What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Web page hijacked on my PC ?

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Running XP Home edition sp3 with no problems until now. After doing some xMas ordering on secure sites, one particular page will not open it goes white. It is the PapaJohns pizza site. The address tab has a little square where a dash should be. I ran hiJackthis and checked the registry keys line by line from a clean machine log file from 2008. Nothing found by me. The PapaJohns site will open on my wife’s computer without problems. It almost seems that this one page has been hijacked on my PC. Address bar is here : http://order.papajohns.com/index.html?fb_x…or=unknown_user Any thoughts why this one page will not open for me ? Is this a symptom of a larger infection ?



Thanks in advance
Post #2
Welcome to WhatTheTech nekia,

Sure haven't heard of any pizza site malwares. May just be an accidental site block got placed in your browser's settings. Which browser did you use when you have problems with that site? Post back on that, and let's get a look at what all is there as well.

To make sure you have an accurate view of files there, make sure you can View Hidden Files. Also uncheck "Hide Extensions for Known File Types"

To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Here are some antivirus disable tips if needed.

——————

Click here and download OldTimer's OTL to your desktop, then click that to open the scan display. At the top click "Scan All Users", then click "Run Scan". Make no other changes at this time.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are also saved in the same location as OTL.exe. Post the contents of those back here please.
Post #3
Thanks for responding Jintan, I was running Windows IE 7. Since I posted, I went to msconfig and tried safe mode upon boot and did a restore point 2 weeks earlier when I knew I didn't have any problems. BIG MISTAKE ! I since undid the safe boot and restore point. The only other change was I stopped OpenOffice.org upon boot. Did your instructions and attached the OTL.txt. However no extras came from the scan. I have not gone to the pizza site yet until I hear back from you. If anyone else reads this post - don't do a restore point unless you REALLY know what your are doing. Thanks again for your post Jintan

Attachments:

Post #4
I haven't been active here in a while, and see I am not getting email notifications, so sorry about the delay. All logs need to be posted here, directly in the thread, but I will go ahead and post the OTL log you attached, so we can get rolling.

Before we go to much further:

I went to msconfig and tried safe mode upon boot


Really better you and I work as a team here. That method of accessing Safe Mode has been discredited as a viable option - if the system just reboots when entering safe Mode, due to some malware or other problem, that leaves the system in a boot loop. Rebooting over and over, to safe Mode, failed, and back to safe Mode and failing again.

OTL logfile created on: 12/18/2011 5:35:18 PM - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Ronald Aiken\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.07 Mb Total Physical Memory | 235.48 Mb Available Physical Memory | 46.90% Memory free
1.20 Gb Paging File | 0.56 Gb Available in Paging File | 46.42% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.15 Gb Total Space | 39.27 Gb Free Space | 55.20% Space Free | Partition Type: NTFS

Computer Name: D98BYVB1 | User Name: Ronald Aiken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/18 16:46:52 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Ronald Aiken\Desktop\OTL.exe
PRC - [2011/10/15 04:15:26 | 000,140,952 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe
PRC - [2011/10/07 07:27:16 | 000,136,584 | —- | M] (LogMeIn, Inc.) – C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2011/10/07 07:27:01 | 000,374,152 | —- | M] (LogMeIn, Inc.) – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2011/02/23 16:11:22 | 000,323,584 | —- | M] (Eastman Kodak Company) – C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
PRC - [2011/02/16 14:26:04 | 000,188,272 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
PRC - [2011/02/10 09:00:24 | 000,116,752 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
PRC - [2011/02/10 08:57:40 | 001,035,512 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
PRC - [2010/11/08 12:04:18 | 000,390,528 | —- | M] (LogMeIn, Inc.) – C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2010/08/08 05:35:32 | 000,138,640 | —- | M] (Trend Micro Inc.) – C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
PRC - [2010/03/18 10:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/11/11 08:20:05 | 000,122,880 | —- | M] (Google Inc.) – C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
PRC - [2009/01/18 08:56:30 | 000,632,048 | —- | M] (eBay Inc.) – C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/04/17 13:03:50 | 000,063,048 | —- | M] (LogMeIn, Inc.) – C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2006/09/23 11:57:06 | 000,026,112 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\realplay.exe
PRC - [2006/02/09 17:34:54 | 000,106,496 | —- | M] (Corel, Inc.) – C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
PRC - [2005/10/05 02:12:00 | 000,094,208 | —- | M] () – C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2005/08/24 18:25:00 | 000,101,080 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Location Finder\LocationFinder.exe
PRC - [2002/12/16 06:26:20 | 000,045,056 | —- | M] (Lexmark International, Inc.) – C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
PRC - [2002/12/16 06:10:34 | 000,086,102 | —- | M] (Lexmark International, Inc.) – C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/22 10:05:57 | 000,103,424 | —- | M] () – C:\Program Files\Google\Quick Search Box\bin\1.2.1151.245\rlz.dll
MOD - [2011/10/16 05:18:16 | 011,490,816 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011/07/26 08:08:49 | 000,143,360 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll
MOD - [2011/07/26 08:08:48 | 000,688,128 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll
MOD - [2011/07/26 08:08:47 | 000,237,568 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll
MOD - [2011/07/26 08:08:46 | 000,847,872 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2V.dll
MOD - [2011/07/26 08:08:46 | 000,528,384 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProcV.dll
MOD - [2011/07/26 08:08:46 | 000,155,648 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxZipV.dll
MOD - [2011/07/26 08:08:45 | 002,236,416 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmpV.dll
MOD - [2011/07/26 08:08:45 | 001,396,736 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommonV.dll
MOD - [2011/07/26 08:08:45 | 000,782,336 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxImV.dll
MOD - [2011/07/26 08:08:45 | 000,462,848 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFFV.dll
MOD - [2011/07/26 08:08:44 | 000,868,352 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBaseV.dll
MOD - [2011/07/26 08:08:40 | 000,010,240 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll
MOD - [2011/07/26 08:08:37 | 000,044,544 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll
MOD - [2011/07/26 08:08:36 | 000,090,112 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll
MOD - [2011/07/26 08:08:33 | 000,406,016 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll
MOD - [2011/07/26 08:08:33 | 000,129,536 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll
MOD - [2011/07/26 08:08:33 | 000,084,480 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll
MOD - [2011/07/26 08:08:33 | 000,052,224 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll
MOD - [2011/07/26 08:08:31 | 000,471,040 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll
MOD - [2011/07/26 08:08:29 | 001,564,672 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\areaifdll.dll
MOD - [2011/07/26 08:08:29 | 000,356,352 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll
MOD - [2011/07/26 08:08:29 | 000,062,464 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\DibLibIP.dll
MOD - [2011/07/26 08:08:28 | 000,264,192 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\AppCore.dll
MOD - [2011/07/26 08:08:26 | 000,315,392 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx
MOD - [2011/07/26 08:08:24 | 000,234,496 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaControls.esx
MOD - [2011/07/26 08:08:23 | 000,098,304 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx
MOD - [2011/07/26 08:08:22 | 000,339,968 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx
MOD - [2011/07/26 08:08:22 | 000,084,480 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx
MOD - [2011/07/26 08:08:21 | 000,171,520 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\Pcd.esx
MOD - [2011/07/26 08:08:19 | 000,152,576 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx
MOD - [2011/07/26 08:08:18 | 011,503,616 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\ESSkin.esx
MOD - [2011/07/26 08:08:05 | 000,684,032 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\ESEmail.esx
MOD - [2011/07/26 08:08:00 | 000,761,856 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCliWicMDRW.esx
MOD - [2011/07/26 08:07:57 | 000,078,848 | —- | M] () – C:\Program Files\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx
MOD - [2011/02/17 14:28:30 | 000,509,456 | —- | M] () – C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarHelper.dll
MOD - [2011/02/17 14:28:30 | 000,029,200 | —- | M] () – C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\components\TBMenuSetting.dll
MOD - [2011/02/17 14:28:30 | 000,029,200 | —- | M] () – C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\components\TBMenuHelp.dll
MOD - [2011/02/16 22:42:44 | 000,057,344 | —- | M] () – C:\Program Files\Trend Micro\Titanium\UIFramework\boost_date_time-vc80-mt-1_36.dll
MOD - [2011/02/16 22:42:44 | 000,049,152 | —- | M] () – C:\Program Files\Trend Micro\Titanium\UIFramework\boost_thread-vc80-mt-1_36.dll
MOD - [2010/09/01 16:05:50 | 000,034,816 | —- | M] () – C:\Program Files\Google\Google Desktop Search\gzlib.dll
MOD - [2010/08/08 05:35:32 | 001,081,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\libprotobuf.dll
MOD - [2010/08/08 05:35:32 | 000,442,368 | —- | M] () – C:\Program Files\Trend Micro\AMSP\sqlite3.dll
MOD - [2010/08/08 05:35:32 | 000,057,344 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll
MOD - [2010/08/08 05:35:32 | 000,049,152 | —- | M] () – C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll
MOD - [2010/08/08 05:04:30 | 000,174,432 | —- | M] () – C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll
MOD - [2007/01/08 07:32:22 | 000,036,864 | —- | M] () – C:\WINDOWS\system32\LXBRPMON.DLL
MOD - [2005/10/05 02:12:00 | 000,094,208 | —- | M] () – C:\Program Files\Dell\Media Experience\DMXLauncher.exe
MOD - [2005/05/25 08:07:26 | 000,061,440 | —- | M] () – C:\WINDOWS\system32\lxbmcnv4.dll
MOD - [2002/11/01 05:15:00 | 000,049,152 | —- | M] () – C:\Program Files\Lexmark X5100 Series\ConvDIB.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – – (HidServ)
SRV - File not found [On_Demand | Stopped] – – (AppMgmt)
SRV - [2011/10/07 07:27:16 | 000,136,584 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files\LogMeIn\x86\RaMaint.exe – (LMIMaint)
SRV - [2011/10/07 07:27:01 | 000,374,152 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe – (LMIGuardianSvc)
SRV - [2011/02/16 14:26:04 | 000,188,272 | —- | M] (Trend Micro Inc.) [Auto | Running] – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe – (Amsp)
SRV - [2010/11/08 12:04:18 | 000,390,528 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files\LogMeIn\x86\LogMeIn.exe – (LogMeIn)
SRV - [2010/03/18 10:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [Auto | Running] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2007/01/30 10:37:40 | 000,537,520 | —- | M] ( ) [Disabled | Stopped] – C:\WINDOWS\System32\lxbmcoms.exe – (lxbm_device)


========== Driver Services (SafeList) ==========

DRV - [2011/10/07 07:27:04 | 000,083,360 | —- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] – C:\WINDOWS\System32\LMIRfsClientNP.dll – (LMIRfsClientNP)
DRV - [2010/08/08 05:35:34 | 000,341,072 | —- | M] (Trend Micro Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\TM_CFW.sys – (tmcfw)
DRV - [2010/08/08 05:35:34 | 000,189,520 | —- | M] (Trend Micro Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\tmcomm.sys – (tmcomm)
DRV - [2010/08/08 05:35:34 | 000,092,112 | —- | M] (Trend Micro Inc.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tmtdi.sys – (tmtdi)
DRV - [2010/08/08 05:35:34 | 000,080,464 | —- | M] (Trend Micro Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\tmactmon.sys – (tmactmon)
DRV - [2010/08/08 05:35:34 | 000,064,080 | —- | M] (Trend Micro Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\tmevtmgr.sys – (tmevtmgr)
DRV - [2010/06/09 09:49:35 | 000,013,408 | —- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\radpms.sys – (radpms)
DRV - [2008/10/17 16:38:26 | 000,047,640 | —- | M] (LogMeIn, Inc.) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\LMIRfsDriver.sys – (LMIRfsDriver)
DRV - [2008/02/28 14:31:50 | 000,012,856 | —- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] – C:\Program Files\LogMeIn\x86\rainfo.sys – (LMIInfo)
DRV - [2006/09/23 11:57:09 | 000,008,552 | —- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\asctrm.sys – (ASCTRM)
DRV - [2006/02/10 17:19:12 | 001,107,224 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sthda.sys – (STHDA)
DRV - [2006/01/10 11:07:58 | 000,004,864 | —- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] – C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2005/09/08 04:20:00 | 000,094,332 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDFAM.SYS – (DLAUDFAM)
DRV - [2005/09/08 04:20:00 | 000,087,036 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAUDF_M.SYS – (DLAUDF_M)
DRV - [2005/09/08 04:20:00 | 000,086,524 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAIFS_M.SYS – (DLAIFS_M)
DRV - [2005/09/08 04:20:00 | 000,025,628 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLABOIOM.SYS – (DLABOIOM)
DRV - [2005/09/08 04:20:00 | 000,014,684 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAOPIOM.SYS – (DLAOPIOM)
DRV - [2005/09/08 04:20:00 | 000,006,364 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLAPoolM.SYS – (DLAPoolM)
DRV - [2005/09/08 04:20:00 | 000,002,496 | —- | M] (Sonic Solutions) [File_System | Auto | Running] – C:\WINDOWS\system32\DLA\DLADResN.SYS – (DLADResN)
DRV - [2005/08/25 11:16:52 | 000,005,628 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLACDBHM.SYS – (DLACDBHM)
DRV - [2005/08/25 11:16:16 | 000,022,684 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\system32\drivers\DLARTL_N.SYS – (DLARTL_N)
DRV - [2004/03/08 12:55:50 | 000,013,567 | —- | M] (B.H.A Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\CDRBSDRV.SYS – (cdrbsdrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client;=dell-usuk&channel;=us&ibd;=2060923
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client;=dell-usuk&channel;=us&ibd;=2060923
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.core.com/home/
IE - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.1851.5542\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2010/10/14 10:55:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1504\6.6.1088\firefoxextension\ [2011/12/17 08:37:17 | 000,000,000 | —D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2009/11/16 09:55:44 | 000,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1504\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (Reg Error: Value error.) - {22D8E815-4A5E-4dfb-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.)
O3 - HKLM\..\Toolbar: (eBay Toolbar) - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll File not found
O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O3 - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\..\Toolbar\WebBrowser: (IE Custom Tools) - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - C:\Program Files\Video Add-on\ictmdl.dll File not found
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe (Corel, Inc.)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe (eBay Inc.)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [Lexmark 4200 Series Fax Server] C:\Program Files\Lexmark 4200 Series\fm3032.exe ()
O4 - HKLM..\Run: [Lexmark X5100 Series] C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [lxbmmon.exe] C:\Program Files\Lexmark 4200 Series\lxbmmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKU\.DEFAULT..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe File not found
O4 - HKU\S-1-5-18..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe File not found
O4 - HKU\S-1-5-19..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe File not found
O4 - HKU\S-1-5-20..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe File not found
O4 - HKU\S-1-5-21-163452362-3896745262-1953921676-1007..\Run: [Microsoft Location Finder] C:\Program Files\Microsoft Location Finder\LocationFinder.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-163452362-3896745262-1953921676-1007..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
O4 - Startup: C:\Documents and Settings\Audriana Carmona\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe (Leader Technologies)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-163452362-3896745262-1953921676-1007\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{41B9DB08-16D4-4A15-9D98-6D5241F03AF2}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1504\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O22 - SharedTaskScheduler: {7265100a-17e1-41bf-bd08-63b95a25a9c3} - cured - C:\WINDOWS\system32\ofcpi.dll File not found
O24 - Desktop WallPaper: C:\WINDOWS\Dell.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Dell.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/18 16:46:50 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Ronald Aiken\Desktop\OTL.exe
[2011/12/18 16:29:55 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/12/18 16:29:55 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/12/18 16:29:55 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/12/16 14:53:53 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2011/12/14 19:12:06 | 000,341,072 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\TM_CFW.sys
[2011/11/22 10:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Quick Search Box
[2011/11/22 08:26:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2011/11/22 08:26:33 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/04/16 15:30:39 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxbminpa.dll
[2010/04/16 15:30:39 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXBMhcp.dll
[2010/04/16 15:30:38 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxbmiesc.dll
[2010/04/16 15:30:37 | 000,991,232 | —- | C] ( ) – C:\WINDOWS\System32\lxbmusb1.dll
[2010/04/16 15:30:36 | 001,224,704 | —- | C] ( ) – C:\WINDOWS\System32\lxbmserv.dll
[2010/04/16 15:30:36 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxbmprox.dll
[2010/04/16 15:30:35 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxbmpmui.dll
[2010/04/16 15:30:35 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxbmpplc.dll
[2010/04/16 15:30:34 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxbmlmpm.dll
[2010/04/16 15:30:32 | 000,385,968 | —- | C] ( ) – C:\WINDOWS\System32\lxbmih.exe
[2010/04/16 15:30:31 | 000,696,320 | —- | C] ( ) – C:\WINDOWS\System32\lxbmhbn3.dll
[2010/04/16 15:30:28 | 000,537,520 | —- | C] ( ) – C:\WINDOWS\System32\lxbmcoms.exe
[2010/04/16 15:30:28 | 000,421,888 | —- | C] ( ) – C:\WINDOWS\System32\lxbmcomm.dll
[2010/04/16 15:30:27 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxbmcomc.dll
[2010/04/16 15:30:27 | 000,381,872 | —- | C] ( ) – C:\WINDOWS\System32\lxbmcfg.exe
[2007/01/26 08:44:40 | 003,050,064 | —- | C] (InstallShield Software Corporation) – C:\Program Files\eBayToolbarSetup.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/18 17:20:20 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/18 16:46:52 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Ronald Aiken\Desktop\OTL.exe
[2011/12/17 20:28:23 | 000,001,565 | —- | M] () – C:\WINDOWS\Lexstat.ini
[2011/12/17 20:16:24 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/17 20:16:05 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/17 20:16:03 | 526,536,704 | -HS- | M] () – C:\hiberfil.sys
[2011/12/17 20:15:06 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2011/12/17 20:10:53 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/12/17 08:43:03 | 000,313,968 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/16 11:30:09 | 000,004,698 | —- | M] () – C:\Documents and Settings\Ronald Aiken\Application Data\wklnhst.dat
[2011/12/16 11:05:24 | 000,008,491 | —- | M] () – C:\Documents and Settings\Ronald Aiken\Desktop\Log 12 16 11
[2011/12/14 19:22:27 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/13 08:46:08 | 000,000,450 | —- | M] () – C:\WINDOWS\tasks\EasyShare Registration Task.job
[2011/11/29 11:30:52 | 003,739,648 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2011/11/29 11:30:51 | 001,671,168 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2011/11/23 08:25:32 | 001,859,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\win32k.sys
[2011/11/23 08:25:32 | 001,859,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\win32k.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/17 20:16:03 | 526,536,704 | -HS- | C] () – C:\hiberfil.sys
[2011/12/16 11:05:23 | 000,008,491 | —- | C] () – C:\Documents and Settings\Ronald Aiken\Desktop\Log 12 16 11
[2010/10/15 12:49:09 | 000,000,127 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2010/04/16 15:31:53 | 000,344,064 | —- | C] () – C:\WINDOWS\System32\lxbmcoin.dll
[2010/04/16 15:31:53 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbmvs.dll
[2010/04/16 15:30:40 | 000,274,432 | —- | C] () – C:\WINDOWS\System32\LXBMinst.dll
[2010/04/16 15:30:38 | 000,413,696 | —- | C] () – C:\WINDOWS\System32\lxbmutil.dll
[2010/02/19 15:23:08 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2009/08/20 19:22:34 | 000,003,350 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/08/20 19:22:34 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\7EA6B6BF5D.sys
[2009/02/17 21:09:32 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\LXBAIH.EXE
[2009/02/17 21:09:29 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\INSTMON.EXE
[2009/02/17 21:09:28 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBALCNP.DLL
[2008/04/29 20:08:19 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\LXBRPMON.DLL
[2008/04/29 20:08:19 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\LXBRPMUI.DLL
[2008/04/29 20:04:01 | 000,001,565 | —- | C] () – C:\WINDOWS\Lexstat.ini
[2008/02/03 11:51:45 | 000,016,384 | —- | C] () – C:\Documents and Settings\Ronald Aiken\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/29 20:28:20 | 000,004,698 | —- | C] () – C:\Documents and Settings\Ronald Aiken\Application Data\wklnhst.dat
[2007/10/06 19:09:35 | 013,411,824 | —- | C] () – C:\Program Files\Google_Earth_BZXV.exe
[2007/06/16 08:40:26 | 000,001,513 | —- | C] () – C:\WINDOWS\disney.ini
[2007/06/09 19:03:02 | 000,000,315 | —- | C] () – C:\WINDOWS\ka.ini
[2007/02/03 10:37:44 | 000,000,168 | —- | C] () – C:\WINDOWS\BluesCluesKindergarten.ini
[2007/02/03 10:15:09 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2007/02/03 09:59:04 | 000,000,479 | —- | C] () – C:\WINDOWS\hegames.ini
[2007/01/26 08:44:08 | 003,162,248 | —- | C] () – C:\Program Files\ToolbarSetup.exe
[2007/01/21 14:24:39 | 000,000,384 | —- | C] () – C:\WINDOWS\dellstat.ini
[2006/09/23 12:11:47 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/09/23 12:07:29 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/09/23 12:02:40 | 000,000,503 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/09/23 11:59:12 | 000,149,504 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2006/09/23 11:56:23 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/09/23 11:33:02 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2006/09/23 11:32:38 | 000,000,392 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 07:56:34 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/05/25 08:07:26 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\lxbmcnv4.dll
[2004/08/10 12:12:05 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 12:07:31 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 12:02:15 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 12:01:18 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 11:57:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 11:57:15 | 000,313,968 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 11:51:21 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 11:51:20 | 000,454,278 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 11:51:20 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 11:51:20 | 000,075,884 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 11:51:20 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 11:51:18 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 11:51:17 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/10 11:51:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 11:51:12 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 11:51:11 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 11:51:05 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 11:50:56 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/08/21 08:55:26 | 000,000,188 | —- | C] () – C:\WINDOWS\System32\lxbacoin.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Ronald Aiken\Desktop\3 17 08 log file:SummaryInformation

< End of report >
Post #5
Malware loading there, though it seems like some older entry. And some proxy settings that are likely malware-sourced.

Be sure to continue to temporarily disable any protective software when running the scan tools we use here.


Download ComboFix.exe from here to your desktop, then click that to run that scan. Agree to any warnings you might receive.

Be sure to install the Recovery Console if you are asked to do so. When the scan completes, a text window with your log will open. Please copy and paste that log back here.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI