Spyware / Malware / Virus Removal

conduit.search.com redirect/whitesmoke toolbar [Solved]

26 min read

Looking for the outcome? Ask AI

NoodleTech

Post #31January 2, 2012, 8:05 PM UTC

Hi Jason1970, Either is fine, just needed to see the screenshot, thanks. The infection that I suspected isn't there. Hmm… Are you getting redirected in Internet Explorer? Firefox? Both browsers? Does it happen all the time? Where do you get redirected?

Jason1970

Post #32January 2, 2012, 9:56 PM UTC

I am being redirected to the conduit search engine with Chrome & I can't change my browser home pg back to google. IE doesn't seem affected. The white smoke tool bar is gone. I only use Chrome except for this removal stuff where I use IE 8 now

Jason1970

Post #33January 2, 2012, 10:52 PM UTC

I should probably mention that when I open control panel/internet options/general/home page it shows google as my home page yet when I open the chrome browser it opens at the conduit search engine. hope this is helpful

NoodleTech

Post #34January 3, 2012, 5:19 AM UTC

Hi Jason1970,

Thanks for the clarification. For some reason, I can't see the Chrome data in the OTL log. Can you please download the updated version of OTL from the link below and run it?

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

Jason1970

Post #35January 3, 2012, 5:27 PM UTC

here is the OTL log however the only "extras.txt" log I could find is from Dec 30/2011

OTL logfile created on: 1/3/2012 12:12:23 AM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\b\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.94 Gb Available Physical Memory | 62.92% Memory free
3.35 Gb Paging File | 2.68 Gb Available in Paging File | 79.76% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 56.84 Gb Free Space | 76.27% Space Free | Partition Type: NTFS

Computer Name: A | User Name: b | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\b\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
PRC - C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
PRC - C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
PRC - C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll ()
MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll ()
MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL ()
MOD - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\acs.exe ()
MOD - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (Imapi Helper) – C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe (Alex Feinman)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (CFSvcs) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (RetroWDSvc) – C:\Program Files\Dantz\Retrospect\wdsvc.exe (Dantz Development Corporation)
SRV - (RetroLauncher) – C:\Program Files\Dantz\Retrospect\retrorun.exe (Dantz Development Corporation)
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)

========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (ssadmdm) – C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (CamDrL) Logitech QuickCam Pro 3000(CamDrl) – C:\WINDOWS\system32\drivers\Camdrl.sys (Logitech Inc.)
DRV - (TPwSav) – C:\WINDOWS\System32\DRIVERS\TPwSav.sys (TOSHIBA )
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (TCtrlIO) – C:\WINDOWS\system32\drivers\TCtrlIO.sys (TOSHIBA )
DRV - (SrvcSSIOMngr) – C:\WINDOWS\system32\drivers\SSIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcTPIOMngr) – C:\WINDOWS\system32\drivers\TPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SrvcEKIOMngr) – C:\WINDOWS\system32\drivers\EKIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (SerTVOutCtlr) – C:\WINDOWS\system32\drivers\EPIOMngr.sys (COMPAL ELECTRONIC INC.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ESMCR) – C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (ESDCR) – C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (caboagp) – C:\WINDOWS\system32\DRIVERS\atisgkaf.sys (ATI Technologies Inc.)
DRV - (Pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (TBiosDrv) – C:\WINDOWS\system32\drivers\Tbiosdrv.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\b\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG2012\Firefox\ [2011/12/22 12:37:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2011/12/22 12:37:20 | 000,000,000 | —D | M]

========== Chrome ==========

CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={…;ctid=CT3007394
CHR - default_search_provider: suggest_url = http://search.conduit.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\gcswf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\Application\16.0.912.63\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\b\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\b\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Unity Player (Enabled) = C:\Documents and Settings\b\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: AddThis - Share & Bookmark (new) = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cgbogdmdefihhljhfeiklfiedefalcde\2.9.2_0\
CHR - Extension: Google Search = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: AVG Safe Search = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\
CHR - Extension: Gmail = C:\Documents and Settings\b\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\

O1 HOSTS File: ([2011/12/31 10:11:00 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe ()
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [WD Button Manager] C:\WINDOWS\System32\WDBtnMgr.exe (Western Digital Technologies, Inc.)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA45BDE3-54B5-4737-BA88-B1F605D31D42}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\b\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/09/01 23:19:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/03 00:11:19 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\b\Desktop\OTL.exe
[2012/01/02 11:06:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ImageShack Uploader
[2012/01/02 11:06:47 | 000,000,000 | —D | C] – C:\Program Files\ImageShack Uploader
[2012/01/02 10:27:02 | 000,000,000 | —D | C] – C:\Program Files\Alex Feinman
[2012/01/02 09:26:01 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\ImgBurn
[2012/01/02 09:22:03 | 000,000,000 | —D | C] – C:\Program Files\ImgBurn
[2012/01/02 09:15:51 | 006,055,875 | —- | C] (LIGHTNING UK!) – C:\Documents and Settings\b\Desktop\SetupImgBurn_2.5.6.0.exe
[2011/12/31 20:39:54 | 000,000,000 | —D | C] – C:\_OTL
[2011/12/31 16:35:36 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\Sun
[2011/12/31 16:34:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2011/12/31 16:34:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/12/31 16:33:33 | 000,000,000 | —D | C] – C:\Program Files\Java
[2011/12/31 16:29:45 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/12/31 10:13:33 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/12/31 09:47:56 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/12/31 09:47:56 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/12/31 09:47:56 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/12/31 09:45:03 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/12/31 09:44:45 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/31 09:41:41 | 004,358,797 | R— | C] (Swearware) – C:\Documents and Settings\b\Desktop\ComboFix.exe
[2011/12/30 15:21:06 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Desktop\tdsskiller
[2011/12/30 14:36:52 | 004,702,720 | —- | C] (AVAST Software) – C:\Documents and Settings\b\Desktop\aswMBR.exe
[2011/12/30 10:31:49 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\b\Desktop\dds.scr
[2011/12/29 14:19:43 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:09:47 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2011/12/21 21:11:10 | 000,000,000 | —D | C] – C:\Documents and Settings\b\My Documents\Recipes
[2011/12/06 08:15:17 | 000,000,000 | —D | C] – C:\Documents and Settings\b\Local Settings\Application Data\PCHealth
[2011/12/05 23:19:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2011/12/05 23:19:07 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2011/12/05 23:18:48 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2011/12/05 23:17:52 | 000,000,000 | —D | C] – C:\1f06b41c5dfa3f6ae26115eb697bf52a
[2011/04/07 17:46:24 | 000,028,672 | —- | C] ( ) – C:\WINDOWS\System32\ControlACS.exe
[2004/09/01 23:03:29 | 000,131,072 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll

========== Files - Modified Within 30 Days ==========

[2012/01/03 00:11:32 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\b\Desktop\OTL.exe
[2012/01/02 23:36:00 | 000,000,962 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006UA.job
[2012/01/02 23:28:00 | 000,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/02 18:43:20 | 000,122,069 | —- | M] () – C:\Documents and Settings\b\Desktop\2012-01-02 10.43.21.jpg
[2012/01/02 18:42:56 | 000,123,423 | —- | M] () – C:\Documents and Settings\b\Desktop\2012-01-02 10.42.56.jpg
[2012/01/02 17:22:27 | 085,812,212 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/01/02 15:36:01 | 000,000,910 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-495781045-3759577209-3036343489-1006Core.job
[2012/01/02 11:07:01 | 000,002,259 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ImageShack Uploader.lnk
[2012/01/02 11:05:40 | 012,964,864 | —- | M] () – C:\Documents and Settings\b\Desktop\ImageShackUploader-2.2.0.msi
[2012/01/02 10:47:50 | 000,000,872 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/02 10:47:45 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/02 10:47:43 | 1609,617,408 | -HS- | M] () – C:\hiberfil.sys
[2012/01/02 10:23:11 | 000,369,152 | —- | M] () – C:\Documents and Settings\b\Desktop\ISORecorderV2RC1.msi
[2012/01/02 10:06:26 | 106,524,672 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2012/01/02 09:22:11 | 000,001,539 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
[2012/01/02 09:15:58 | 006,055,875 | —- | M] (LIGHTNING UK!) – C:\Documents and Settings\b\Desktop\SetupImgBurn_2.5.6.0.exe
[2012/01/02 00:13:01 | 119,416,832 | —- | M] () – C:\Documents and Settings\b\Desktop\gparted-live-0.11.0-2.iso
[2012/01/01 10:58:32 | 000,000,544 | —- | M] () – C:\Documents and Settings\b\Desktop\MBR.zip
[2012/01/01 10:58:09 | 000,000,512 | —- | M] () – C:\Documents and Settings\b\Desktop\MBR.dat
[2011/12/31 20:37:46 | 000,000,768 | —- | M] () – C:\Documents and Settings\b\Desktop\Shortcut to OTL (1).lnk
[2011/12/31 10:11:00 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/31 09:41:47 | 004,358,797 | R— | M] (Swearware) – C:\Documents and Settings\b\Desktop\ComboFix.exe
[2011/12/30 15:38:45 | 000,000,754 | —- | M] () – C:\WINDOWS\WORDPAD.INI
[2011/12/30 15:20:17 | 001,558,406 | —- | M] () – C:\Documents and Settings\b\Desktop\tdsskiller.zip
[2011/12/30 14:36:43 | 004,702,720 | —- | M] (AVAST Software) – C:\Documents and Settings\b\Desktop\aswMBR.exe
[2011/12/30 10:31:49 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\b\Desktop\dds.scr
[2011/12/28 18:58:34 | 000,210,961 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/12/28 18:46:40 | 000,144,384 | —- | M] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/27 20:10:36 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/12/27 02:00:01 | 000,000,334 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-A-b.job
[2011/12/22 12:37:21 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/12/21 17:58:29 | 000,000,991 | —- | M] () – C:\Documents and Settings\b\Desktop\magicJack.lnk
[2011/12/19 09:28:06 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/15 19:42:51 | 000,002,241 | —- | M] () – C:\Documents and Settings\b\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/15 19:42:49 | 000,002,263 | —- | M] () – C:\Documents and Settings\b\Desktop\Google Chrome.lnk
[2011/12/15 07:43:39 | 003,850,224 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 00:41:38 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/12/07 14:09:40 | 000,000,294 | —- | M] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/12/06 23:56:04 | 000,441,692 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/12/06 23:56:04 | 000,071,462 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2012/01/02 11:06:51 | 000,002,259 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ImageShack Uploader.lnk
[2012/01/02 11:05:40 | 012,964,864 | —- | C] () – C:\Documents and Settings\b\Desktop\ImageShackUploader-2.2.0.msi
[2012/01/02 10:51:52 | 000,123,423 | —- | C] () – C:\Documents and Settings\b\Desktop\2012-01-02 10.42.56.jpg
[2012/01/02 10:51:49 | 000,122,069 | —- | C] () – C:\Documents and Settings\b\Desktop\2012-01-02 10.43.21.jpg
[2012/01/02 10:23:11 | 000,369,152 | —- | C] () – C:\Documents and Settings\b\Desktop\ISORecorderV2RC1.msi
[2012/01/02 09:22:10 | 000,001,539 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
[2012/01/02 00:13:01 | 119,416,832 | —- | C] () – C:\Documents and Settings\b\Desktop\gparted-live-0.11.0-2.iso
[2011/12/31 20:37:46 | 000,000,768 | —- | C] () – C:\Documents and Settings\b\Desktop\Shortcut to OTL (1).lnk
[2011/12/31 09:47:56 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/12/31 09:47:56 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/12/31 09:47:56 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/12/31 09:45:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/12/31 09:45:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/12/30 15:38:25 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2011/12/30 15:20:11 | 001,558,406 | —- | C] () – C:\Documents and Settings\b\Desktop\tdsskiller.zip
[2011/12/30 15:18:13 | 000,000,544 | —- | C] () – C:\Documents and Settings\b\Desktop\MBR.zip
[2011/12/30 15:16:27 | 000,000,512 | —- | C] () – C:\Documents and Settings\b\Desktop\MBR.dat
[2011/12/07 14:09:40 | 000,000,294 | —- | C] () – C:\Documents and Settings\b\My Documents\lost my give a stuff.xml
[2011/09/10 12:30:39 | 000,000,000 | —- | C] () – C:\WINDOWS\JDSecure31.INI
[2011/08/05 20:24:47 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\06807e882eed5f29381fe74271ecdccf_c
[2011/06/25 09:49:57 | 000,103,509 | —- | C] () – C:\WINDOWS\hpoins04.dat
[2011/06/25 09:49:57 | 000,017,176 | —- | C] () – C:\WINDOWS\hpomdl04.dat
[2011/06/01 19:57:08 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/06/01 19:57:08 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/06/01 16:27:15 | 000,144,384 | —- | C] () – C:\Documents and Settings\b\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/20 06:40:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/22 12:21:22 | 000,000,113 | —- | C] () – C:\WINDOWS\(null)toolkit.ini
[2011/04/07 17:46:24 | 000,241,664 | —- | C] () – C:\WINDOWS\System32\ControlWZCS.exe
[2011/04/07 17:46:23 | 000,218,003 | —- | C] () – C:\WINDOWS\dssec.dat
[2011/04/07 17:46:23 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2011/04/07 17:46:23 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\acs.exe
[2011/04/07 17:33:17 | 000,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2011/04/07 17:33:17 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2011/04/07 17:33:17 | 000,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2011/04/07 17:33:17 | 000,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2011/04/07 17:32:33 | 000,006,528 | —- | C] () – C:\WINDOWS\System32\drivers\Tbiosdrv.sys
[2007/02/03 07:59:04 | 000,050,127 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2004/09/02 09:15:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/09/02 08:33:41 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/09/02 08:13:04 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2004/09/02 08:10:55 | 000,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/09/02 08:10:04 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2004/09/02 08:10:04 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2004/09/02 08:10:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2004/09/02 08:10:04 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2004/09/02 08:10:04 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2004/09/02 08:06:23 | 000,000,000 | —- | C] () – C:\WINDOWS\TPTray.INI
[2004/09/01 23:30:55 | 000,000,000 | —- | C] () – C:\WINDOWS\CeEKey.INI
[2004/09/01 23:30:40 | 000,356,352 | —- | C] () – C:\WINDOWS\System32\EMCRI.dll
[2004/09/01 23:28:11 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2004/09/01 23:28:11 | 000,001,048 | —- | C] () – C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/09/01 23:28:11 | 000,000,176 | —- | C] () – C:\WINDOWS\System32\drivers\alcxhweq.dat
[2004/09/01 23:23:18 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/09/01 23:21:58 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/09/01 23:17:12 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/09/01 23:03:29 | 000,385,024 | —- | C] () – C:\WINDOWS\System32\ati2evxx.exe
[2004/09/01 23:03:29 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/09/01 23:02:55 | 000,002,388 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/09/01 23:02:26 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/09/01 23:02:23 | 000,441,692 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/09/01 23:02:23 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/09/01 23:02:23 | 000,071,462 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/09/01 23:02:23 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/09/01 23:02:23 | 000,004,631 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/09/01 23:02:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/09/01 23:02:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/09/01 23:02:16 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/09/01 23:02:16 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/09/01 23:02:10 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/09/01 23:02:03 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/09/01 16:12:06 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/09/01 16:11:14 | 003,850,224 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/07/12 06:18:22 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini

========== LOP Check ==========

[2011/08/06 18:20:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\!SASCORE
[2011/12/27 20:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/10/14 14:42:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG
[2011/08/30 22:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/10/07 08:33:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/08/30 22:33:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Backup
[2011/04/09 08:22:45 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/04/10 21:05:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\magicJack
[2012/01/02 17:22:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/07/11 15:25:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MGS
[2011/11/22 07:56:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Security
[2011/10/19 21:52:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Software
[2011/07/17 14:33:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/07/17 12:41:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Retrospect
[2011/07/20 08:58:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2011/08/10 06:34:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/07/16 11:34:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/10/14 10:54:14 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG
[2011/04/09 08:24:04 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG10
[2011/09/30 16:45:50 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\AVG2012
[2011/08/10 07:27:58 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/29 14:19:43 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Curiolab
[2011/12/29 14:12:35 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\GetRightToGo
[2012/01/02 09:26:01 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\ImgBurn
[2004/09/02 08:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterTrust
[2011/06/04 20:11:41 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\InterVideo
[2011/12/21 22:46:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\mjusbsp
[2011/07/16 11:34:49 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenCandy
[2011/12/28 20:47:29 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\OpenOffice.org1.9.79
[2011/11/11 15:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\SmartDraw
[2004/09/02 08:11:02 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\toshiba
[2011/04/22 12:18:28 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Trillian
[2011/08/03 17:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\b\Application Data\Unity
[2011/04/07 17:45:57 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\Registration reminder 1.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 16:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 16:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 16:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004/08/04 04:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 16:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 16:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 16:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/04 04:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 04:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 16:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 16:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 16:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 04:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 16:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 16:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 16:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< End of report >

NoodleTech

Post #36January 3, 2012, 6:06 PM UTC

Hi Jason1970,

Run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={…;ctid=CT3007394
CHR - default_search_provider: suggest_url = http://search.conduit.com/

:Commands
[createrestorepoint]
[purity]
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Jason1970

Post #37January 3, 2012, 6:18 PM UTC

Here is the latest OTL log, the redirect is still there though

Jason1970

Post #38January 3, 2012, 6:19 PM UTC

let's try this again, shall we All processes killed ========== OTL ========== Unable to fix default_search_provider items. Unable to fix default_search_provider items. Unable to fix default_search_provider items. ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: b ->Temp folder emptied: 52550314 bytes ->Temporary Internet Files folder emptied: 84558989 bytes ->Google Chrome cache emptied: 427285182 bytes ->Flash cache emptied: 8679 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 32990 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 63019344 bytes Total Files Cleaned = 598.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 01032012_101104 Files\Folders moved on Reboot… C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\W5EVUDUN\adloader[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\W5EVUDUN\AdServeMsg[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\W5EVUDUN\Banner[3].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\W5EVUDUN\CAS96RSP.000300%26landingUrl= moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\W5EVUDUN\co109w.col109.mail.live[2] moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\W5EVUDUN\resourcespreload[2].mvc moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\81EDI52J\iframe[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\81EDI52J\LocalStorage[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\81EDI52J\Messenger[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\4N0LUHOB\AjaxHistoryFrame[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\4N0LUHOB\xmlProxy[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\0DOTMLGF\InboxLight[2].aspx moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\0DOTMLGF\WebIMPop[1].htm moved successfully. C:\Documents and Settings\b\Local Settings\Temporary Internet Files\Content.IE5\0DOTMLGF\xmlProxy[3].htm moved successfully. Registry entries deleted on Reboot…

NoodleTech

Post #39January 4, 2012, 6:07 AM UTC

Hey Jason1970,

Looks like OTL failed to fix the Chrome search providers. Can you please right click the URL bar in Chrome (where you type web addresses and search for things) > Select Edit Search Engines > Hover your mouse over Conduit > Click the X on the right.

Next, hover your mouse over Google and choose Make Default.

Let me know if that works for you.

Jason1970

Post #40January 4, 2012, 5:31 PM UTC

Hi, success.I edited the search engines as U suggested & additionally I removed the bing search engine from the Chrome://Settings/Browser/Options/Basics menu/Search/manage Search Engines, I did a search of "All files & folders" & did not find anything with the name conduit however in the "On Startup" area I can still see the conduit search engine greyed. Any ideas? can it still pose a threat?

Jason1970

Post #41January 4, 2012, 6:16 PM UTC

btw I had to make the Chrome browser my default B4 it would let me delete the conduit browser, took me a few to figure that 1 out

NoodleTech

Post #42January 4, 2012, 7:51 PM UTC

Hi Jason1970, You should be OK. Do you have any other issues before we begin cleaning up the tools we used?

Jason1970

Post #43January 4, 2012, 11:29 PM UTC

no other issues that I can think of, thx so much for your help

NoodleTech

Post #44January 4, 2012, 11:59 PM UTC

Great! My pleasure Jason1970 :).

Now let's clean up the tools we used.

Please delete DDS, getPartitions, aswMBR, and TDSSKiller from your desktop.

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Here are some tips to reduce the potential for spyware infection in the future:

Updates

It is very important that you keep your Operating System and applications up to date so that you will be less susceptible to malware.
It's a good idea to have Windows Update automatically download and install updates as they become available.
Secunia Online Software Inspector is a great tool that will tell you which of your applications are outdated and vulnerable to attack.

Run Anti-Virus Software

For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system.
When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
Once complete, remember to re-engage your resident security before going online.

Passwords

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection.
Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

Spyware Protection

This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

Additional Software

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements.
Google Chrome is a great alternative to Internet Explorer and Firefox.

Follow these steps, keep your antivirus program and antispyware programs updated, and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically. 

Hopefully this should take care of your problems! Good luck.

Do you have any further questions? 

**Please respond one more time to confirm your problem is resolved so I can close this thread.

Jason1970

Post #45January 5, 2012, 5:17 AM UTC

Hi & thank U so much for your help. I followed your uninstall instructions & everything looks fine, again thank you. I couldn't get my acrobat reader to update per the Secunia software scan's suggestion, it would stop less than 50% thru the install & would timeout, tried it 4 times with the same result, don't know how to get around it, any suggestions? That is the only issue remaining that I can think of. I can't afford the full acrobat suite, just need to be able to read pdf files. Can't really afford any software so must make do with shareware & freeware.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

conduit.search.com redirect/whitesmoke toolbar [Solved]

✨ Ask AI

Ask AI