What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

win32.Intelcore.D application (Varient) [Solved]

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi guys im back with this pc mis behaving. I have had problems for some time with mini dumps daily and the pc shutting down while im in the middle of working. However i have recently sent some error reporting to microsoft and the response back was i may have malware/spyware/virus, i ran a eset online scan which came up with this:

C:\Documents and Settings\Access Granted\Local Settings\temp\ICReinstall\cnet_ashampoo_burning_studio_6_free_6_80_4312_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Access Granted\Local Settings\temp\ICReinstall\cnet_CheetahDVDBurner_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Access Granted\My Documents\Downloads\cnet_ashampoo_burning_studio_6_free_6_80_4312_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Access Granted\My Documents\Downloads\cnet_CheetahDVDBurner_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Access Granted\My Documents\Downloads\cnet_CheetahDvdMaker_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Access Granted\My Documents\Downloads\cnet_san1715_exe(1).exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Access Granted\My Documents\Downloads\cnet_san1715_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined

I admit i did install/uninstall these as my Recordnow appears to have been deleted after a previous WTT visit. The files are still there but are 0% and is no longer on my start menu. As i was having many mini dumps proir to the above infections i know these are not reponsible and am hoping someone can shed light on to the cause of my pc's erratic behaviour and whether the above issues are totally removed. I did contact a gentleman called lee from software regarding the md's but he stoppped replying to me, any help is appreciated as i need the pc for studying purposes.
Kind Regards Lisa

otl log

OTL logfile created on: 13/01/2012 19:04:53 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Access Granted\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.48 Mb Total Physical Memory | 414.57 Mb Available Physical Memory | 40.51% Memory free
2.40 Gb Paging File | 1.65 Gb Available in Paging File | 68.68% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 83.67 Gb Free Space | 56.14% Space Free | Partition Type: NTFS

Computer Name: SN048919120306 | User Name: Access Granted | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Access Granted\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Online Armor\oaui.exe (Emsi Software GmbH)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oahlp.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportMS.dll ()
MOD - C:\Program Files\Trusteer\Rapport\bin\js32.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()


========== Win32 Services (SafeList) ==========

SRV - (VCSSecS) Virtual CD v4 Security service (SDK - Version) – File not found
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (AppMgmt) – File not found
SRV - (AffinegyService) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeActiveFileMonitor10.0) – C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\OAcat.exe (Emsi Software GmbH)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (MpKsl33fca16c) – File not found
DRV - (MpKsl295cfa97) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BAEF4379-E9FF-468C-8F34-8E372F2D2215}\MpKsl295cfa97.sys (Microsoft Corporation)
DRV - (RapportIaso) – c:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys (Trusteer Ltd.)
DRV - (RapportCerberus_32301) – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys ()
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\WINDOWS\system32\drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (AFGSp50) – C:\WINDOWS\system32\drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (vcsmpdrv) – C:\WINDOWS\system32\drivers\vcsmpdrv.sys (H+H Software GmbH)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 84 43 3C 02 CF CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "NCH Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.order.2: "Google"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2117678&SearchSource;=13"
FF - prefs.js..extensions.enabledItems: [removed]:2.3
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
FF - prefs.js..extensions.enabledItems: [removed]:1.0.7
FF - prefs.js..extensions.enabledItems: avg@igeared:6.011.025.001
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4de2a7dd&v;=7.004.022.004&i;=26&tp;=ab&iy;=&ychte;=uk&lng;=en-GB&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_96.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.0.60818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Access Granted\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/11/26 12:01:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/01/08 16:53:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/01/05 22:50:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/11 10:05:17 | 000,000,000 | —D | M]

[2011/01/19 16:57:21 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Extensions
[2012/01/05 22:50:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions
[2011/01/23 20:56:45 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/11/22 09:06:50 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/10/17 22:02:29 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}(2)
[2011/11/05 21:00:35 | 000,000,000 | —D | M] (MyAshampoo Community Toolbar) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2011/10/17 22:02:34 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)
[2011/11/05 20:08:53 | 000,000,000 | —D | M] (Conduit Engine) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]
[2012/01/05 22:50:22 | 000,000,000 | —D | M] ("Update Service") – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]
[2011/09/14 20:52:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]
[2011/07/14 10:50:09 | 000,000,909 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\searchplugins\conduit.xml
[2012/01/05 22:50:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/01/05 22:50:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/01/05 22:50:06 | 000,000,000 | —D | M] ("Update Service") – C:\Program Files\Mozilla Firefox\distribution\extensions\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\{0545B830-F0AA-4D7E-8820-50A4629A56FE}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\[removed]
[2011/12/25 02:46:57 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/10/19 18:02:07 | 000,611,224 | —- | M] (Oracle Corporation) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/12/25 02:46:57 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/12/25 02:46:57 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/12/25 02:46:57 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/12/25 02:46:57 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/12/25 02:46:57 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_96.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 7.0.10.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 7 U1 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Unity Player (Enabled) = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.0.60818.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\
CHR - Extension: Google Search = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2011/10/31 16:50:06 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\APPS\BAE\BAE.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A5780F9-9298-4B3F-BBAD-FA85CF37EE1F}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Access Granted\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Access Granted\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsi Software GmbH)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\Iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\Ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\Ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\Ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\Iyvu9_32.dll ()
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/13 19:03:01 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Access Granted\Desktop\OTL.exe
[2012/01/08 17:14:05 | 000,000,000 | —D | C] – C:\Documents and Settings\Access Granted\Application Data\DDMSettings
[2012/01/08 16:57:54 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2012/01/08 16:55:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2011/12/21 11:54:48 | 000,056,208 | —- | C] (Trusteer Ltd.) – C:\WINDOWS\System32\drivers\RapportKELL.sys
[2011/12/18 14:28:21 | 000,000,000 | —D | C] – C:\79f30fa1ab35e5c8c096
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/13 19:03:31 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Access Granted\Desktop\OTL.exe
[2012/01/13 19:03:02 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/13 18:57:18 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/01/13 18:55:20 | 000,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2012/01/13 18:55:19 | 000,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.EXE
[2012/01/13 18:03:01 | 000,000,898 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/13 16:40:59 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012/01/13 16:35:38 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/13 16:35:36 | 1073,270,784 | -HS- | M] () – C:\hiberfil.sys
[2012/01/13 16:33:43 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/11 11:09:47 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/01/10 12:55:07 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/01/08 16:55:03 | 000,001,816 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2012/01/08 16:55:03 | 000,001,794 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/08 16:53:25 | 000,001,760 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2012/01/08 16:53:22 | 000,001,499 | —- | M] () – C:\Documents and Settings\Access Granted\Desktop\DivX Movies.lnk
[2012/01/08 16:47:13 | 000,000,780 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2012/01/08 15:19:13 | 000,002,515 | —- | M] () – C:\Documents and Settings\Access Granted\Desktop\Microsoft Office Word 2007.lnk
[2012/01/07 15:53:47 | 000,556,112 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/01/07 15:53:47 | 000,117,818 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/01/05 22:50:12 | 000,000,745 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/01/05 22:50:12 | 000,000,727 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/12/21 11:54:48 | 000,056,208 | —- | M] (Trusteer Ltd.) – C:\WINDOWS\System32\drivers\RapportKELL.sys
[2011/12/19 02:00:01 | 000,000,360 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-SN048919120306-Access Granted.job
[2011/12/18 17:51:35 | 003,723,264 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/18 14:57:52 | 000,417,440 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2011/12/18 14:57:52 | 000,069,792 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/08 16:55:03 | 000,001,816 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2012/01/08 16:55:03 | 000,001,794 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/08 16:52:49 | 000,000,902 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/08 16:52:48 | 000,000,898 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/08 16:47:13 | 000,000,780 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2012/01/05 22:50:12 | 000,000,745 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/01/05 22:50:12 | 000,000,733 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/01/05 22:50:12 | 000,000,727 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/10/22 09:45:18 | 000,175,616 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2011/10/22 09:45:16 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2011/10/22 09:45:15 | 000,650,752 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/10/22 09:45:14 | 000,243,200 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/10/22 09:45:13 | 000,074,752 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2011/08/08 10:34:01 | 000,001,456 | —- | C] () – C:\Documents and Settings\Access Granted\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs
[2011/07/04 22:27:06 | 000,057,864 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/06/15 21:18:30 | 000,280,276 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/06/15 21:18:30 | 000,280,276 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/06/15 21:18:30 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/06/15 21:16:07 | 002,128,778 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2011/06/09 10:48:13 | 000,039,048 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2011/06/09 10:48:12 | 000,205,864 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2011/04/27 19:05:19 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[2011/02/15 21:15:37 | 000,000,158 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\wklnhst.dat
[2011/01/21 17:41:51 | 000,000,030 | —- | C] () – C:\WINDOWS\iedit.INI
[2011/01/21 17:35:19 | 000,024,576 | —- | C] () – C:\Documents and Settings\Access Granted\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/19 16:36:07 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/01/13 14:49:18 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2011/01/13 14:46:06 | 000,003,439 | —- | C] () – C:\WINDOWS\mozver.dat
[2011/01/13 14:42:25 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2011/01/13 14:39:24 | 000,000,514 | —- | C] () – C:\WINDOWS\System32\SETUPPC.INI
[2011/01/13 14:33:42 | 000,007,584 | —- | C] () – C:\WINDOWS\HDReg.ini
[2011/01/13 14:32:28 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2011/01/13 14:17:47 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2005/05/20 14:05:02 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/05/12 13:24:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/10 17:13:32 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 17:03:24 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 16:55:57 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 16:48:11 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 16:46:35 | 003,723,264 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 16:38:12 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 16:38:09 | 000,556,112 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 16:38:09 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 16:38:09 | 000,117,818 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 16:38:09 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 16:38:08 | 000,004,541 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 16:38:06 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/10 16:38:04 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 16:37:57 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 16:37:57 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 16:37:48 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 16:37:40 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2011/11/05 20:31:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Ashampoo
[2011/06/20 13:12:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Audacity
[2011/06/03 11:34:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Auslogics
[2011/02/24 17:20:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\AVG10
[2011/08/28 17:46:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Boolat Games
[2011/09/06 12:27:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Canon
[2011/07/04 22:26:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/07/04 17:25:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/01/08 17:14:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\DDMSettings
[2011/10/19 18:38:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\ElevatedDiagnostics
[2011/08/23 15:09:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\go
[2011/05/26 18:25:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\GrabPro
[2011/03/26 12:43:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Leadertech
[2011/10/23 21:11:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\LibreOffice
[2011/06/20 14:01:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\NCH Swift Sound
[2011/01/20 21:04:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\OD2
[2011/07/15 09:33:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\OnlineArmor
[2011/06/23 11:20:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\OpenCandy
[2011/10/23 21:56:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\OpenOffice.org
[2011/10/19 20:23:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Orbit
[2011/09/16 21:55:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\PhotoScape
[2011/11/30 12:33:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\PriceGong
[2011/05/26 15:39:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\ProgSense
[2011/09/18 07:54:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\QuickScan
[2011/10/17 21:15:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Spotify
[2011/10/17 19:30:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Systweak
[2011/02/15 21:16:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Template
[2011/09/14 20:18:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\TP
[2011/06/20 09:18:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Trusteer
[2011/01/19 21:45:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\Ulead Systems
[2011/05/31 11:33:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\WinPatrol
[2011/09/14 20:32:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Access Granted\Application Data\{90140011-0061-0409-0000-0000000FF1CE}
[2011/02/18 15:23:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Affinegy
[2011/11/05 20:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ashampoo
[2011/02/24 17:17:55 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/09/14 20:54:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Easybits GO
[2011/06/09 10:39:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/06/20 16:16:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2011/01/13 14:37:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OD2
[2011/06/09 11:16:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2011/11/01 18:18:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/12/27 00:31:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/06/20 09:16:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2011/01/13 14:39:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2011/01/13 14:33:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/09/14 20:16:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Virtualized Applications
[2011/04/25 21:49:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2011/08/07 21:07:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2011/01/30 14:09:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/01/13 16:40:59 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/01/13 14:28:50 | 000,000,210 | RHS- | M] () – C:\BOOT.BAK
[2011/06/15 20:47:21 | 000,000,281 | -HS- | M] () – C:\BOOT.INI
[2004/08/04 14:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2011/10/31 16:53:50 | 000,024,042 | —- | M] () – C:\ComboFix.txt
[2011/09/21 08:53:43 | 000,509,099 | —- | M] () – C:\DeQuarantine.txt
[2011/01/13 15:07:20 | 000,006,569 | —- | M] () – C:\DWNLOG.TXT
[2011/11/02 19:51:55 | 000,011,149 | —- | M] () – C:\HCT.Log
[2012/01/13 16:35:36 | 1073,270,784 | -HS- | M] () – C:\hiberfil.sys
[2011/01/13 14:31:40 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/01/13 14:33:19 | 000,000,886 | -H– | M] () – C:\IPH.PH
[2011/09/19 12:39:24 | 000,026,004 | —- | M] () – C:\JavaRa.log
[2011/04/27 22:55:48 | 005,748,345 | —- | M] () – C:\Lemmings.log
[2011/01/13 15:07:20 | 000,006,569 | —- | M] () – C:\MCDLOG.TXT
[2011/01/13 14:31:40 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 14:00:00 | 000,047,564 | —- | M] () – C:\NTDETECT.COM
[2011/01/29 19:01:49 | 000,250,048 | —- | M] () – C:\NTLDR
[2012/01/13 16:35:34 | 1609,801,728 | -HS- | M] () – C:\pagefile.sys
[2011/11/13 15:18:48 | 000,010,636 | —- | M] () – C:\profile_43.txt
[2011/01/13 15:07:20 | 000,000,000 | —- | M] () – C:\UPDFLOP.TAG

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 16:58:22 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 12:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 18:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 10:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 16:46:06 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/08/10 16:46:06 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/08/10 16:46:06 | 000,847,872 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/01/29 19:05:59 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/01/29 19:18:17 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 17:04:54 | 000,000,079 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/09/19 18:43:21 | 016,897,824 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Access Granted\Desktop\jre-6u27-windows-i586.exe
[2012/01/13 19:03:31 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Access Granted\Desktop\OTL.exe
[2011/01/19 16:29:52 | 001,029,000 | —- | M] (Skype Technologies S.A.) – C:\Documents and Settings\Access Granted\Desktop\SkypeSetup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-11 11:09:57

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

First we need to make all files and folders VISIBLE:

  • Go to Start >> Control Panel >> Folder Options >> View
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
———-

Apologies for the delay in response. As you can see we are very busy here.
———-


Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-
Post #3
Hi Jeff thanks for your time: aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software Run date: 2012-01-17 10:53:04 —————————– 10:53:04.015 OS Version: Windows 5.1.2600 Service Pack 3 10:53:04.015 Number of processors: 1 586 0x401 10:53:04.015 ComputerName: SN048919120306 UserName: Access Granted 10:53:05.796 Initialize success 10:53:35.203 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 10:53:35.203 Disk 0 Vendor: WDC_WD1600JS-55MHB1 10.02E01 Size: 152627MB BusType: 3 10:53:35.203 Disk 0 MBR read successfully 10:53:35.203 Disk 0 MBR scan 10:53:35.203 Disk 0 unknown MBR code 10:53:35.218 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 152617 MB offset 63 10:53:35.218 Disk 0 scanning sectors +312560640 10:53:35.296 Disk 0 scanning C:\WINDOWS\system32\drivers 10:53:46.875 Service scanning 10:53:47.765 Service MpKsl2a51d5b8 c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C68CCBBC-661E-406F-8D1E-0146F9A9DF8A}\MpKsl2a51d5b8.sys **LOCKED** 32 10:53:48.484 Modules scanning 10:54:04.656 Disk 0 trace - called modules: 10:54:04.671 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 10:54:04.687 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87156290] 10:54:05.015 3 CLASSPNP.SYS[f761bfd7] -> nt!IofCallDriver -> \Device\000000a0[0x8717e1b0] 10:54:05.015 5 ACPI.sys[f7432620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x87156940] 10:54:05.031 Scan finished successfully 10:54:18.312 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Access Granted\Desktop\MBR.dat" 10:54:18.328 The log file has been saved successfully to "C:\Documents and Settings\Access Granted\Desktop\aswMBR.txt"
Post #4
Hi,

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #5
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000000d Kernel Drivers (total 175): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806D1000 \WINDOWS\system32\hal.dll 0xF7A5B000 \WINDOWS\system32\KDCOM.DLL 0xF796B000 \WINDOWS\system32\BOOTVID.dll 0xF742C000 ACPI.sys 0xF7A5D000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF741B000 pci.sys 0xF755B000 isapnp.sys 0xF7B23000 pciide.sys 0xF77DB000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF7A5F000 aliide.sys 0xF7A61000 cmdide.sys 0xF7A63000 toside.sys 0xF7A65000 viaide.sys 0xF7A67000 intelide.sys 0xF756B000 MountMgr.sys 0xF73FC000 ftdisk.sys 0xF77E3000 PartMgr.sys 0xF757B000 VolSnap.sys 0xF796F000 cpqarray.sys 0xF73E4000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS 0xF73CC000 atapi.sys 0xF7973000 aha154x.sys 0xF77EB000 sparrow.sys 0xF7977000 symc810.sys 0xF758B000 aic78xx.sys 0xF797B000 dac960nt.sys 0xF759B000 ql10wnt.sys 0xF797F000 amsint.sys 0xF77F3000 asc.sys 0xF7983000 asc3550.sys 0xF77FB000 mraid35x.sys 0xF7803000 i2omp.sys 0xF7987000 ini910u.sys 0xF75AB000 ql1240.sys 0xF75BB000 aic78u2.sys 0xF780B000 symc8xx.sys 0xF7813000 sym_hi.sys 0xF781B000 sym_u3.sys 0xF7823000 ABP480N5.SYS 0xF782B000 asc3350p.sys 0xF7A69000 cd20xrnt.sys 0xF75CB000 ultra.sys 0xF73B3000 adpu160m.sys 0xF7833000 dpti2o.sys 0xF75DB000 ql1080.sys 0xF75EB000 ql1280.sys 0xF75FB000 ql12160.sys 0xF783B000 perc2.sys 0xF7A6B000 perc2hib.sys 0xF7843000 hpn.sys 0xF798B000 cbidf2k.sys 0xF7387000 dac2w2k.sys 0xF760B000 disk.sys 0xF761B000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF7367000 fltmgr.sys 0xF7355000 sr.sys 0xF762B000 PxHelp20.sys 0xF733E000 KSecDD.sys 0xF72B1000 Ntfs.sys 0xF7284000 NDIS.sys 0xF763B000 sisagp.sys 0xF764B000 viaagp.sys 0xF798F000 RecAgent.sys 0xF765B000 ohci1394.sys 0xF766B000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xF726A000 Mup.sys 0xF767B000 alim1541.sys 0xF768B000 amdagp.sys 0xF769B000 agp440.sys 0xF76AB000 agpCPQ.sys 0xF76DB000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xF77BB000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xF61F0000 \SystemRoot\system32\DRIVERS\nv4_mini.sys 0xF61DC000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF61B4000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xF785B000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF6190000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF7863000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF612D000 \SystemRoot\system32\DRIVERS\slntamr.sys 0xF71A2000 \SystemRoot\system32\DRIVERS\SlWdmSup.sys 0xF610E000 \SystemRoot\system32\DRIVERS\Mtlmnt5.sys 0xF786B000 \SystemRoot\System32\Drivers\Modem.SYS 0xF60FD000 \SystemRoot\system32\DRIVERS\Rtlnic51.sys 0xF7873000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF725A000 \SystemRoot\system32\DRIVERS\serial.sys 0xF719A000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF60E9000 \SystemRoot\system32\DRIVERS\parport.sys 0xF724A000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF723A000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF722A000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF60C6000 \SystemRoot\system32\DRIVERS\ks.sys 0xF787B000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0xF7C22000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF721A000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF7192000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF60AF000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF720A000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF71FA000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF7883000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF788B000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF7893000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF789B000 \SystemRoot\system32\DRIVERS\wanatw4.sys 0xF71EA000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF78A3000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF78AB000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF71DA000 \SystemRoot\system32\DRIVERS\vcsmpdrv.sys 0xF7A93000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF6051000 \SystemRoot\system32\DRIVERS\update.sys 0xF718A000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF71CA000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF36C0000 \SystemRoot\system32\drivers\RtkHDAud.sys 0xF369C000 \SystemRoot\system32\drivers\portcls.sys 0xF76EB000 \SystemRoot\system32\drivers\drmk.sys 0xF6E77000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF7A99000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF7A33000 \SystemRoot\system32\drivers\MODEMCSA.sys 0xF78C3000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF7A47000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xF34D0000 \SystemRoot\system32\DRIVERS\MpFilter.sys 0xF78FB000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xF344A000 \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys 0xF7AD7000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7C01000 \SystemRoot\System32\Drivers\Null.SYS 0xF7AD9000 \SystemRoot\System32\Drivers\Beep.SYS 0xF790B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF7913000 \SystemRoot\System32\drivers\vga.sys 0xF7ADB000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7ADD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF791B000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7923000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF6029000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xF792B000 \??\C:\WINDOWS\system32\drivers\OAnet.sys 0xF3417000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xF6E37000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF33BE000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xF6E27000 \??\C:\WINDOWS\system32\drivers\OAmon.sys 0xF32F6000 \SystemRoot\system32\DRIVERS\netbt.sys 0xF32D4000 \SystemRoot\System32\drivers\afd.sys 0xF6E17000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF32A9000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xF325B000 \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys 0xF6DF7000 \??\C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys 0xF7933000 \??\C:\WINDOWS\system32\drivers\oahlp32.sys 0xF322A000 \??\C:\WINDOWS\system32\drivers\OADriver.sys 0xF31BA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF6DE7000 \SystemRoot\System32\Drivers\Fips.SYS 0xF3194000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF76FB000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xF770B000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xF3678000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF771B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF3674000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xF366C000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xF776B000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xF317C000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7AED000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7A4F000 \SystemRoot\System32\drivers\Dxapi.sys 0xF34C8000 \SystemRoot\System32\watchdog.sys 0xBD000000 \SystemRoot\System32\drivers\dxg.sys 0xF7C72000 \SystemRoot\System32\drivers\dxgthk.sys 0xBD012000 \SystemRoot\System32\nv4_disp.dll 0xBD417000 \SystemRoot\System32\ATMFD.DLL 0xB7C9A000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xB7901000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB789C000 \SystemRoot\system32\drivers\wdmaud.sys 0xF777B000 \SystemRoot\system32\drivers\sysaudio.sys 0xB7574000 \SystemRoot\system32\DRIVERS\srv.sys 0xB70AB000 \SystemRoot\System32\Drivers\HTTP.sys 0xB6B08000 \??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C68CCBBC-661E-406F-8D1E-0146F9A9DF8A}\MpKsl2a51d5b8.sys 0xB6B80000 \??\C:\DOCUME~1\ACCESS~1\LOCALS~1\Temp\aswMBR.sys 0xF328D000 \??\c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportms\baseline\rapportiaso.sys 0xB63A8000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 43): 0 System Idle Process 4 System 392 C:\WINDOWS\system32\smss.exe 444 csrss.exe 468 C:\WINDOWS\system32\winlogon.exe 516 C:\WINDOWS\system32\services.exe 528 C:\WINDOWS\system32\lsass.exe 680 C:\WINDOWS\system32\svchost.exe 724 svchost.exe 764 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe 812 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe 1016 C:\WINDOWS\system32\svchost.exe 1280 svchost.exe 1424 C:\WINDOWS\explorer.exe 1480 C:\Program Files\Online Armor\oacat.exe 1652 C:\WINDOWS\system32\spoolsv.exe 1732 svchost.exe 1764 C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe 1788 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 2004 C:\WINDOWS\system32\nvsvc32.exe 176 daemonu.exe 212 C:\WINDOWS\system32\slserv.exe 2088 alg.exe 2516 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe 2916 C:\WINDOWS\ALCWZRD.EXE 2992 C:\Program Files\QuickTime\QTTask.exe 3028 C:\WINDOWS\system32\rundll32.exe 3060 C:\Program Files\iTunes\iTunesHelper.exe 3068 C:\Program Files\Microsoft Security Client\msseces.exe 3080 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe 3092 C:\Program Files\DivX\DivX Update\DivXUpdate.exe 3100 C:\Program Files\Real\RealPlayer\Update\realsched.exe 3116 C:\WINDOWS\system32\ctfmon.exe 3392 C:\Program Files\iPod\bin\iPodService.exe 1048 C:\Program Files\Google\Chrome\Application\chrome.exe 1152 C:\Program Files\Google\Chrome\Application\chrome.exe 1344 C:\Program Files\Google\Chrome\Application\chrome.exe 2424 C:\Program Files\Google\Chrome\Application\chrome.exe 1860 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE 1440 C:\Program Files\Google\Chrome\Application\chrome.exe 2220 C:\Program Files\Google\Chrome\Application\chrome.exe 2804 C:\WINDOWS\system32\wscntfy.exe 5560 C:\Documents and Settings\Access Granted\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD1600JS-55MHB1, Rev: 10.02E01 Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Windows 98 MBR code detected SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E Done!
Post #6
Hi lisafunckypants,

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
SRV - (VCSSecS) Virtual CD v4 Security service (SDK - Version) – File not found
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (AppMgmt) – File not found
SRV - (AffinegyService) – File not found
DRV - (MpKsl33fca16c) – File not found
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "NCH Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.order.2: "Google"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2117678&SearchSource=13"
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
[2011/10/17 22:02:34 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)
[2011/11/05 20:08:53 | 000,000,000 | —D | M] (Conduit Engine) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]
[2011/07/14 10:50:09 | 000,000,909 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\searchplugins\conduit.xml
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2011/01/21 17:35:19 | 000,024,576 | —- | C] () – C:\Documents and Settings\Access Granted\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[clearallrestorepoints]
[resethosts]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Post #7
hi it didnt give me a log once it completed the fix it rebooted straight way and when windows came back on it asked to run it again and produced this log:


All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Error: No service named VCSSecS) Virtual CD v4 Security service (SDK - Version was found to stop!
Service\Driver key VCSSecS) Virtual CD v4 Security service (SDK - Version not found.
File File not found not found.
Error: No service named rpcapd) Remote Packet Capture Protocol v.0 (experimental was found to stop!
Service\Driver key rpcapd) Remote Packet Capture Protocol v.0 (experimental not found.
File File not found not found.
Service AppMgmt stopped successfully!
Service AppMgmt deleted successfully!
File File not found not found.
Service AffinegyService stopped successfully!
Service AffinegyService deleted successfully!
File File not found not found.
Error: No service named MpKsl33fca16c was found to stop!
Service\Driver key MpKsl33fca16c not found.
File File not found not found.
Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
Prefs.js: "NCH Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Web Search" removed from browser.search.order.1
Prefs.js: "Google" removed from browser.search.order.2
Prefs.js: "Web Search" removed from browser.search.selectedEngine
Prefs.js: "http://search.conduit.com/?ctid=CT2117678&SearchSource=13" removed from browser.startup.homepage
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@viewpoint.com/VMP\ deleted successfully.
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)\searchplugin(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)\modules(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)\META-INF(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)\defaults(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)\components(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2)\chrome(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}(2) folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\searchplugin folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\META-INF folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\lib folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\DualPackage folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\defaults folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\components folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]\chrome folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed] folder moved successfully.
C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\searchplugins\conduit.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214}\ deleted successfully.
C:\Program Files\Orbitdownloader\orbitcth.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
C:\WINDOWS\System32\ConduitEngine.tmp deleted successfully.
C:\WINDOWS\System32\SET1A3.tmp deleted successfully.
C:\WINDOWS\System32\SET1AF.tmp deleted successfully.
C:\WINDOWS\System32\SETCE.tmp deleted successfully.
C:\WINDOWS\System32\SETD0.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\Documents and Settings\Access Granted\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
C:\Documents and Settings\Access Granted\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Access Granted\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Access Granted
->Temp folder emptied: 4436984883 bytes
->Temporary Internet Files folder emptied: 65574849 bytes
->Java cache emptied: 267524 bytes
->FireFox cache emptied: 48514724 bytes
->Google Chrome cache emptied: 71571197 bytes
->Flash cache emptied: 79930 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 56466 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 343 bytes

User: NetworkService
->Temp folder emptied: 297516 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16730600 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 15255244 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 6307723 bytes

Total Files Cleaned = 4,446.00 mb


[EMPTYJAVA]

User: Access Granted
->Java cache emptied: 0 bytes

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: Access Granted
->Flash cache emptied: 0 bytes

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: UpdatusUser

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 01182012_102748

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…
Post #8
jeff was i supposed to check purity and lop on the first fix? because they werent checked!!
This is the scan i did after reboot;


OTL logfile created on: 18/01/2012 10:40:07 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Access Granted\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.48 Mb Total Physical Memory | 326.87 Mb Available Physical Memory | 31.94% Memory free
2.40 Gb Paging File | 1.83 Gb Available in Paging File | 76.07% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 94.57 Gb Free Space | 63.45% Space Free | Partition Type: NTFS

Computer Name: SN048919120306 | User Name: Access Granted | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Access Granted\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Online Armor\oaui.exe (Emsi Software GmbH)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oahlp.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Google\Chrome\Application\16.0.912.75\ppgooglenaclpluginchrome.dll ()
MOD - C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll ()
MOD - C:\Program Files\Google\Chrome\Application\16.0.912.75\avutil-51.dll ()
MOD - C:\Program Files\Google\Chrome\Application\16.0.912.75\avformat-53.dll ()
MOD - C:\Program Files\Google\Chrome\Application\16.0.912.75\avcodec-53.dll ()
MOD - C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportMS.dll ()
MOD - C:\Program Files\Trusteer\Rapport\bin\js32.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()


========== Win32 Services (SafeList) ==========

SRV - (VCSSecS) Virtual CD v4 Security service (SDK - Version) – File not found
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeActiveFileMonitor10.0) – C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\OAcat.exe (Emsi Software GmbH)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (RapportCerberus_32301) – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys ()
DRV - (RapportIaso) – c:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\WINDOWS\system32\drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (AFGSp50) – C:\WINDOWS\system32\drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (vcsmpdrv) – C:\WINDOWS\system32\drivers\vcsmpdrv.sys (H+H Software GmbH)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 84 43 3C 02 CF CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.order.2: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: [removed]:2.3
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
FF - prefs.js..extensions.enabledItems: [removed]:1.0.7
FF - prefs.js..extensions.enabledItems: avg@igeared:6.011.025.001
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4de2a7dd&v;=7.004.022.004&i;=26&tp;=ab&iy;=&ychte;=uk&lng;=en-GB&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_96.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.0.60818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Access Granted\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/11/26 12:01:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/01/08 16:53:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/01/05 22:50:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/11 10:05:17 | 000,000,000 | —D | M]

[2011/01/19 16:57:21 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Extensions
[2012/01/18 10:27:52 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions
[2011/01/23 20:56:45 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/11/22 09:06:50 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/10/17 22:02:29 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}(2)
[2011/11/05 21:00:35 | 000,000,000 | —D | M] (MyAshampoo Community Toolbar) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2012/01/05 22:50:22 | 000,000,000 | —D | M] ("Update Service") – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]
[2011/09/14 20:52:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Access Granted\Application Data\Mozilla\Firefox\Profiles\5euyt50z.default\extensions\[removed]
[2012/01/05 22:50:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/01/05 22:50:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/01/05 22:50:06 | 000,000,000 | —D | M] ("Update Service") – C:\Program Files\Mozilla Firefox\distribution\extensions\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\{0545B830-F0AA-4D7E-8820-50A4629A56FE}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\ACCESS GRANTED\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5EUYT50Z.DEFAULT\EXTENSIONS\[removed]
[2011/12/25 02:46:57 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/10/19 18:02:07 | 000,611,224 | —- | M] (Oracle Corporation) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/12/25 02:46:57 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/12/25 02:46:57 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/12/25 02:46:57 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/12/25 02:46:57 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/12/25 02:46:57 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_96.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 7.0.10.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 7 U1 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Unity Player (Enabled) = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.0.60818.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\
CHR - Extension: Google Search = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = C:\Documents and Settings\Access Granted\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/01/18 10:29:15 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\APPS\BAE\BAE.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\Access Granted\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A5780F9-9298-4B3F-BBAD-FA85CF37EE1F}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Access Granted\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Access Granted\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsi Software GmbH)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/18 10:27:48 | 000,000,000 | —D | C] – C:\_OTL
[2012/01/18 10:23:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2012/01/17 10:51:12 | 004,713,472 | —- | C] (AVAST Software) – C:\Documents and Settings\Access Granted\Desktop\aswMBR.exe
[2012/01/13 19:03:01 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Access Granted\Desktop\OTL.exe
[2012/01/08 17:14:05 | 000,000,000 | —D | C] – C:\Documents and Settings\Access Granted\Application Data\DDMSettings
[2012/01/08 16:57:54 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2012/01/08 16:55:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2012/01/04 14:33:56 | 000,056,208 | —- | C] (Trusteer Ltd.) – C:\WINDOWS\System32\drivers\RapportKELL.sys

========== Files - Modified Within 30 Days ==========

[2012/01/18 10:35:46 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012/01/18 10:30:58 | 000,000,898 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/18 10:30:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/18 10:30:34 | 1073,270,784 | -HS- | M] () – C:\hiberfil.sys
[2012/01/18 10:29:15 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2012/01/18 10:23:56 | 000,000,770 | —- | M] () – C:\Documents and Settings\Access Granted\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/01/18 10:23:44 | 000,000,632 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\NTREGOPT.lnk
[2012/01/18 10:23:44 | 000,000,613 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\ERUNT.lnk
[2012/01/17 20:05:57 | 000,080,384 | —- | M] () – C:\Documents and Settings\Access Granted\Desktop\MBRCheck.exe
[2012/01/17 20:03:00 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/17 19:57:16 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/01/17 12:55:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/01/17 11:42:15 | 000,002,515 | —- | M] () – C:\Documents and Settings\Access Granted\Desktop\Microsoft Office Word 2007.lnk
[2012/01/17 10:54:18 | 000,000,512 | —- | M] () – C:\Documents and Settings\Access Granted\Desktop\MBR.dat
[2012/01/17 10:51:33 | 004,713,472 | —- | M] (AVAST Software) – C:\Documents and Settings\Access Granted\Desktop\aswMBR.exe
[2012/01/17 10:38:00 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/13 19:03:31 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Access Granted\Desktop\OTL.exe
[2012/01/13 18:55:20 | 000,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2012/01/13 18:55:19 | 000,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.EXE
[2012/01/11 11:09:57 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/01/08 16:55:03 | 000,001,816 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2012/01/08 16:55:03 | 000,001,794 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/08 16:53:25 | 000,001,760 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2012/01/08 16:53:22 | 000,001,499 | —- | M] () – C:\Documents and Settings\Access Granted\Desktop\DivX Movies.lnk
[2012/01/08 16:47:13 | 000,000,780 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2012/01/07 15:53:47 | 000,556,112 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/01/07 15:53:47 | 000,117,818 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/01/05 22:50:12 | 000,000,745 | —- | M] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/01/05 22:50:12 | 000,000,727 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/01/04 14:33:56 | 000,056,208 | —- | M] (Trusteer Ltd.) – C:\WINDOWS\System32\drivers\RapportKELL.sys

========== Files Created - No Company Name ==========

[2012/01/18 10:23:56 | 000,000,770 | —- | C] () – C:\Documents and Settings\Access Granted\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/01/18 10:23:44 | 000,000,632 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\NTREGOPT.lnk
[2012/01/18 10:23:44 | 000,000,613 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\ERUNT.lnk
[2012/01/17 20:05:41 | 000,080,384 | —- | C] () – C:\Documents and Settings\Access Granted\Desktop\MBRCheck.exe
[2012/01/17 10:54:18 | 000,000,512 | —- | C] () – C:\Documents and Settings\Access Granted\Desktop\MBR.dat
[2012/01/08 16:55:03 | 000,001,816 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2012/01/08 16:55:03 | 000,001,794 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/08 16:52:49 | 000,000,902 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/08 16:52:48 | 000,000,898 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/08 16:47:13 | 000,000,780 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2012/01/05 22:50:12 | 000,000,745 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/01/05 22:50:12 | 000,000,733 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/01/05 22:50:12 | 000,000,727 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/10/22 09:45:18 | 000,175,616 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2011/10/22 09:45:16 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2011/10/22 09:45:15 | 000,650,752 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/10/22 09:45:14 | 000,243,200 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/10/22 09:45:13 | 000,074,752 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2011/08/08 10:34:01 | 000,001,456 | —- | C] () – C:\Documents and Settings\Access Granted\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs
[2011/07/04 22:27:06 | 000,057,864 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/06/15 21:18:30 | 000,280,276 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/06/15 21:18:30 | 000,280,276 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/06/15 21:18:30 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/06/15 21:16:07 | 002,128,778 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2011/06/09 10:48:13 | 000,039,048 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2011/06/09 10:48:12 | 000,205,864 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2011/04/27 19:05:19 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[2011/02/15 21:15:37 | 000,000,158 | —- | C] () – C:\Documents and Settings\Access Granted\Application Data\wklnhst.dat
[2011/01/21 17:41:51 | 000,000,030 | —- | C] () – C:\WINDOWS\iedit.INI
[2011/01/19 16:36:07 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/01/13 14:49:18 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2011/01/13 14:46:06 | 000,003,439 | —- | C] () – C:\WINDOWS\mozver.dat
[2011/01/13 14:42:25 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2011/01/13 14:39:24 | 000,000,514 | —- | C] () – C:\WINDOWS\System32\SETUPPC.INI
[2011/01/13 14:33:42 | 000,007,584 | —- | C] () – C:\WINDOWS\HDReg.ini
[2011/01/13 14:32:28 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2011/01/13 14:17:47 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2005/05/20 14:05:02 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/05/12 13:24:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/10 17:13:32 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 17:03:24 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/10 16:55:57 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 16:48:11 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 16:46:35 | 003,723,264 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 16:38:12 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 16:38:09 | 000,556,112 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 16:38:09 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 16:38:09 | 000,117,818 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 16:38:09 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 16:38:08 | 000,004,541 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 16:38:06 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/10 16:38:04 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 16:37:57 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 16:37:57 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 16:37:48 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 16:37:40 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >
Post #9
Hi lisafunckypants,

I see that you have Malwarebytes on your system. Please open Malwarebytes, update it and then run a Quick Scan. Please save the log that is created for your next reply.
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
———-

In your next reply please post the logs that are created by Malwarebytes and ESET online scanner. :)
Post #10
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.18.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Access Granted :: SN048919120306 [administrator]

18/01/2012 13:21:37
mbam-log-2012-01-18 (13-21-37).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 205690
Time elapsed: 7 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)



Report from ESET:

C:\Documents and Settings\Access Granted\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\5\73319d45-57764031 Java/TrojanDownloader.OpenStream.NCO trojan
Post #11
Hi,

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Files
C:\Documents and Settings\Access Granted\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\5\73319d45-57764031 

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
———-

Please post the log created by OTL and let me know how your system is running. :)
Post #13
hi jeff Still with you sorry for the delay just having a short break away.. however ive tried to do the otl fix on my pc and the whole screen went white and unresponsive, I had to switch off via power button due to amount of time it was taking. and couldnt return back online after that. I am returning home today so shall give it another go in the morning and get back to you with the results Thanks Lisa
Post #15
Hi Jeff I can not run this fix on OTL, once i press run fix button my internet protection disables and a box appears asking to turn it back on, i dont touch it but the otl seems to freeze, although theres a hour glass timer on screen nothing happens and then the whole page turns white, leaving no start panel or icons on desktop, and is totally unresponsive, yet again i have had to restart pc by manually turning off at the main power button Lisa :wacko:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI