What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ping.exe virus problems [Solved]

61 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #61
Hi catherine,

No its there it is just hiding. This is a tricky one that will try to protect itself.

Do you recognize either of these >> DISRUPTIVE INNOVATIONS or BLUEGRIFFON
Post #62
disruptive innovations created a html composer program i tried one night called nvu. http://www.nvu.com/ i uninstalled that one because it wasn't what i need. blue griphon is a wysiwyg html composer program. so is sea monkey. as i put up a website of stories now and then i needed one because the old netscape composer won't work on windows 7. i went to their sites through wiki and that was after the first virus showed up. i made sure to make sure and scan the downloads before i did anything. that was after i wrote to the forum and before you answered because i had stuff i had to put up friday.
Post #63
Hi catherine,

Thanks for letting me know that you are aware of those. I am not seeing the jjv.exe in the logs….Lets look for it again in a different way.

  • Right-click and Run as Administrator SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
jjv.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #64
is it possible that security center 2012 virus is creating jjv.exe as a front and it's in another file? i was looking things up on it earlier and saw that mention. SystemLook 27.08.10 by jpshortstuff Log created at 17:10 on 20/12/2011 by laptop Administrator - Elevation successful ========== filefind ========== Searching for "jjv.exe" No files found. -= EOF =-
Post #65
Hi catherine,

Yup…that is what I think is happening.
————–

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\ProgramData\222620n4p360q763c457a6gir7g0

:Files
inconfig /flushdns /c

:Commands
[purity]
[emptyflash]
[emptyjava]
[resethosts]
[clearallrestorepoints]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
—————

Once that is complete run Malwarebytes again as a Full Scan.
———-

In your next reply please post the logs created by OTL and the log created by Malwarebytes. :)
Post #66
question first. i was looking at the code. why are we removing all the old restore points? shouldn't i have those just in case? I might need a very clean one sometime.
Post #68
but what if i need one of the earlier ones, like the one that happened right after i turned on the computer for the first time? i know combofix has set up one every other time you've had me run it, but i have 2 or 3 earlier ones too.
Post #69
Hi catherine,

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

If you are not comfortable with the other fix use this one…

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\ProgramData\222620n4p360q763c457a6gir7g0

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
———-

Now please run Malwarebytes with a Full Scan once again and save the log for your next reply.
———-

In your next reply please post the logs created by OTL and the log created by Malwarebytes.
Post #70
OTL logfile created on: 12/20/2011 5:49:16 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\laptop\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.48 Gb Total Physical Memory | 2.01 Gb Available Physical Memory | 57.73% Memory free
6.96 Gb Paging File | 5.10 Gb Available in Paging File | 73.29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.37 Gb Total Space | 476.74 Gb Free Space | 82.00% Space Free | Partition Type: NTFS

Computer Name: LAPTOP-PC | User Name: laptop | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\laptop\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\yui.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\pcre.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (TOSHIBA eco Utility Service) – C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation)
SRV:64bit: - (TPCHSrv) – C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (GFNEXSrv) – C:\Windows\SysNative\GFNEXSrv.exe ()
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TMachInfo) – C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (Amazon Download Agent) – C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe (Amazon.com)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (PGEffect) – C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Tosrfusb) – C:\Windows\SysNative\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BtFilter) – C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (tosrfec) – C:\Windows\SysNative\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (TVALZFL) – C:\Windows\SysNative\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/17 12:12:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/11/30 12:08:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.5\extensions\\Components: C:\Program Files (x86)\SeaMonkey\components [2011/12/16 04:11:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.5\extensions\\Plugins: C:\Program Files (x86)\SeaMonkey\plugins

[2011/08/26 05:01:46 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\Extensions
[2011/12/20 17:47:54 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions
[2011/08/27 16:43:38 | 000,000,000 | —D | M] (Ad blocker) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/12/17 12:12:30 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/09/30 18:30:33 | 000,000,000 | —D | M] (Webmail Ad Blocker) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\[removed]
[2011/10/07 21:02:14 | 000,000,000 | —D | M] (Read It Later) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\[removed]
[2011/12/16 04:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\SeaMonkey\Profiles\bvn00hqz.default\extensions
[2011/12/20 17:47:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/12/14 00:54:27 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
[2011/11/30 12:08:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/11 16:48:12 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2011/12/18 11:27:32 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe (Amazon.com)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - %SystemRoot%\System32\winrnr.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A0273F09-A733-49EC-9049-CD0F840D449E}: DhcpNameServer = 192.168.1.1
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/20 17:42:48 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011/12/20 17:42:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2011/12/20 17:41:42 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\laptop\Desktop\erunt-setup.exe
[2011/12/20 03:10:59 | 000,000,000 | —D | C] – C:\ProgramData\Rumbic Studio
[2011/12/20 00:47:07 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maestro - Music of Death
[2011/12/20 00:47:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maestro - Music of Death
[2011/12/20 00:47:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\Maestro - Music of Death
[2011/12/20 00:13:42 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Playrix Entertainment
[2011/12/19 23:51:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bubble Odyssey
[2011/12/19 23:51:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bubble Odyssey
[2011/12/19 23:49:49 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Royal Envoy 2 Collector's Edition
[2011/12/19 23:49:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Royal Envoy 2 Collector's Edition
[2011/12/19 23:49:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Royal Envoy 2 Collector's Edition
[2011/12/19 23:12:59 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/19 19:12:26 | 004,345,296 | R— | C] (Swearware) – C:\Users\laptop\Desktop\ComboFix.exe
[2011/12/19 19:02:54 | 000,000,000 | —D | C] – C:\_OTL
[2011/12/18 21:05:38 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\laptop\Desktop\OTL.exe
[2011/12/18 17:52:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Security Client
[2011/12/18 17:52:37 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/12/18 11:05:51 | 001,163,104 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Users\laptop\Desktop\avg_remover_stf_x86_2011_1322.exe
[2011/12/17 12:17:09 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\QuickScan
[2011/12/16 11:10:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2011/12/16 11:10:04 | 002,322,184 | —- | C] (ESET) – C:\Users\laptop\Desktop\esetsmartinstaller_enu.exe
[2011/12/16 04:11:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SeaMonkey
[2011/12/16 04:11:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\SeaMonkey
[2011/12/16 03:32:54 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL
[2011/12/16 03:32:54 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Local\Disruptive Innovations SARL
[2011/12/16 03:32:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueGriffon
[2011/12/16 03:32:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\BlueGriffon
[2011/12/16 02:47:06 | 000,000,000 | —D | C] – C:\ProgramData\Blumentals
[2011/12/16 00:44:42 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/15 15:12:11 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2011/12/15 15:12:11 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2011/12/15 15:12:11 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2011/12/15 15:11:45 | 000,000,000 | —D | C] – C:\windows\ERDNT
[2011/12/15 15:11:39 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/15 13:54:48 | 000,000,000 | —D | C] – C:\Users\laptop\Desktop\tdsskiller
[2011/12/15 13:47:31 | 000,000,000 | —D | C] – C:\Users\laptop\Desktop\gmer
[2011/12/13 22:46:39 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/13 22:46:07 | 000,607,260 | R— | C] (Swearware) – C:\Users\laptop\Desktop\dds.scr
[2011/12/13 18:01:15 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2011/12/13 18:00:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2011/12/13 17:50:16 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2011/12/13 17:49:48 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2011/12/13 14:45:38 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Malwarebytes
[2011/12/13 14:44:51 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/13 14:44:48 | 000,025,416 | —- | C] (Malwarebytes Corporation) – C:\windows\SysNative\drivers\mbam.sys
[2011/12/13 14:44:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/12/03 23:36:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition
[2011/12/03 18:49:57 | 000,000,000 | —D | C] – C:\ProgramData\Playrix Entertainment
[2011/12/03 18:33:20 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\My Games
[2011/12/03 17:42:59 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\MumboJumbo
[2011/12/03 17:21:27 | 000,000,000 | —D | C] – C:\ProgramData\TERMINAL Studio
[2011/12/03 12:45:35 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Local\Tific
[2011/12/03 11:17:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor Adventures
[2011/12/03 11:17:05 | 000,057,344 | —- | C] (Reflexive) – C:\windows\SysWow64\Big Kahuna Reef.scr
[2011/12/03 11:17:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Big Kahuna Reef
[2011/12/03 11:02:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Double Play Jewel Quest 2 and 3
[2011/12/03 10:55:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Royal Envoy
[2011/12/03 10:42:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Samantha Swift and the Mystery from Atlantis
[2011/12/03 10:26:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Big Kahuna Reef 2
[2011/12/03 10:25:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\The Rise Of Atlantis
[2011/12/03 10:23:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sky Kingdoms
[2011/12/03 10:20:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\Heroes Of Hellas
[2011/12/03 10:19:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Call Of Atlantis
[2011/12/03 10:13:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Atlantis Quest
[2011/12/03 10:11:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor HD
[2011/12/03 10:10:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Samantha Swift Fountains of Fate
[2011/12/03 09:52:45 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\Amazon Downloads
[2011/12/03 09:52:40 | 000,000,000 | —D | C] – C:\ProgramData\Amazon
[2011/12/03 09:52:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2011/12/03 09:52:33 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Amazon Games & Software
[2011/12/03 09:52:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Amazon
[2011/12/02 23:34:22 | 000,000,000 | —D | C] – C:\ProgramData\Fugazo
[2011/12/02 16:57:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mythic Pearls - The Legend of Tirnanog
[2011/12/02 16:53:49 | 000,000,000 | —D | C] – C:\ProgramData\Intenium
[2011/12/02 16:45:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor - 5th Passage
[2011/11/30 12:10:59 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\OpenOffice.org
[2011/11/30 12:09:48 | 000,000,000 | –SD | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011/11/30 12:08:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\OpenOffice.org 3
[2011/11/30 12:08:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2011/11/30 12:08:17 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaws.exe
[2011/11/30 12:08:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaw.exe
[2011/11/30 12:08:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\SysWow64\java.exe
[2011/11/30 12:08:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2011/11/30 11:31:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe
[2011/11/27 19:04:22 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Oberon Games

========== Files - Modified Within 30 Days ==========

[2011/12/20 17:53:54 | 000,024,400 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/20 17:53:54 | 000,024,400 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/20 17:52:58 | 000,688,904 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2011/12/20 17:52:58 | 000,596,860 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2011/12/20 17:52:58 | 000,097,834 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2011/12/20 17:46:18 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/12/20 17:46:13 | 2801,418,240 | -HS- | M] () – C:\hiberfil.sys
[2011/12/20 17:42:49 | 000,000,880 | —- | M] () – C:\Users\laptop\Desktop\ERUNT.lnk
[2011/12/20 17:41:52 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\laptop\Desktop\erunt-setup.exe
[2011/12/20 16:29:42 | 000,007,606 | —- | M] () – C:\Users\laptop\AppData\Local\Resmon.ResmonCfg
[2011/12/19 19:13:00 | 004,345,296 | R— | M] (Swearware) – C:\Users\laptop\Desktop\ComboFix.exe
[2011/12/18 21:05:43 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\laptop\Desktop\OTL.exe
[2011/12/18 19:24:01 | 000,095,744 | —- | M] () – C:\Users\laptop\Desktop\SystemLook_x64.exe
[2011/12/18 17:52:58 | 000,001,945 | —- | M] () – C:\windows\epplauncher.mif
[2011/12/18 17:52:47 | 000,702,750 | —- | M] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/12/18 11:27:32 | 000,000,027 | —- | M] () – C:\windows\SysNative\drivers\etc\hosts
[2011/12/18 11:05:52 | 001,163,104 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Users\laptop\Desktop\avg_remover_stf_x86_2011_1322.exe
[2011/12/16 15:10:58 | 000,458,240 | —- | M] () – C:\Users\laptop\Desktop\CKScanner.exe
[2011/12/16 15:10:36 | 000,458,240 | —- | M] () – C:\Users\laptop\Desktop\CKScanner.exe.part
[2011/12/16 14:43:19 | 000,004,540 | —- | M] () – C:\Users\laptop\Desktop\avg scan.csv
[2011/12/16 11:10:24 | 002,322,184 | —- | M] (ESET) – C:\Users\laptop\Desktop\esetsmartinstaller_enu.exe
[2011/12/15 16:06:50 | 000,139,264 | —- | M] () – C:\Users\laptop\Desktop\SystemLook.exe
[2011/12/13 22:46:10 | 000,607,260 | R— | M] (Swearware) – C:\Users\laptop\Desktop\dds.scr
[2011/12/13 15:38:56 | 000,458,752 | —- | M] () – C:\windows\SysNative\Ikeext.etl
[2011/12/05 18:49:43 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/12/03 00:10:11 | 000,372,016 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2011/11/30 12:08:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\deployJava1.dll
[2011/11/30 12:08:07 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaws.exe
[2011/11/30 12:08:07 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaw.exe
[2011/11/30 12:08:07 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\java.exe

========== Files Created - No Company Name ==========

[2011/12/20 17:42:49 | 000,000,899 | —- | C] () – C:\Users\laptop\Desktop\NTREGOPT.lnk
[2011/12/20 17:42:49 | 000,000,880 | —- | C] () – C:\Users\laptop\Desktop\ERUNT.lnk
[2011/12/18 19:24:00 | 000,095,744 | —- | C] () – C:\Users\laptop\Desktop\SystemLook_x64.exe
[2011/12/18 17:52:40 | 000,001,908 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/12/16 15:10:34 | 000,458,240 | —- | C] () – C:\Users\laptop\Desktop\CKScanner.exe
[2011/12/16 15:10:31 | 000,458,240 | —- | C] () – C:\Users\laptop\Desktop\CKScanner.exe.part
[2011/12/16 14:43:19 | 000,004,540 | —- | C] () – C:\Users\laptop\Desktop\avg scan.csv
[2011/12/16 10:42:34 | 000,001,945 | —- | C] () – C:\windows\epplauncher.mif
[2011/12/15 16:06:49 | 000,139,264 | —- | C] () – C:\Users\laptop\Desktop\SystemLook.exe
[2011/12/15 15:12:11 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2011/12/15 15:12:11 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2011/12/15 15:12:11 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2011/12/15 15:12:11 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2011/12/15 15:12:11 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2011/12/13 17:39:17 | 000,007,606 | —- | C] () – C:\Users\laptop\AppData\Local\Resmon.ResmonCfg
[2011/12/05 18:49:43 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/11/30 11:32:03 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/10/16 04:05:33 | 000,002,951 | —- | C] () – C:\windows\SysWow64\settings.bin
[2011/10/16 02:05:51 | 000,702,750 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/10/15 22:24:50 | 000,007,112 | —- | C] () – C:\windows\mozver.dat
[2011/10/15 00:29:35 | 000,000,335 | —- | C] () – C:\windows\nsreg.dat
[2011/10/11 22:54:25 | 000,004,096 | —- | C] () – C:\windows\d3dx.dat
[2011/10/10 20:35:44 | 000,000,574 | —- | C] () – C:\windows\hpomdl46.dat.temp
[2011/09/14 11:06:40 | 000,207,034 | —- | C] () – C:\windows\hpoins46.dat
[2011/09/05 22:44:51 | 000,000,000 | —- | C] () – C:\windows\ativpsrm.bin
[2011/09/05 22:37:34 | 000,003,929 | —- | C] () – C:\windows\SysWow64\atipblag.dat
[2011/08/25 12:38:12 | 000,061,678 | —- | C] () – C:\Users\laptop\AppData\Roaming\PFP100JPR.{PB
[2011/08/25 12:38:12 | 000,012,358 | —- | C] () – C:\Users\laptop\AppData\Roaming\PFP100JCM.{PB
[2011/08/25 11:57:18 | 000,000,420 | —- | C] () – C:\windows\PowerReg.dat
[2011/08/24 11:58:34 | 000,128,312 | —- | C] () – C:\windows\SysWow64\GFNEX.dll
[2011/02/03 21:56:58 | 000,066,856 | —- | C] () – C:\windows\SysWow64\SynTPEnhPS.dll
[2010/03/31 19:34:36 | 000,000,574 | —- | C] () – C:\windows\hpomdl46.dat
[2009/07/14 00:38:36 | 000,067,584 | –S- | C] () – C:\windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | —- | C] () – C:\windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | —- | C] () – C:\windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | —- | C] () – C:\windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\windows\SysWow64\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:D667795F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:A0921B2C
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:AE289451
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:F9EDCFB0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:58EBEBDC

< End of report >

and the quick fix log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0 moved successfully.
C:\ProgramData\222620n4p360q763c457a6gir7g0 moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\laptop\Desktop\cmd.bat deleted successfully.
C:\Users\laptop\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: laptop
->Temp folder emptied: 7434077 bytes
->Temporary Internet Files folder emptied: 513810 bytes
->Java cache emptied: 184060 bytes
->FireFox cache emptied: 89040753 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1869 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16578 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 428659 bytes

Total Files Cleaned = 93.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 12202011_174451

Files\Folders moved on Reboot…
C:\Users\laptop\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot…
Post #71
Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8400 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 12/20/2011 7:22:31 PM mbam-log-2011-12-20 (19-22-31).txt Scan type: Full scan (C:\|Q:\|) Objects scanned: 480261 Time elapsed: 1 hour(s), 25 minute(s), 32 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #72 last edited
any idea how i get my search function back? i can't find it anywhere. thanks. edit: i found out how online
Post #73
Hi catherine, I am glad to see you got your search bar back and functioning. Are you still experiencing any problems? Are you having any redirects by chance?
Post #74
no, i haven't had any redirects recently. thank you for all your help. what can i erase of all those scans and programs? they've taken over half of my desktop.
Post #75
Hi catherine, Sorry…I just want to clarify…are you experiencing any more problems? Run a scan with DDS once more and post that log into your next reply to get one last look. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI