Spyware / Malware / Virus Removal

Hijacked

8 min read

Looking for the outcome? Ask AI

vdicaprio Topic Starter

Post #1December 20, 2011, 1:47 PM UTC

Hi

I have a problem with my machine. It all started when I purchased a program on line from Nucleustechnologies "Kernel for Outlook PST Repair." They seem legit. I was having problems with the program so they told me to send them the file and they would look at it. They sent me a program to send them the file. I thought it was some type of FTP transfer but when I ran it disabled my windows firewall. It took a bout 6 hours to transfer (2 GB) file and errored out before it completed. After that I was surfing the internet and had a virus pop up. I ran malware bytes and it found and removed items but I still have problems. I'm not sure if Nucleustechnologies was the problem or if I got something when the firewall was disabled. Now that I think about it I should never have let the firewall be disabled.

Now when I try to start the Windows firewall from the control panel I received a message that says the Windows Firewall / Internet Community Sharing services is not installed and asks me if I want to start it. I have not started it.

A couple of other things that I have noticed. My Microsoft Security Essentials program is no longer running and when I tried to run it from the program menu I got a pop up window asking me what program I would like to open it with. Similarly, I tried to run mscong to look at the services running and I received the same message.

I booted-up in safe mode and when I use microsoft explorer I am automatically directed to a google website. Again in safe mode I tried to run the Microsoft Security Essentials and it just times out and never starts. Still in safe mode, I ran msconfig and it starts, however I never see the Windows Firewall / ICS service.

I downloaded and ran "hijact this" all in safe mode and the results are posted below.

Any help would be much appreciated.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:59:40 AM, on 12/20/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
C:\Documents and Settings\V\My Documents\DOWNLOADS\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=5080904
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=5080904
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=5080904
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {2e6e669c-7c46-4505-ab62-f87a53acac2c} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [DellAutomatedPCTuneUp] "C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [gebogawuya] Rundll32.exe "C:\WINDOWS\system32\hogumana.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [gebogawuya] Rundll32.exe "C:\WINDOWS\system32\hogumana.dll",s (User 'NETWORK SERVICE')
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4A769165-055C-4566-ABBB-3EA82DD4F8AE} (IVSLite.FastViewer) - http://www.ipinviewer.com/binInstall/IVSLite.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://harsco.webex.com/client/wbs26-vzbpr…bex/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE61A097-8766-41AB-9940-5E6EE0B7E491}: Domain = windstream.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE61A097-8766-41AB-9940-5E6EE0B7E491}: NameServer = 166.102.165.11,207.91.5.20
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: dkab_device - - C:\WINDOWS\system32\DKabcoms.exe
O23 - Service: elAPI - Service Server (elAPIsvc) - Unknown owner - C:\Program Files\DOS2USB\elSVC.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7376 bytes

Thanks

V

mowman

Post #2December 22, 2011, 6:48 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

vdicaprio

Post #3December 22, 2011, 10:56 PM UTC

Hello Mowman! Thanks for taking the time to work with me to clean up my computer. I downloaded and extracted the TDSSKiller program but when I go to run it a window pops up asking me which program I want to use to open it. It looks like a "real" message from windows but I dont think that it is. I get this alot when I use my machine. I have attached a screen shot of the message. I also get another message that scares me. This one I think is a legit windows message. I get a notice from windows when the computer trys to go into sleep mode that says something like it is unable because it is still connected to a network or it is still being used by a network I'll wait to hear from you…. Thanks

Attachments:

📎Screen_Shot.pdf

mowman

Post #4December 23, 2011, 10:20 AM UTC

Try this program instead,be sure to rename it as instructed first.

ownload Combofix from either of the links below. You must rename it to combo.com before saving it.
Save it to your desktop. Change the save as file type to "all files"

**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".

Link 1
Link 2

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.

Double click on the renamed ComboFix.exe & follow the prompts. When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

vdicaprio

Post #5December 23, 2011, 1:58 PM UTC

Mowman

Nothing has been easy. I hope things are okay. I thought I had my anti-virus stopped when I ran combo fix but it wasnt. I got some warnings from Combo fix alerting me that the anti-virus (Microsoft Security Essentials) was running but in trying to stop Combo fix from running, it continued (I must have hit the wrong key or something). The txt file is posted below.

Also while combo fix was running is gave me a message that the Windows Recovery Console was missing and asked me if I wanted to download it. I declined. At this time I thought I was still going to be able to stop combo fix.

While running it found a virus but I didnt get a chance to get its name. Combo fix then gave me a message that there was presence fo rootkit activity and then performed a reboot.

Anyway the log is below - thanks

ComboFix 11-12-23.01 - V 12/23/2011 8:08.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2626 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.com
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\V\g2mdlhlpx.exe
c:\documents and settings\V\Local Settings\Application Data\assembly\tmp
c:\documents and settings\V\System
c:\documents and settings\V\System\win_qs8.jqx
c:\documents and settings\V\WINDOWS
c:\windows\$NtUninstallKB58993$
c:\windows\$NtUninstallKB58993$\1015601913\@
c:\windows\$NtUninstallKB58993$\1015601913\bckfg.tmp
c:\windows\$NtUninstallKB58993$\1015601913\cfg.ini
c:\windows\$NtUninstallKB58993$\1015601913\Desktop.ini
c:\windows\$NtUninstallKB58993$\1015601913\keywords
c:\windows\$NtUninstallKB58993$\1015601913\kwrd.dll
c:\windows\$NtUninstallKB58993$\1015601913\L\rohepcid
c:\windows\$NtUninstallKB58993$\1015601913\lsflt7.ver
c:\windows\$NtUninstallKB58993$\1015601913\U\00000001.@
c:\windows\$NtUninstallKB58993$\1015601913\U\00000002.@
c:\windows\$NtUninstallKB58993$\1015601913\U\00000004.@
c:\windows\$NtUninstallKB58993$\1015601913\U\80000000.@
c:\windows\$NtUninstallKB58993$\1015601913\U\80000004.@
c:\windows\$NtUninstallKB58993$\1015601913\U\80000032.@
c:\windows\$NtUninstallKB58993$\285348948
c:\windows\dasetup.log
c:\windows\system32\drivers\npf.sys
c:\windows\system32\FM20(2).DLL
c:\windows\system32\oobe\isperror
c:\windows\system32\oobe\isperror\ispcnerr.htm
c:\windows\system32\oobe\isperror\ispdtone.htm
c:\windows\system32\oobe\isperror\isphdshk.htm
c:\windows\system32\oobe\isperror\ispins.htm
c:\windows\system32\oobe\isperror\ispnoanw.htm
c:\windows\system32\oobe\isperror\isppberr.htm
c:\windows\system32\oobe\isperror\ispphbsy.htm
c:\windows\system32\oobe\isperror\ispsbusy.htm
c:\windows\system32\Packet.dll
c:\windows\system32\regobj.dll
c:\windows\system32\wpcap.dll
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
.
Infected copy of c:\windows\system32\drivers\ipsec.sys was found and disinfected
Restored copy from - The cat found it

.
((((((((((((((((((((((((( Files Created from 2011-11-23 to 2011-12-23 )))))))))))))))))))))))))))))))
.
.
2011-12-23 13:22 . 2011-12-23 13:22 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-12-23 13:21 . 2011-12-23 13:21 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\MpKsl1e7bd425.sys
2011-12-23 13:21 . 2011-12-23 13:21 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\offreg.dll
2011-12-23 13:05 . 2008-04-14 12:00 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys
2011-12-23 12:39 . 2011-12-23 12:39 1324 —-a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp
2011-12-21 12:43 . 2011-12-21 12:44 41680 —-a-w- c:\windows\system32\drivers\vkylmhri.sys
2011-12-20 09:07 . 2011-12-20 16:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-12-20 00:18 . 2011-12-20 00:18 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2011-12-19 18:33 . 2011-11-21 07:47 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\mpengine.dll
2011-12-18 17:42 . 2004-03-09 05:00 212240 —-a-w- c:\windows\system32\RICHTX32.OCX
2011-12-18 17:42 . 2011-12-18 17:42 ——– d—–w- c:\program files\Kernel for Outlook PST Repair
2011-12-18 17:42 . 2008-09-27 00:55 1668096 —-a-w- c:\windows\system32\Redemption.dll
2011-12-15 01:45 . 2011-12-15 01:47 ——– d—–w- c:\program files\PCVITA Split Magic v2.3
2011-12-15 01:38 . 2011-12-15 01:41 ——– d—–w- c:\program files\SysTools Split PST
2011-12-14 20:50 . 2011-12-15 00:43 ——– d—–w- c:\documents and settings\V\Local Settings\Application Data\OutlookFreeware.com
2011-12-14 14:28 . 2011-12-15 02:26 ——– d—–w- c:\program files\Memecode
2011-12-13 21:07 . 2011-12-13 21:07 ——– d—–w- c:\windows\system32\wbem\Repository
2011-12-02 22:14 . 2011-12-02 22:14 ——– d—–w- c:\program files\Common Files\eDrawings2012
2011-11-28 23:04 . 2011-12-05 12:22 ——– d—–w- c:\documents and settings\V\Application Data\Atduz
2011-11-28 23:04 . 2011-12-02 22:24 ——– d—–w- c:\documents and settings\V\Application Data\Paem
2011-11-25 19:31 . 2011-11-25 19:32 ——– d—–w- c:\documents and settings\V\Application Data\gtk-2.0
2011-11-25 15:46 . 2011-11-25 16:31 ——– d—–w- c:\documents and settings\V\Application Data\SmartDraw
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:25 . 2008-04-25 16:16 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-21 07:47 . 2011-06-13 11:28 6823496 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-16 13:22 . 2011-05-19 18:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-04 19:20 . 2008-04-25 16:16 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2008-04-25 16:16 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2008-04-25 16:16 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2008-04-25 16:16 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2008-04-25 16:16 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2008-04-25 16:16 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2008-04-25 16:16 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2008-04-14 00:01 2027008 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2008-04-25 16:16 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2008-04-25 21:27 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2008-04-25 16:16 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 15:41 . 2008-07-29 23:59 611328 —-a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41 . 2008-04-25 16:16 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2008-04-25 16:16 20480 —-a-w- c:\windows\system32\oleaccrc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-02-21 159744]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-21 16855552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-22 137752]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-06-30 2220032]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
.
c:\documents and settings\V\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-9-4 7168]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Taskman"=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^V^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\documents and settings\V\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellAutomatedPCTuneUp]
2007-10-11 14:49 465136 —-a-w- c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 15:13 206064 —-a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2008-03-11 17:44 16384 —-a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiadap.exe"=
"c:\\Program Files\\Dell Network Assistant\\hnm_svc.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\WINDOWS\\system32\\BCMWLTRY.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dkabcoms.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Documents and Settings\\V\\My Documents\\OUTLOOK Repair\\FTPTransfer.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
.
R1 MpKsl1e7bd425;MpKsl1e7bd425;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\MpKsl1e7bd425.sys [12/23/2011 8:21 AM 29904]
R2 dkab_device;dkab_device;c:\windows\system32\DKabcoms.exe -service –> c:\windows\system32\DKabcoms.exe -service [?]
R2 elAPIsvc;elAPI - Service Server;c:\program files\DOS2USB\elsvc.exe [10/14/2010 9:05 AM 45056]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [9/4/2008 3:11 PM 48472]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [9/4/2008 3:11 PM 43480]
S1 MpKsl181a7299;MpKsl181a7299;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\MpKsl181a7299.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\MpKsl181a7299.sys [?]
S1 MpKsl79183772;MpKsl79183772;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\MpKsl79183772.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D2CB6A79-6E48-4BFB-990A-594361DD68C2}\MpKsl79183772.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/4/2010 7:36 AM 135664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/4/2010 7:36 AM 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL1E7BD425
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 12:36]
.
2011-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 12:36]
.
2011-12-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client;=dell-usuk&channel;=us-smb&ibd;=5080904
uInternet Settings,ProxyOverride =
Trusted Zone: bxcleve.com\www
Trusted Zone: bxlogin.com\www
Trusted Zone: bxohio.com\www
Trusted Zone: private-planroom.com\subs
Trusted Zone: private-planroom.com\www
TCP: DhcpNameServer = 192.168.254.254 192.168.254.254
TCP: Interfaces\{CE61A097-8766-41AB-9940-5E6EE0B7E491}: NameServer = 166.102.165.11,207.91.5.20
DPF: {4A769165-055C-4566-ABBB-3EA82DD4F8AE} - hxxp://www.ipinviewer.com/binInstall/IVSLite.CAB
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{2e6e669c-7c46-4505-ab62-f87a53acac2c} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-23 08:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(944)
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(1128)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\DKabcoms.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\DellTPad\Apntex.exe
c:\program files\Dell Network Assistant\ezi_hnm2.exe
c:\windows\system32\wscript.exe
c:\\?\c:\windows\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2011-12-23 08:25:40 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-23 13:25
.
Pre-Run: 108,104,507,392 bytes free
Post-Run: 109,739,945,984 bytes free
.
- - End Of File - - 70C78BDC903C7B34329C4F0F3B0D6064

mowman

Post #6December 24, 2011, 1:55 PM UTC

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Also tell me how the computer is running now.

vdicaprio

Post #7December 26, 2011, 4:04 PM UTC

Mowman Here is the Malware Bytes Quick Scan log Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 911122602 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 12/26/2011 10:18:56 AM mbam-log-2011-12-26 (10-18-56).txt Scan type: Quick scan Objects scanned: 179821 Time elapsed: 3 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Here is the ESET scan - nothing was found ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=4be6555de7c1734789d19e445cf74ecb # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-12-26 04:01:25 # local_time=2011-12-26 11:01:25 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=5891 16776533 42 87 0 20844551 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=67478 # found=0 # cleaned=0 # scan_time=2004 The computer is running better. But periodically I get a message from my Microsoft Secuirities Essentials program that something was detected and was cleaned. Thanks for your help so far.

mowman

Post #8December 26, 2011, 9:37 PM UTC

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

Download aswMBR.exe ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
Click the Scan button to start scan
On completion of the scan click Save Log, save it to your Desktop and post in your next reply

vdicaprio

Post #9December 27, 2011, 10:05 PM UTC

Mowman

Below are the OTL and Extra txt files as well as the aswMBR txt.

OTL logfile created on: 12/27/2011 4:38:33 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\V\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 2.44 Gb Available Physical Memory | 81.62% Memory free
4.83 Gb Paging File | 4.43 Gb Available in Paging File | 91.66% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 139.25 Gb Total Space | 102.30 Gb Free Space | 73.46% Space Free | Partition Type: NTFS
Drive F: | 4.00 Gb Total Space | 2.98 Gb Free Space | 74.55% Space Free | Partition Type: FAT

Computer Name: VINCE | User Name: V | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\V\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\DOS2USB\elsvc.exe ()
PRC - C:\WINDOWS\system32\dkabcoms.exe ( )
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Dell Network Assistant\ezi_hnm2.exe (SingleClick Systems)
PRC - C:\Program Files\Dell Network Assistant\hnm_svc.exe (SingleClick Systems)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - C:\Program Files\DOS2USB\elsvc.exe ()
MOD - C:\WINDOWS\system32\pdf995mon.dll ()
MOD - C:\WINDOWS\system32\preflib.dll ()
MOD - C:\WINDOWS\system32\bcm1xsup.dll ()
MOD - C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll ()

========== Win32 Services (SafeList) ==========

SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (elAPIsvc) – C:\Program Files\DOS2USB\elsvc.exe ()
SRV - (dkab_device) – C:\WINDOWS\System32\DKabcoms.exe ( )
SRV - (SolidWorks Licensing Service) – C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)
SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (DellAMBrokerService) – C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe ()
SRV - (hnmsvc) – C:\Program Files\Dell Network Assistant\hnm_svc.exe (SingleClick Systems)

========== Driver Services (SafeList) ==========

DRV - (MpKsl79cfbe83) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2530B9BF-144A-4FAB-8454-7DCFCD3B8F2E}\MpKsl79cfbe83.sys (Microsoft Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (O2SDRDR) – C:\WINDOWS\system32\drivers\o2sd.sys (O2Micro )
DRV - (O2MDRDR) – C:\WINDOWS\system32\drivers\o2media.sys (O2Micro )
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (MREMP50) – C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (datunidr) – C:\WINDOWS\system32\drivers\datunidr.sys (Gteko Ltd.)
DRV - (DLADResM) – C:\WINDOWS\system32\drivers\DLADResM.SYS (Roxio)
DRV - (DLABMFSM) – C:\WINDOWS\system32\drivers\DLABMFSM.SYS (Roxio)
DRV - (DLAUDF_M) – C:\WINDOWS\system32\drivers\DLAUDF_M.SYS (Roxio)
DRV - (DLAUDFAM) – C:\WINDOWS\system32\drivers\DLAUDFAM.SYS (Roxio)
DRV - (DLAOPIOM) – C:\WINDOWS\system32\drivers\DLAOPIOM.SYS (Roxio)
DRV - (DLABOIOM) – C:\WINDOWS\system32\drivers\DLABOIOM.SYS (Roxio)
DRV - (DLAPoolM) – C:\WINDOWS\system32\drivers\DLAPoolM.SYS (Roxio)
DRV - (DLAIFS_M) – C:\WINDOWS\system32\drivers\DLAIFS_M.SYS (Roxio)
DRV - (DLARTL_M) – C:\WINDOWS\system32\drivers\DLARTL_M.SYS (Roxio)
DRV - (DLACDBHM) – C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Roxio)
DRV - (Packet) – C:\WINDOWS\system32\drivers\packet.sys (SingleClick Systems)
DRV - (PTproct) – C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys (Gteko Ltd.)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=5080904
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=5080904

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

O1 HOSTS File: ([2011/12/23 08:21:51 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk = C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\V\Start Menu\Programs\Startup\Microsoft Outlook.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: bxcleve.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: bxlogin.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: bxohio.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: private-planroom.com ([subs] http in Trusted sites)
O15 - HKCU\..Trusted Domains: private-planroom.com ([www] http in Trusted sites)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {4A769165-055C-4566-ABBB-3EA82DD4F8AE} http://www.ipinviewer.com/binInstall/IVSLite.CAB (IVSLite.FastViewer)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://harsco.webex.com/client/wbs26-vzbpr…bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CE61A097-8766-41AB-9940-5E6EE0B7E491}: DhcpNameServer = 192.168.254.254 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CE61A097-8766-41AB-9940-5E6EE0B7E491}: Domain = windstream.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CE61A097-8766-41AB-9940-5E6EE0B7E491}: NameServer = 166.102.165.11,207.91.5.20
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 16:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/27 16:35:51 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\V\Desktop\OTL.exe
[2011/12/26 10:25:23 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/12/23 09:26:35 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/23 08:22:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/12/23 08:02:39 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/12/23 08:02:39 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/12/23 08:02:39 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/12/23 08:02:39 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/12/23 08:02:31 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/12/23 08:01:50 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/23 08:01:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\V\Start Menu\Programs\Administrative Tools
[2011/12/23 07:49:26 | 004,350,311 | R— | C] (Swearware) – C:\Documents and Settings\V\Desktop\ComboFix.com
[2011/12/22 18:22:38 | 001,577,776 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\V\Desktop\TDSSKiller.exe
[2011/12/22 17:26:02 | 000,000,000 | —D | C] – C:\Documents and Settings\V\Desktop\tdsskiller
[2011/12/21 07:43:59 | 000,041,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\vkylmhri.sys
[2011/12/20 04:07:49 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/12/19 19:37:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/12/19 19:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/12/19 19:27:54 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/12/18 12:42:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Kernel for Outlook PST Repair
[2011/12/18 12:42:13 | 000,212,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\RICHTX32.OCX
[2011/12/18 12:42:12 | 001,668,096 | —- | C] (Dmitry Streblechenko) – C:\WINDOWS\System32\Redemption.dll
[2011/12/18 12:42:12 | 000,000,000 | —D | C] – C:\Program Files\Kernel for Outlook PST Repair
[2011/12/18 12:35:38 | 000,000,000 | —D | C] – C:\Documents and Settings\V\My Documents\OUTLOOK Repair
[2011/12/14 20:45:04 | 000,000,000 | —D | C] – C:\Program Files\PCVITA Split Magic v2.3
[2011/12/14 20:38:23 | 000,000,000 | —D | C] – C:\Program Files\SysTools Split PST
[2011/12/14 15:50:13 | 000,000,000 | —D | C] – C:\Documents and Settings\V\Local Settings\Application Data\OutlookFreeware.com
[2011/12/14 09:28:09 | 000,000,000 | —D | C] – C:\Program Files\Memecode
[2011/12/02 17:14:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SolidWorks 2012
[2011/12/02 17:14:00 | 000,000,000 | —D | C] – C:\Program Files\Common Files\eDrawings2012
[2011/11/28 18:04:03 | 000,000,000 | —D | C] – C:\Documents and Settings\V\Application Data\Paem
[2011/11/28 18:04:03 | 000,000,000 | —D | C] – C:\Documents and Settings\V\Application Data\Atduz
[2010/10/02 14:36:59 | 000,372,736 | —- | C] ( ) – C:\WINDOWS\System32\lexlog.dll
[2010/10/02 14:36:30 | 000,851,968 | —- | C] ( ) – C:\WINDOWS\System32\dkabusb1.dll
[2010/10/02 14:36:30 | 000,651,264 | —- | C] ( ) – C:\WINDOWS\System32\dkabpmui.dll
[2010/10/02 14:36:29 | 001,056,768 | —- | C] ( ) – C:\WINDOWS\System32\dkabserv.dll
[2010/10/02 14:36:29 | 000,581,632 | —- | C] ( ) – C:\WINDOWS\System32\dkablmpm.dll
[2010/10/02 14:36:29 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\dkabpar1.dll
[2010/10/02 14:36:29 | 000,339,968 | —- | C] ( ) – C:\WINDOWS\System32\dkabiesc.dll
[2010/10/02 14:36:28 | 000,917,504 | —- | C] ( ) – C:\WINDOWS\System32\dkabip1.dll
[2010/10/02 14:36:28 | 000,603,376 | —- | C] ( ) – C:\WINDOWS\System32\dkabcoms.exe
[2010/10/02 14:36:28 | 000,454,656 | —- | C] ( ) – C:\WINDOWS\System32\dkabiobj.dll
[2010/10/02 14:36:28 | 000,446,464 | —- | C] ( ) – C:\WINDOWS\System32\dkabhcp.dll
[2010/10/02 14:36:28 | 000,364,544 | —- | C] ( ) – C:\WINDOWS\System32\dkabinpa.dll
[2010/10/02 14:36:27 | 000,802,816 | —- | C] ( ) – C:\WINDOWS\System32\dkabcomc.dll
[2010/10/02 14:36:27 | 000,376,832 | —- | C] ( ) – C:\WINDOWS\System32\dkabcomm.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/27 16:35:53 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\V\Desktop\OTL.exe
[2011/12/27 16:01:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/27 08:01:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/27 07:36:29 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/12/27 07:31:48 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/12/27 07:31:43 | 000,002,333 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
[2011/12/27 07:31:20 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/27 07:31:19 | 3211,186,176 | -HS- | M] () – C:\hiberfil.sys
[2011/12/23 08:26:03 | 000,443,482 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/12/23 08:26:03 | 000,072,582 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/12/23 08:21:51 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/23 07:55:06 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/23 07:49:26 | 004,350,311 | R— | M] (Swearware) – C:\Documents and Settings\V\Desktop\ComboFix.com
[2011/12/22 18:22:38 | 001,577,776 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\V\Desktop\TDSSKiller.exe
[2011/12/22 17:49:11 | 000,247,221 | —- | M] () – C:\Documents and Settings\V\Desktop\Screen Shot.pdf
[2011/12/22 17:32:00 | 000,002,473 | —- | M] () – C:\Documents and Settings\V\Desktop\Microsoft Word.lnk
[2011/12/22 17:24:44 | 001,558,059 | —- | M] () – C:\Documents and Settings\V\Desktop\tdsskiller.zip
[2011/12/21 12:04:12 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\null
[2011/12/21 07:44:00 | 000,041,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\vkylmhri.sys
[2011/12/19 18:40:42 | 000,004,168 | -HS- | M] () – C:\Documents and Settings\V\Local Settings\Application Data\hyuodt1j5iyt1ung3flh6h410f1c
[2011/12/19 18:40:42 | 000,004,168 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\hyuodt1j5iyt1ung3flh6h410f1c
[2011/12/17 11:42:13 | 000,001,731 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/12/16 07:41:05 | 000,000,130 | —- | M] () – C:\WINDOWS\ivslite.ini
[2011/12/15 13:54:46 | 000,352,176 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 13:50:57 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/14 21:53:36 | 000,000,989 | —- | M] () – C:\WINDOWS\ODBC.INI
[2011/12/14 21:53:19 | 000,001,727 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2011/12/14 19:06:15 | 000,000,782 | —- | M] () – C:\Documents and Settings\V\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Outlook.lnk
[2011/12/02 17:14:21 | 000,000,000 | —- | M] () – C:\WINDOWS\eDrawingOfficeAutomator.INI
[2011/12/02 17:14:15 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SolidWorks eDrawings 2012.lnk
[2011/12/02 13:56:15 | 000,003,882 | —- | M] () – C:\Documents and Settings\V\My Documents\GJM Signature.tif
[2011/11/30 16:55:38 | 000,000,199 | —- | M] () – C:\Documents and Settings\V\Desktop\Hurst Boiler.url
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/23 08:02:39 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/12/23 08:02:39 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/12/23 08:02:39 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/12/23 08:02:39 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/12/23 08:02:39 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/12/23 07:58:28 | 3211,186,176 | -HS- | C] () – C:\hiberfil.sys
[2011/12/22 17:49:09 | 000,247,221 | —- | C] () – C:\Documents and Settings\V\Desktop\Screen Shot.pdf
[2011/12/22 17:24:38 | 001,558,059 | —- | C] () – C:\Documents and Settings\V\Desktop\tdsskiller.zip
[2011/12/19 19:28:22 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/19 18:37:07 | 000,004,168 | -HS- | C] () – C:\Documents and Settings\V\Local Settings\Application Data\hyuodt1j5iyt1ung3flh6h410f1c
[2011/12/19 18:37:07 | 000,004,168 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\hyuodt1j5iyt1ung3flh6h410f1c
[2011/12/02 17:14:21 | 000,000,000 | —- | C] () – C:\WINDOWS\eDrawingOfficeAutomator.INI
[2011/12/02 17:14:15 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SolidWorks eDrawings 2012.lnk
[2011/12/02 13:56:15 | 000,003,882 | —- | C] () – C:\Documents and Settings\V\My Documents\GJM Signature.tif
[2010/09/04 12:23:28 | 000,445,960 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/07 07:45:01 | 000,000,027 | —- | C] () – C:\WINDOWS\EZSET_SP.INI
[2010/06/07 07:41:35 | 000,000,058 | —- | C] () – C:\WINDOWS\System32\KmTwain.ini
[2009/09/28 10:54:27 | 000,000,064 | —- | C] () – C:\WINDOWS\KMSTMVM.ini
[2009/07/09 08:57:48 | 000,000,124 | —- | C] () – C:\Documents and Settings\V\Local Settings\Application Data\fusioncache.dat
[2009/05/15 08:12:17 | 000,006,143 | —- | C] () – C:\Documents and Settings\V\Application Data\PrimoPDFSet.xml
[2009/05/15 07:57:46 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2008/11/24 17:26:20 | 000,000,130 | —- | C] () – C:\WINDOWS\ivslite.ini
[2008/11/24 08:48:19 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2008/11/23 13:48:09 | 000,000,989 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/11/05 18:21:07 | 000,007,168 | —- | C] () – C:\Documents and Settings\V\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/05 17:43:41 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2008/11/05 17:39:18 | 000,000,106 | —- | C] () – C:\WINDOWS\wpd99.drv
[2008/09/04 15:12:04 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2008/09/04 15:12:01 | 001,174,000 | —- | C] () – C:\WINDOWS\System32\igmedkrn.dll
[2008/09/04 15:12:01 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4864.dll
[2008/09/04 15:12:01 | 000,104,636 | —- | C] () – C:\WINDOWS\System32\igmedcompkrn.dll
[2008/09/04 15:11:28 | 000,001,153 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2008/09/04 12:23:33 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/09/04 12:21:00 | 000,000,859 | —- | C] () – C:\WINDOWS\{0240BDFB-2995-4A3F-8C96-18D41282B716}_WiseFW.ini
[2008/09/04 12:20:24 | 000,000,234 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/09/04 12:19:13 | 000,753,664 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2008/09/04 12:19:13 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2008/09/04 12:19:13 | 000,024,064 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2008/04/25 16:31:41 | 000,002,048 | —- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 16:27:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 11:16:24 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 11:16:22 | 000,443,482 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 11:16:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 11:16:22 | 000,072,582 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 11:16:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 11:16:22 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 11:16:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 11:16:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 11:16:18 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 11:16:18 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 11:16:13 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 11:16:11 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 04:22:39 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 04:21:52 | 000,352,176 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 00:42:22 | 000,193,024 | —- | C] () – C:\WINDOWS\System32\fsquirt.exe
[2002/07/22 12:25:00 | 000,794,624 | —- | C] () – C:\WINDOWS\System32\LTRTN13n.DLL
[1999/01/22 13:46:56 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2008/12/18 09:49:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Autodesk
[2008/11/05 18:04:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DassaultSystemes
[2011/12/27 10:53:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pdf995
[2008/11/23 13:52:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBT
[2008/09/04 12:21:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SingleClick Systems
[2008/09/04 12:21:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/12/27 07:31:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/12/05 07:22:43 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\Atduz
[2009/05/13 12:48:24 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\Autodesk
[2008/11/05 18:04:54 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\DassaultSystemes
[2008/12/18 09:40:59 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\EDrawings
[2008/12/17 18:02:34 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\Grundfos
[2011/11/25 14:32:15 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\gtk-2.0
[2009/04/08 15:21:22 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\OpenOffice.org
[2011/12/02 17:24:42 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\Paem
[2008/11/24 08:48:19 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\pdf995
[2011/11/25 11:31:13 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\SmartDraw
[2009/12/01 08:47:03 | 000,000,000 | —D | M] – C:\Documents and Settings\V\Application Data\webex
[2011/12/27 07:36:29 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/14 07:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/14 07:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/14 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/14 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 07:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/14 07:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/14 07:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 07:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 514 bytes -> C:\WINDOWS\System32\drivers\vkylmhri.sys:changelist
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:62E2D794

< End of report >

OTL Extras logfile created on: 12/27/2011 4:38:33 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\V\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 2.44 Gb Available Physical Memory | 81.62% Memory free
4.83 Gb Paging File | 4.43 Gb Available in Paging File | 91.66% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 139.25 Gb Total Space | 102.30 Gb Free Space | 73.46% Space Free | Partition Type: NTFS
Drive F: | 4.00 Gb Total Space | 2.98 Gb Free Space | 74.55% Space Free | Partition Type: FAT

Computer Name: VINCE | User Name: V | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"10421:UDP" = 10421:UDP:*:Enabled:SingleClick Discovery Protocol
"10426:UDP" = 10426:UDP:*:Enabled:SingleClick ICC
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Dell Network Assistant\ezi_hnm2.exe" = C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Enabled:Dell Network Assistant – (SingleClick Systems)
"C:\WINDOWS\system32\wbem\wmiadap.exe" = C:\WINDOWS\system32\wbem\wmiadap.exe:*:Enabled:WMIADAP – (Microsoft Corporation)
"C:\Program Files\Dell Network Assistant\hnm_svc.exe" = C:\Program Files\Dell Network Assistant\hnm_svc.exe:*:Enabled:hnm_svc – (SingleClick Systems)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\WINDOWS\system32\dkabcoms.exe" = C:\WINDOWS\system32\dkabcoms.exe:*:Enabled:Dell Enhanced TCP/IP Server – ( )
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth – (Google)
"C:\Documents and Settings\V\My Documents\OUTLOOK Repair\FTPTransfer.exe" = C:\Documents and Settings\V\My Documents\OUTLOOK Repair\FTPTransfer.exe:*:Enabled:Kernel File upload – (Nucleus Data Recovery.com Pvt.Ltd )

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional
"{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Disc 2
"{0240BDFB-2995-4A3F-8C96-18D41282B716}" = Dell Network Assistant
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{0D691876-ABA3-4D11-95FA-0A2232FCE055}" = Chimney Sizer 4.1
"{0F9F2CFA-7810-49BD-B933-2E8128767960}" = IPIN Viewing System Professional
"{10AB8F68-6962-4ACA-AE28-2600828B62AE}" = Kyocera TWAIN Driver
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java™ 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 24
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2BD41DF0-A605-48AF-9449-215EF5FF0610}" = Boiler Steam Cost Calculator
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{55D9E026-DCB0-46FF-B60A-68B972228CF6}" = Autodesk Design Review 2010
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B4D15B5-C666-490D-AF91-0EEEDE73E2E2}" = VentBOM 2
"{834CB6BD-D802-48F1-AF73-A6CB6B0BF483}" = SolidWorks eDrawings 2012
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B66482D-424F-4610-9DD8-A37FED092F92}" = CBROI_V2_0
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A210DE32-E1A4-4C4D-A624-2B88A14CB58F}" = CB Hawk ICS Aftermarket Calculator V2007
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.7
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2C023E1-DD40-4562-90C7-B82D035A9F04}" = CB Hawk ICS List Price Calculator v2007
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE34691C-4298-4667-9758-D7F534DD0B94}" = Dell Automated PC TuneUp
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Autodesk Design Review 2010" = Autodesk Design Review 2010
"BLCC5" = BLCC5
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card Utility
"Dell_HostCD" = Dell Printer Software Uninstall
"ESET Online Scanner" = ESET Online Scanner v3
"HDMI" = Intel® Graphics Media Accelerator Driver
"Hurst CAD Library (Hurst)" = Hurst CAD Library 3.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{10AB8F68-6962-4ACA-AE28-2600828B62AE}" = Kyocera TWAIN Driver
"Kernel for Outlook PST Repair_is1" = Kernel for Outlook PST Repair ver 10.10.01
"Kyocera Product Library" = Kyocera Product Library
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Pdf995" = Pdf995
"PdfEdit995" = PdfEdit995
"PRO50" = PRO50
"SearchAssist" = SearchAssist
"Signature995" = Signature995
"ST6UNST #1" = Metal-Fab Pipe Sizing Program
"ST6UNST #2" = Spence Sizing Program
"ST6UNST #3" = ERI Steam Flow 2002
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.5.0.457

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/22/2011 8:50:53 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 8:53:14 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 8:54:04 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 8:54:14 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 2:50:59 PM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 3:01:20 PM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/26/2011 11:09:31 AM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

Error - 12/27/2011 9:12:27 AM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

Error - 12/27/2011 10:45:06 AM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

Error - 12/27/2011 4:43:12 PM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

[ Application Events ]
Error - 12/22/2011 8:50:53 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 8:53:14 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 8:54:04 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 8:54:14 AM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 2:50:59 PM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/22/2011 3:01:20 PM | Computer Name = VINCE | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 12/26/2011 11:09:31 AM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

Error - 12/27/2011 9:12:27 AM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

Error - 12/27/2011 10:45:06 AM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

Error - 12/27/2011 4:43:12 PM | Computer Name = VINCE | Source = Microsoft Security Client | ID = 5000
Description =

[ System Events ]
Error - 12/27/2011 5:17:24 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "MIKE :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.22 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:17:24 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "JEFF :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.23 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:17:24 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "JUDY :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.24 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:17:39 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "DONNA :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.40 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:18:45 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "NTSERVER :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.107
did not allow the name to be claimed by this machine.

Error - 12/27/2011 5:31:50 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "KM4B9899 :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.1 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:32:08 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "JUDY :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.24 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:32:08 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "MIKE :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.22 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:32:08 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "JEFF :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.23 did
not allow the name to be claimed by this machine.

Error - 12/27/2011 5:33:30 PM | Computer Name = VINCE | Source = NetBT | ID = 4321
Description = The name "NTSERVER :0" could not be registered on the Interface
with IP address 192.168.254.21. The machine with the IP address 192.168.254.107
did not allow the name to be claimed by this machine.

< End of report >

aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-27 16:51:34
—————————–
16:51:34.671 OS Version: Windows 5.1.2600 Service Pack 3
16:51:34.671 Number of processors: 2 586 0xF0D
16:51:34.687 ComputerName: VINCE UserName: V
16:51:35.375 Initialize success
16:54:10.312 AVAST engine defs: 11122702
16:54:28.015 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
16:54:28.015 Disk 0 Vendor: ST916082 3.AD Size: 152627MB BusType: 3
16:54:28.015 Disk 0 MBR read successfully
16:54:28.031 Disk 0 MBR scan
16:54:28.062 Disk 0 unknown MBR code
16:54:28.062 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
16:54:28.093 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 142587 MB offset 80325
16:54:28.156 Disk 0 Partition 3 00 DB CP/M / CTOS Dell 8.0 9993 MB offset 292109895
16:54:28.203 Disk 0 scanning sectors +312576705
16:54:28.312 Disk 0 scanning C:\WINDOWS\system32\drivers
16:54:40.375 Service scanning
16:54:40.703 Service MpKsl79cfbe83 c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2530B9BF-144A-4FAB-8454-7DCFCD3B8F2E}\MpKsl79cfbe83.sys **LOCKED** 32
16:54:41.265 Modules scanning
16:54:48.062 Disk 0 trace - called modules:
16:54:48.078 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
16:54:48.078 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aebc6c8]
16:54:48.093 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\0000006f[0x8aec0a28]
16:54:48.093 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8aeb1030]
16:54:48.796 AVAST engine scan C:\WINDOWS
16:55:01.812 AVAST engine scan C:\WINDOWS\system32
16:57:16.343 AVAST engine scan C:\WINDOWS\system32\drivers
16:57:31.296 AVAST engine scan C:\Documents and Settings\V
17:01:45.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\V\Desktop\MBR.dat"
17:01:45.156 The log file has been saved successfully to "C:\Documents and Settings\V\Desktop\aswMBR.txt"

thanks

mowman

Post #10December 28, 2011, 11:08 AM UTC

But periodically I get a message from my Microsoft Secuirities Essentials program that something was detected and was cleaned.

Are you still getting these messages,if so what exactly are they as the logs all look clean now

vdicaprio

Post #11December 28, 2011, 4:35 PM UTC

Mowman The computer is working much better. I received the message again from MIcrosoft Security Essentials. The virus was Win32/Sirefef.N. The software said it was disinfected and removed. I'm not sure if this is the same virus that I have been receiving the last few days. I will get the details if it occurs again. Thanks

mowman

Post #12December 29, 2011, 12:31 AM UTC

Run the computer for a day or so,if no more problems we will clean up the tools we have used.

vdicaprio

Post #13December 29, 2011, 12:33 PM UTC

Thanks so much for your help this far. I will let you know how things are going in a day or so.

vdicaprio

Post #14January 3, 2012, 12:49 PM UTC

Mowman I have been using the computer for the last few days and everything seems to be operating fine. Thanks so much for your help. Is there some way to make a small donation to the cause?

mowman

Post #15January 3, 2012, 7:38 PM UTC

You can donate here if you wish. http://www.whatthetech.com/donate/

You appear clean of infections,please do the following.

ComboFix - Cleanup
Time for some housekeeping

Click Start…select Run from the menu.
Copy and paste the following into the text entry box:
Combofix /Uninstall
Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 7 and save it to your desktop.
Scroll down to where it says JDK 7 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-7-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hijacked

✨ Ask AI

Ask AI