 69376 —-a-w- C:\Windows\System32\drivers\Lbd.sys
2011-11-24 13:54:08 ——– d—–w- C:\Program Files (x86)\Lavasoft
2011-11-24 13:24:17 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3
2011-11-24 11:39:27 ——– d—–w- C:\Windows\en
2011-11-24 11:17:16 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live
2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Roaming\Windows Live Writer
2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live Writer
2011-11-22 13:12:24 8570192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-21 04:01:50 ——– d—–w- C:\Windows\System32\SPReview
2011-11-21 04:01:27 ——– d—–w- C:\Windows\System32\EventProviders
2011-11-20 20:34:35 203264 —-a-w- C:\Windows\System32\unrar.dll
2011-11-20 20:34:34 86016 —-a-w- C:\Windows\System32\ff_vfw.dll
2011-11-20 20:34:34 ——– d—–w- C:\Program Files\K-Lite Codec Pack x64
2011-11-20 16:29:38 ——– d—–w- C:\Users\Tony\AppData\Local\FVD Suite
2011-11-20 16:24:16 ——– d—–w- C:\Program Files (x86)\FVD Suite
2011-11-20 14:24:42 ——– d—–w- C:\firefox
2011-11-20 14:22:11 ——– d—–w- C:\Users\Tony\AppData\Local\Adobe
2011-11-20 13:47:56 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-20 13:34:41 ——– d—–w- C:\Users\Tony\AppData\Local\Mozilla
2011-11-20 13:25:30 ——– d—–w- C:\direct x files
2011-11-20 13:16:08 ——– d—–w- C:\Windows\SysWow64\directx
2011-11-20 13:13:52 ——– d—–w- C:\Program Files\Media Player Classic - Home Cinema
2011-11-20 13:11:12 ——– d—–w- C:\Users\Tony\AppData\Local\Programs
2011-11-20 13:01:16 48976 —-a-w- C:\Windows\System32\netfxperf.dll
2011-11-20 13:01:16 1942856 —-a-w- C:\Windows\System32\dfshim.dll
2011-11-20 13:01:08 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll
2011-11-20 13:01:02 59392 —-a-w- C:\Windows\System32\drivers\TsUsbFlt.sys
2011-11-20 13:01:02 3715584 —-a-w- C:\Windows\System32\mstscax.dll
2011-11-20 13:01:02 1838080 —-a-w- C:\Windows\System32\d3d10warp.dll
2011-11-20 13:01:02 12288 —-a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2011-11-20 13:01:01 14967808 —-a-w- C:\Program Files\DVD Maker\OmdBase.dll
2011-11-20 12:59:59 705024 —-a-w- C:\Windows\System32\BFE.DLL
2011-11-20 12:58:59 856576 —-a-w- C:\Windows\SysWow64\FirewallControlPanel.dll
2011-11-20 12:57:58 3072 —-a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
2011-11-20 12:57:58 2560 —-a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
2011-11-20 12:57:56 6144 —-a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
2011-11-20 12:57:56 4608 —-a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
2011-11-20 12:57:55 399872 —-a-w- C:\Windows\System32\dpx.dll
2011-11-20 12:57:55 189952 —-a-w- C:\Windows\SysWow64\wdscore.dll
2011-11-20 12:57:49 189952 —-a-w- C:\Windows\SysWow64\sqmapi.dll
2011-11-20 12:57:40 606208 —-a-w- C:\Windows\SysWow64\wbem\fastprox.dll
2011-11-20 12:57:40 363008 —-a-w- C:\Windows\SysWow64\wbemcomn.dll
2011-11-20 12:57:40 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll
2011-11-20 12:55:56 529408 —-a-w- C:\Windows\System32\wbemcomn.dll
2011-11-20 12:55:56 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll
2011-11-20 12:55:45 244736 —-a-w- C:\Windows\System32\sqmapi.dll
2011-11-20 12:44:54 ——– d–h–w- C:\ProgramData\Common Files
2011-11-20 12:44:53 ——– d—–w- C:\Program Files (x86)\AVG
2011-11-20 12:42:12 ——– d—–w- C:\ProgramData\MFAData
2011-11-20 12:33:03 1659776 —-a-w- C:\Windows\System32\drivers\ntfs.sys
2011-11-20 12:33:02 96768 —-a-w- C:\Windows\System32\fsutil.exe
2011-11-20 12:33:02 74240 —-a-w- C:\Windows\SysWow64\fsutil.exe
2011-11-20 12:33:02 410496 —-a-w- C:\Windows\System32\drivers\iaStorV.sys
2011-11-20 12:33:02 27008 —-a-w- C:\Windows\System32\drivers\amdxata.sys
2011-11-20 12:33:02 2565632 —-a-w- C:\Windows\System32\esent.dll
2011-11-20 12:33:02 189824 —-a-w- C:\Windows\System32\drivers\storport.sys
2011-11-20 12:33:02 1699328 —-a-w- C:\Windows\SysWow64\esent.dll
2011-11-20 12:33:02 166272 —-a-w- C:\Windows\System32\drivers\nvstor.sys
2011-11-20 12:33:02 148352 —-a-w- C:\Windows\System32\drivers\nvraid.sys
2011-11-20 12:33:02 107904 —-a-w- C:\Windows\System32\drivers\amdsata.sys
2011-11-20 12:32:56 98816 —-a-w- C:\Windows\System32\drivers\usbccgp.sys
2011-11-20 12:32:56 7936 —-a-w- C:\Windows\System32\drivers\usbd.sys
2011-11-20 12:32:56 52736 —-a-w- C:\Windows\System32\drivers\usbehci.sys
2011-11-20 12:32:56 343040 —-a-w- C:\Windows\System32\drivers\usbhub.sys
2011-11-20 12:32:56 325120 —-a-w- C:\Windows\System32\drivers\usbport.sys
2011-11-20 12:32:56 30720 —-a-w- C:\Windows\System32\drivers\usbuhci.sys
2011-11-20 12:32:56 25600 —-a-w- C:\Windows\System32\drivers\usbohci.sys
2011-11-20 12:32:55 80384 —-a-w- C:\Windows\System32\drivers\BTHUSB.SYS
2011-11-20 12:32:55 552960 —-a-w- C:\Windows\System32\drivers\bthport.sys
2011-11-20 12:32:55 229376 —-a-w- C:\Windows\System32\fsquirt.exe
2011-11-20 12:29:57 ——– d—–w- C:\Users\Tony\AppData\Local\Diagnostics
2011-11-20 12:02:40 ——– d—–w- C:\Program Files (x86)\uTorrent
2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Roaming\uTorrent
2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Local\uTorrent
2011-11-20 11:26:26 ——– d—–w- C:\Users\Tony\AppData\Local\CrashDumps
2011-11-20 10:31:58 ——– d—–w- C:\Windows\SysWow64\Wat
2011-11-20 10:31:58 ——– d—–w- C:\Windows\System32\Wat
2011-11-20 10:04:22 ——– d—–w- C:\Program Files (x86)\MSXML 4.0
2011-11-20 05:10:08 ——– d—–w- C:\Program Files (x86)\Apex Fitness
2011-11-20 05:01:00 ——– d—–w- C:\ProgramData\Blizzard Entertainment
2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\StarCraft II
2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\Common Files\Blizzard Entertainment
2011-11-20 04:22:59 86528 —-a-w- C:\Windows\SysWow64\SearchFilterHost.exe
2011-11-20 04:20:46 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe
2011-11-20 04:20:46 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe
2011-11-20 04:20:46 183296 —-a-w- C:\Windows\System32\dnsrslvr.dll
2011-11-20 04:20:03 467456 —-a-w- C:\Windows\System32\drivers\srv.sys
2011-11-20 04:20:03 410112 —-a-w- C:\Windows\System32\drivers\srv2.sys
2011-11-20 04:20:03 168448 —-a-w- C:\Windows\System32\drivers\srvnet.sys
2011-11-20 04:20:01 321024 —-a-w- C:\Windows\System32\d3d10_1core.dll
2011-11-20 04:20:01 219136 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll
2011-11-20 04:20:01 197120 —-a-w- C:\Windows\System32\d3d10_1.dll
2011-11-20 04:20:01 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-11-20 04:15:40 270720 ——w- C:\Windows\System32\MpSigStub.exe
2011-11-20 03:59:15 ——– d—–w- C:\Users\Tony\AppData\Roaming\Blio
2011-11-20 03:52:42 ——– d—–w- C:\Users\Tony\AppData\Local\ATI
2011-11-20 03:52:29 ——– d—–w- C:\Users\Tony\AppData\Roaming\PictureMover
2011-11-20 02:54:16 ——– d—–w- C:\Users\Tony\AppData\Local\Broadcom
2011-11-20 02:54:13 ——– d—–w- C:\Users\Tony\AppData\Roaming\Intel Corporation
2011-11-20 02:54:12 ——– d—–w- C:\Users\Tony\AppData\Roaming\Stardock
2011-11-20 02:54:11 ——– d—–w- C:\Users\Tony\AppData\Roaming\hpqLog
2011-11-20 02:53:24 ——– d—–w- C:\Users\Tony\AppData\Local\RemEngine
2011-11-20 02:48:58 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard
2011-11-20 02:48:41 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard_Company
2011-11-18 22:15:54 39464 —-a-w- C:\Windows\System32\drivers\btwl2cap.sys
2011-11-18 22:15:54 344616 —-a-w- C:\Windows\System32\drivers\btwampfl.sys
2011-11-18 22:15:54 21544 —-a-w- C:\Windows\System32\drivers\btwrchid.sys
2011-11-18 22:15:54 135720 —-a-w- C:\Windows\System32\drivers\btwavdt.sys
2011-11-18 22:15:54 102952 —-a-w- C:\Windows\System32\drivers\btwaudio.sys
2011-11-18 22:15:28 ——– d—–w- C:\Program Files\WIDCOMM
2011-11-18 22:15:20 ——– d—–w- C:\Program Files (x86)\Microsoft
2011-11-18 22:14:49 ——– d—–w- C:\ProgramData\Downloaded Installations
2011-11-18 22:10:15 ——– d—–w- C:\Program Files (x86)\HP Games
2011-11-18 22:10:12 ——– d—–w- C:\ProgramData\WildTangent
2011-11-18 22:09:26 ——– d—–w- C:\ProgramData\Norton
2011-11-18 22:09:05 ——– d—–w- C:\ProgramData\NortonInstaller
2011-11-18 22:08:39 ——– d—–w- C:\ProgramData\Uninstall
2011-11-18 22:08:21 ——– d—–w- C:\Program Files (x86)\Microsoft WSE
2011-11-18 22:08:16 ——– d—–w- C:\ProgramData\RoxioNow
2011-11-18 22:08:13 ——– d—–w- C:\Program Files (x86)\Roxio
2011-11-18 22:08:01 ——– d—–w- C:\ProgramData\PictureMover
2011-11-18 22:08:01 ——– d—–w- C:\Program Files (x86)\PictureMover
2011-11-18 22:05:44 ——– d—–w- C:\Program Files (x86)\Times Reader
2011-11-18 22:05:31 ——– dc-h–w- C:\ProgramData\{05971B75-B620-4D64-9985-7971BEF763A2}
2011-11-18 22:05:30 ——– d—–w- C:\Program Files\Stardock
2011-11-18 21:55:41 0 —-a-w- C:\Windows\ativpsrm.bin
2011-11-18 21:54:26 53248 —-a-w- C:\Windows\SysWow64\CSVer.dll
2011-11-18 21:54:19 ——– d—–w- C:\Windows\Hewlett-Packard
2011-11-18 21:53:27 ——– d—–w- C:\Windows\Driver Cache
2011-11-18 21:53:27 ——– d—–w- C:\Program Files (x86)\HP
2011-11-18 21:50:56 9112168 —-a-w- C:\Windows\SysWow64\RtsUStoricon.dll
2011-11-18 21:50:56 422504 —-a-w- C:\Windows\System32\RtsUStor.dll
2011-11-18 21:50:56 246376 —-a-w- C:\Windows\System32\drivers\RtsUStor.sys
2011-11-18 21:50:56 ——– d—–w- C:\Program Files (x86)\Realtek
2011-11-18 21:50:22 ——– d—–w- C:\Program Files\Validity Sensors
2011-11-18 21:49:59 437272 —-a-w- C:\Windows\System32\drivers\iaStor.sys
2011-11-18 21:49:56 8192 —-a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
2011-11-18 21:49:56 8192 —-a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll
2011-11-18 21:49:50 ——– d—–w- C:\Program Files (x86)\Common Files\postureAgent
2011-11-18 21:49:38 ——– d—–w- C:\Program Files\Synaptics
2011-11-18 21:48:11 ——– d—–w- C:\Program Files\ATI
2011-11-18 21:48:09 ——– d—–w- C:\Program Files (x86)\ATI Technologies
2011-11-18 21:38:29 ——– d—–w- C:\Windows\ehome
.
==================== Find3M ====================
.
2011-11-21 04:34:49 175616 —-a-w- C:\Windows\System32\msclmd.dll
2011-11-21 04:34:49 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll
2011-10-03 12:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2011-09-29 04:03:32 3144704 —-a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 15:44:41.87 ===============
ken545
Desktop.ini is in there , its inside the GAC_32 folder
C:\Windows\assembly\GAC_32 - Parameters: "(none)"
—Files—
Desktop.ini –ahs– 4096 bytes [11:24 20/11/2011] [11:57 01/12/2011]
I need you to download HostsXpert but dont run it yet, just leave it on your desktop,
Download the HostsXpert 4.3 - Hosts File Manager.
Now run this fix with OTM
Now run HostsXpert
Post the log from OTM and then run DDS again and post a new log please
C:\Windows\assembly\GAC_32 - Parameters: "(none)"
—Files—
Desktop.ini –ahs– 4096 bytes [11:24 20/11/2011] [11:57 01/12/2011]
I need you to download HostsXpert but dont run it yet, just leave it on your desktop,
Download the HostsXpert 4.3 - Hosts File Manager.
- Unzip HostsXpert 4.2.0.0 - Hosts File Manager to a convenient folder such as C:\HostsXpert
- Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
- Click "Make Hosts Writable?" in the upper left corner.
- Click Restore Microsoft's Hosts file and then click OK.
- Click the X to exit the program.
- Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
Now run this fix with OTM
- Please download OTM by OldTimer and save it to your desktop.
- Double click the [external image: Posted Image] icon on your desktop.
- Paste the following code under the [external image: Posted Image] area.
Do not include the word "Code".
:Processes explorer.exe :Services :Reg :Files C:\Windows\SysNative\drivers\etc\hosts :Commands [purity] [emptytemp] [start explorer] [Reboot]
- Push the large [external image: Posted Image] button.
- OTM may ask to reboot the machine. Please do so if asked.
- Copy/Paste the contents under the [external image: Posted Image] line here in your next reply.
- If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Now run HostsXpert
Post the log from OTM and then run DDS again and post a new log please
mistaben
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File move failed. C:\Windows\SysNative\drivers\etc\hosts scheduled to be moved on reboot.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Tony
->Temp folder emptied: 53614021 bytes
->Temporary Internet Files folder emptied: 12487796 bytes
->Java cache emptied: 607414 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 470 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3470 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 64.00 mb
OTM by OldTimer - Version 3.1.19.0 log created on 12032011_172237
Files moved on Reboot…
File move failed. C:\Windows\SysNative\drivers\etc\hosts scheduled to be moved on reboot.
C:\Users\Tony\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot…
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI