Deleted Member
That worked.
Spyware / Malware / Virus Removal
Start Up Problem
19 min read
mowman
Good,now download a fresh copy and run it,post the log.
Deleted Member
I don't know if it means anything but Combofix worked alot kwicker. Nothing popped up during scan
ComboFix 12-01-19.02 - VJones 21/01/2012 15:45:32.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2036.1141 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-21 to 2012-01-21 )))))))))))))))))))))))))))))))
.
.
2012-01-21 15:59 . 2012-01-21 15:59 ——– d—–w- c:\users\VJones\AppData\Local\temp
2012-01-21 15:59 . 2012-01-21 15:59 ——– d—–w- c:\users\UltimoLee\AppData\Local\temp
2012-01-21 15:59 . 2012-01-21 15:59 ——– d—–w- c:\users\Ultimo Lee\AppData\Local\temp
2012-01-20 12:43 . 2012-01-06 04:19 6557240 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A807C4C0-BC51-4245-8F60-590F9F95BF4A}\mpengine.dll
2012-01-18 23:26 . 2012-01-18 23:26 ——– d—–w- c:\users\VJones\AppData\Roaming\f-secure
2012-01-18 23:25 . 2012-01-18 23:25 ——– d—–w- c:\programdata\F-Secure
2012-01-18 16:34 . 2012-01-18 16:34 ——– d—–w- c:\program files\ESET
2012-01-17 22:13 . 2011-12-10 15:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-01-17 22:12 . 2012-01-17 22:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-01-11 20:07 . 2011-10-14 16:03 189952 —-a-w- c:\windows\system32\winmm.dll
2012-01-11 20:07 . 2011-10-14 16:00 23552 —-a-w- c:\windows\system32\mciseq.dll
2012-01-11 20:06 . 2011-11-18 20:23 1205064 —-a-w- c:\windows\system32\ntdll.dll
2012-01-11 20:06 . 2011-11-18 17:47 66560 —-a-w- c:\windows\system32\packager.dll
2012-01-11 20:06 . 2011-11-25 15:59 376320 —-a-w- c:\windows\system32\winsrv.dll
2012-01-11 20:06 . 2011-12-01 15:21 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-01-11 20:06 . 2011-10-25 15:58 1314816 —-a-w- c:\windows\system32\quartz.dll
2012-01-11 20:06 . 2011-10-25 15:58 497152 —-a-w- c:\windows\system32\qdvd.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:37 . 2011-12-14 23:16 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-11-15 14:29 . 2009-10-03 00:32 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-08 14:42 . 2011-12-14 23:16 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-03 06:22 . 2011-12-14 23:15 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-03 06:17 . 2011-12-14 23:14 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-03 06:17 . 2011-12-14 23:15 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 06:17 . 2011-12-14 23:14 71680 —-a-w- c:\windows\system32\iesetup.dll
2011-11-03 06:17 . 2011-12-14 23:14 109056 —-a-w- c:\windows\system32\iesysprep.dll
2011-11-03 05:22 . 2011-12-14 23:15 385024 —-a-w- c:\windows\system32\html.iec
2011-11-03 04:45 . 2011-12-14 23:14 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2011-11-03 04:43 . 2011-12-14 23:14 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-27 08:01 . 2011-12-14 23:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-27 08:01 . 2011-12-14 23:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 15:56 . 2011-12-14 23:16 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-07 17:55 . 2011-07-03 18:35 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sh–r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 31232 –sh–r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 216064 –sh–r- c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2009-10-27 2325528]
.
[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
2009-10-27 11:45 2325528 —-a-w- c:\program files\Softonic_English\tbSoft.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2009-10-27 2325528]
.
[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{930F1200-F5F1-4870-BAC6-E233EC8E7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2009-10-27 2325528]
.
[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-05 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-01 06:39 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-16 23:56]
.
2012-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-16 23:56]
.
2012-01-20 c:\windows\Tasks\Norton Security Scan for VJones.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-07-22 23:51]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{04F1B430-67A1-4B31-962C-B500816EFE55}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{09CC4FE3-90EB-45E2-9902-ADEE35007982}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{26438954-F43E-45EA-B377-13E87D63FBD8}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{3E4E7D37-EA7D-43AC-8038-284715408613}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://start.facemoods.com/?a=ddrnw
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1142338&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Softonic English Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1142338&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-21 15:59
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-01-21 16:01:21
ComboFix-quarantined-files.txt 2012-01-21 16:01
ComboFix2.txt 2012-01-16 17:39
.
Pre-Run: 54,526,287,872 bytes free
Post-Run: 54,890,151,936 bytes free
.
- - End Of File - - 4A439282DE528303489F204F3EDC9D5F
ComboFix 12-01-19.02 - VJones 21/01/2012 15:45:32.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2036.1141 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-21 to 2012-01-21 )))))))))))))))))))))))))))))))
.
.
2012-01-21 15:59 . 2012-01-21 15:59 ——– d—–w- c:\users\VJones\AppData\Local\temp
2012-01-21 15:59 . 2012-01-21 15:59 ——– d—–w- c:\users\UltimoLee\AppData\Local\temp
2012-01-21 15:59 . 2012-01-21 15:59 ——– d—–w- c:\users\Ultimo Lee\AppData\Local\temp
2012-01-20 12:43 . 2012-01-06 04:19 6557240 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A807C4C0-BC51-4245-8F60-590F9F95BF4A}\mpengine.dll
2012-01-18 23:26 . 2012-01-18 23:26 ——– d—–w- c:\users\VJones\AppData\Roaming\f-secure
2012-01-18 23:25 . 2012-01-18 23:25 ——– d—–w- c:\programdata\F-Secure
2012-01-18 16:34 . 2012-01-18 16:34 ——– d—–w- c:\program files\ESET
2012-01-17 22:13 . 2011-12-10 15:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-01-17 22:12 . 2012-01-17 22:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-01-11 20:07 . 2011-10-14 16:03 189952 —-a-w- c:\windows\system32\winmm.dll
2012-01-11 20:07 . 2011-10-14 16:00 23552 —-a-w- c:\windows\system32\mciseq.dll
2012-01-11 20:06 . 2011-11-18 20:23 1205064 —-a-w- c:\windows\system32\ntdll.dll
2012-01-11 20:06 . 2011-11-18 17:47 66560 —-a-w- c:\windows\system32\packager.dll
2012-01-11 20:06 . 2011-11-25 15:59 376320 —-a-w- c:\windows\system32\winsrv.dll
2012-01-11 20:06 . 2011-12-01 15:21 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-01-11 20:06 . 2011-10-25 15:58 1314816 —-a-w- c:\windows\system32\quartz.dll
2012-01-11 20:06 . 2011-10-25 15:58 497152 —-a-w- c:\windows\system32\qdvd.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:37 . 2011-12-14 23:16 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-11-15 14:29 . 2009-10-03 00:32 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-08 14:42 . 2011-12-14 23:16 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-03 06:22 . 2011-12-14 23:15 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-03 06:17 . 2011-12-14 23:14 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-03 06:17 . 2011-12-14 23:15 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 06:17 . 2011-12-14 23:14 71680 —-a-w- c:\windows\system32\iesetup.dll
2011-11-03 06:17 . 2011-12-14 23:14 109056 —-a-w- c:\windows\system32\iesysprep.dll
2011-11-03 05:22 . 2011-12-14 23:15 385024 —-a-w- c:\windows\system32\html.iec
2011-11-03 04:45 . 2011-12-14 23:14 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2011-11-03 04:43 . 2011-12-14 23:14 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-27 08:01 . 2011-12-14 23:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-27 08:01 . 2011-12-14 23:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 15:56 . 2011-12-14 23:16 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-07 17:55 . 2011-07-03 18:35 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06 163328 –sh–r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 31232 –sh–r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 216064 –sh–r- c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2009-10-27 2325528]
.
[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
2009-10-27 11:45 2325528 —-a-w- c:\program files\Softonic_English\tbSoft.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2009-10-27 2325528]
.
[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{930F1200-F5F1-4870-BAC6-E233EC8E7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2009-10-27 2325528]
.
[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-05 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-01 06:39 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-16 23:56]
.
2012-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-16 23:56]
.
2012-01-20 c:\windows\Tasks\Norton Security Scan for VJones.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-07-22 23:51]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{04F1B430-67A1-4B31-962C-B500816EFE55}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{09CC4FE3-90EB-45E2-9902-ADEE35007982}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{26438954-F43E-45EA-B377-13E87D63FBD8}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
2012-01-21 c:\windows\Tasks\User_Feed_Synchronization-{3E4E7D37-EA7D-43AC-8038-284715408613}.job
- c:\windows\system32\msfeedssync.exe [2011-12-14 04:44]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://start.facemoods.com/?a=ddrnw
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1142338&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Softonic English Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1142338&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-21 15:59
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-01-21 16:01:21
ComboFix-quarantined-files.txt 2012-01-21 16:01
ComboFix2.txt 2012-01-16 17:39
.
Pre-Run: 54,526,287,872 bytes free
Post-Run: 54,890,151,936 bytes free
.
- - End Of File - - 4A439282DE528303489F204F3EDC9D5F
mowman
Combofix will have run quicker because Comodo was not interfering with it.
Open OTL,tick scan all users and click run scan,post the new log.
Is that fake police warning gone from the other account now?
I am going offline now,will be back in about 3 hours so will have a look back then.
Deleted Member
Can i reinstal COMDO after this so i can go online?
Yes fake warning gone
Deleted Member
OTL logfile created on: 21/01/2012 17:42:41 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ultimo Lee\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
1.99 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 61.35% Memory free
4.22 Gb Paging File | 3.46 Gb Available in Paging File | 81.92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.01 Gb Total Space | 51.07 Gb Free Space | 34.27% Space Free | Partition Type: NTFS
Computer Name: HOME-PC | User Name: VJones | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Ultimo Lee\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\System32\lxdacoms.exe ( )
========== Modules (No Company Name) ==========
MOD - C:\Program Files\WinRAR\RarExt.dll ()
========== Win32 Services (SafeList) ==========
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (lxda_device) – C:\Windows\System32\lxdacoms.exe ( )
========== Driver Services (SafeList) ==========
DRV - (ISODrive) – C:\Program Files\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\URLSearchHook: {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=ddrnw
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\..\URLSearchHook: {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 52 7A 9B DF 35 D6 CC 01 [binary data]
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:59636
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: [removed]:0.1.2008d
FF - prefs.js..extensions.enabledItems: [removed]:2.0.0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2897: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2955: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1675: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/07 17:55:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/03 18:35:49 | 000,000,000 | —D | M]
[2010/07/22 15:40:12 | 000,000,000 | —D | M] (No name found) – C:\Users\VJones\AppData\Roaming\Mozilla\Extensions
[2009/03/30 23:54:02 | 000,000,000 | —D | M] (No name found) – C:\Users\VJones\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/01/21 13:49:36 | 000,000,000 | —D | M] (No name found) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions
[2010/11/07 22:51:55 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/01/16 17:42:51 | 000,000,000 | —D | M] (WOT) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/01/21 13:49:36 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/07/03 18:35:53 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/05/13 00:48:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2009/01/03 19:39:01 | 000,000,000 | —D | M] (Seekeen) – C:\Program Files\Mozilla Firefox\extensions\{DB390D2E-0FB4-413F-B039-AE342D1D40BA}
[2009/03/30 23:46:30 | 000,000,000 | —D | M] (Timezone Definitions for Mozilla Calendar) – C:\PROGRAM FILES\CELTX\EXTENSIONS\[removed]
[2009/03/30 23:46:38 | 000,000,000 | —D | M] (DOM Inspector) – C:\PROGRAM FILES\CELTX\EXTENSIONS\[removed]
[2011/10/07 17:55:02 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/13 00:47:36 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/07 17:55:00 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/10/07 17:55:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/10/07 17:55:00 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/10/07 17:55:00 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/07/04 00:29:28 | 000,002,048 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2011/10/07 17:55:00 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
O1 HOSTS File: ([2012/01/16 17:32:06 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Softonic English Toolbar) - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (XBTBPos00 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_int.dll File not found
O3 - HKLM\..\Toolbar: (Softonic English Toolbar) - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\..\Toolbar\WebBrowser: (Softonic English Toolbar) - {930F1200-F5F1-4870-BAC6-E233EC8E7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\..\Toolbar\WebBrowser: (Softonic English Toolbar) - {930F1200-F5F1-4870-BAC6-E233EC8E7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{409452A3-5B92-4468-B2C6-D644AE9F4822}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\VJones\Desktop\Documents\tigers.JPG
O24 - Desktop BackupWallPaper: C:\Users\VJones\Desktop\Documents\tigers.JPG
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/01/21 16:01:23 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/01/21 16:01:23 | 000,000,000 | —D | C] – C:\Users\VJones\AppData\Local\temp
[2012/01/21 16:00:29 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/01/21 15:43:04 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/01/21 15:43:04 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/01/21 15:43:04 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/01/21 15:42:57 | 000,000,000 | —D | C] – C:\Qoobox
[2012/01/18 23:26:07 | 000,000,000 | —D | C] – C:\Users\VJones\AppData\Roaming\f-secure
[2012/01/18 23:25:27 | 000,000,000 | —D | C] – C:\ProgramData\F-Secure
[2012/01/18 16:34:59 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/01/17 22:13:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/17 22:13:10 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/01/17 22:12:29 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/01/11 20:07:02 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciseq.dll
[2012/01/11 20:06:55 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\packager.dll
[2012/01/11 20:06:53 | 000,376,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/01/11 20:06:40 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/01/11 20:06:40 | 000,497,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2009/03/26 14:44:29 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxdainpa.dll
[2009/03/26 14:44:29 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\LXDAhcp.dll
[2009/03/26 14:44:28 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxdaserv.dll
[2009/03/26 14:44:28 | 000,991,232 | —- | C] ( ) – C:\Windows\System32\lxdausb1.dll
[2009/03/26 14:44:28 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxdapmui.dll
[2009/03/26 14:44:28 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxdalmpm.dll
[2009/03/26 14:44:28 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxdaiesc.dll
[2009/03/26 14:44:28 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxdaprox.dll
[2009/03/26 14:44:28 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxdapplc.dll
[2009/03/26 14:44:27 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxdahbn3.dll
[2009/03/26 14:44:27 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxdacomc.dll
[2009/03/26 14:44:27 | 000,537,520 | —- | C] ( ) – C:\Windows\System32\lxdacoms.exe
[2009/03/26 14:44:27 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxdacomm.dll
[2009/03/26 14:44:27 | 000,385,968 | —- | C] ( ) – C:\Windows\System32\lxdaih.exe
[2009/03/26 14:44:27 | 000,381,872 | —- | C] ( ) – C:\Windows\System32\lxdacfg.exe
[2009/01/06 17:40:41 | 000,047,360 | —- | C] (VSO Software) – C:\Users\VJones\AppData\Roaming\pcouffin.sys
========== Files - Modified Within 30 Days ==========
[2012/01/21 17:42:02 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/21 17:42:00 | 000,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{04F1B430-67A1-4B31-962C-B500816EFE55}.job
[2012/01/21 17:42:00 | 000,000,414 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{09CC4FE3-90EB-45E2-9902-ADEE35007982}.job
[2012/01/21 17:41:00 | 000,000,400 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{3E4E7D37-EA7D-43AC-8038-284715408613}.job
[2012/01/21 16:10:06 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/21 16:03:29 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/21 16:03:29 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/21 16:03:25 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/21 16:03:23 | 2136,133,632 | -HS- | M] () – C:\hiberfil.sys
[2012/01/21 13:33:21 | 000,000,424 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{26438954-F43E-45EA-B377-13E87D63FBD8}.job
[2012/01/21 13:17:24 | 001,474,832 | —- | M] () – C:\Windows\System32\drivers\sfi.dat
[2012/01/21 10:20:49 | 000,604,950 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/21 10:20:49 | 000,108,282 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/20 19:55:35 | 000,000,476 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for VJones.job
[2012/01/16 17:32:06 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
========== Files Created - No Company Name ==========
[2012/01/21 15:43:04 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/01/21 15:43:04 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/01/21 15:43:04 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/01/21 15:43:04 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/01/21 15:43:04 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/03/31 20:54:27 | 000,000,036 | —- | C] () – C:\Users\VJones\AppData\Local\housecall.guid.cache
[2011/02/02 17:42:21 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2011/02/02 17:42:16 | 000,795,648 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/02/02 17:42:15 | 000,130,048 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/02/02 17:42:11 | 000,084,480 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/12/17 16:55:23 | 002,392,064 | —- | C] () – C:\Windows\System32\videotrans.dll
[2009/12/17 16:55:23 | 000,215,040 | —- | C] () – C:\Windows\System32\videoformat.dll
[2009/12/17 16:55:22 | 000,061,440 | —- | C] () – C:\Windows\System32\imgscaler.dll
[2009/12/17 16:55:22 | 000,022,016 | —- | C] () – C:\Windows\System32\img_utils.dll
[2009/09/15 18:37:21 | 001,474,832 | —- | C] () – C:\Windows\System32\drivers\sfi.dat
[2009/09/13 23:34:07 | 000,000,088 | —- | C] () – C:\Users\VJones\AppData\Roaming\wklnhst.dat
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/21 22:02:22 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/07/21 22:02:21 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/03/26 14:44:29 | 000,274,432 | —- | C] () – C:\Windows\System32\LXDAinst.dll
[2009/03/26 14:44:28 | 000,413,696 | —- | C] () – C:\Windows\System32\lxdautil.dll
[2009/03/18 12:24:34 | 000,000,308 | —- | C] () – C:\Windows\LEXSTAT.INI
[2009/01/22 21:29:28 | 000,027,648 | —- | C] () – C:\Windows\System32\AVSredirect.dll
[2009/01/21 20:31:33 | 000,014,848 | —- | C] () – C:\Users\VJones\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/06 17:40:41 | 000,007,887 | —- | C] () – C:\Users\VJones\AppData\Roaming\pcouffin.cat
[2009/01/06 17:40:41 | 000,001,144 | —- | C] () – C:\Users\VJones\AppData\Roaming\pcouffin.inf
[2009/01/02 19:31:21 | 000,000,552 | —- | C] () – C:\Users\VJones\AppData\Local\d3d8caps.dat
[2009/01/02 19:28:17 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/01/02 18:03:58 | 000,000,680 | —- | C] () – C:\Users\VJones\AppData\Local\d3d9caps.dat
[2008/02/11 19:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2008/02/11 19:34:48 | 002,215,364 | —- | C] () – C:\Windows\System32\igklg400.bin
[2008/02/11 19:34:48 | 001,971,732 | —- | C] () – C:\Windows\System32\igklg450.bin
[2008/02/11 19:34:48 | 000,029,932 | —- | C] () – C:\Windows\System32\igmedcompkrn.bin
[2007/01/22 09:49:34 | 000,344,064 | —- | C] () – C:\Windows\System32\lxdacoin.dll
[2006/11/02 12:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 003,631,240 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,604,950 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,108,282 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 10:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 08:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/03/27 12:19:20 | 000,040,960 | —- | C] () – C:\Windows\System32\lxdavs.dll
[2002/10/15 22:54:04 | 000,153,088 | —- | C] () – C:\Windows\System32\unrar.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D1B5B4F1
< End of report >
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ultimo Lee\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
1.99 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 61.35% Memory free
4.22 Gb Paging File | 3.46 Gb Available in Paging File | 81.92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.01 Gb Total Space | 51.07 Gb Free Space | 34.27% Space Free | Partition Type: NTFS
Computer Name: HOME-PC | User Name: VJones | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Ultimo Lee\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\System32\lxdacoms.exe ( )
========== Modules (No Company Name) ==========
MOD - C:\Program Files\WinRAR\RarExt.dll ()
========== Win32 Services (SafeList) ==========
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (lxda_device) – C:\Windows\System32\lxdacoms.exe ( )
========== Driver Services (SafeList) ==========
DRV - (ISODrive) – C:\Program Files\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\URLSearchHook: {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=ddrnw
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\..\URLSearchHook: {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 52 7A 9B DF 35 D6 CC 01 [binary data]
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:59636
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: [removed]:0.1.2008d
FF - prefs.js..extensions.enabledItems: [removed]:2.0.0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2897: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2955: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1675: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/07 17:55:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/03 18:35:49 | 000,000,000 | —D | M]
[2010/07/22 15:40:12 | 000,000,000 | —D | M] (No name found) – C:\Users\VJones\AppData\Roaming\Mozilla\Extensions
[2009/03/30 23:54:02 | 000,000,000 | —D | M] (No name found) – C:\Users\VJones\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/01/21 13:49:36 | 000,000,000 | —D | M] (No name found) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions
[2010/11/07 22:51:55 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/01/16 17:42:51 | 000,000,000 | —D | M] (WOT) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/01/21 13:49:36 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\VJones\AppData\Roaming\Mozilla\Firefox\Profiles\b3ps2o0c.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/07/03 18:35:53 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/05/13 00:48:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2009/01/03 19:39:01 | 000,000,000 | —D | M] (Seekeen) – C:\Program Files\Mozilla Firefox\extensions\{DB390D2E-0FB4-413F-B039-AE342D1D40BA}
[2009/03/30 23:46:30 | 000,000,000 | —D | M] (Timezone Definitions for Mozilla Calendar) – C:\PROGRAM FILES\CELTX\EXTENSIONS\[removed]
[2009/03/30 23:46:38 | 000,000,000 | —D | M] (DOM Inspector) – C:\PROGRAM FILES\CELTX\EXTENSIONS\[removed]
[2011/10/07 17:55:02 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/13 00:47:36 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/07 17:55:00 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/10/07 17:55:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/10/07 17:55:00 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/10/07 17:55:00 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/07/04 00:29:28 | 000,002,048 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2011/10/07 17:55:00 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
O1 HOSTS File: ([2012/01/16 17:32:06 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Softonic English Toolbar) - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (XBTBPos00 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_int.dll File not found
O3 - HKLM\..\Toolbar: (Softonic English Toolbar) - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\..\Toolbar\WebBrowser: (Softonic English Toolbar) - {930F1200-F5F1-4870-BAC6-E233EC8E7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\..\Toolbar\WebBrowser: (Softonic English Toolbar) - {930F1200-F5F1-4870-BAC6-E233EC8E7023} - C:\Program Files\Softonic_English\tbSoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{409452A3-5B92-4468-B2C6-D644AE9F4822}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\VJones\Desktop\Documents\tigers.JPG
O24 - Desktop BackupWallPaper: C:\Users\VJones\Desktop\Documents\tigers.JPG
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/01/21 16:01:23 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/01/21 16:01:23 | 000,000,000 | —D | C] – C:\Users\VJones\AppData\Local\temp
[2012/01/21 16:00:29 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/01/21 15:43:04 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/01/21 15:43:04 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/01/21 15:43:04 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/01/21 15:42:57 | 000,000,000 | —D | C] – C:\Qoobox
[2012/01/18 23:26:07 | 000,000,000 | —D | C] – C:\Users\VJones\AppData\Roaming\f-secure
[2012/01/18 23:25:27 | 000,000,000 | —D | C] – C:\ProgramData\F-Secure
[2012/01/18 16:34:59 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/01/17 22:13:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/17 22:13:10 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/01/17 22:12:29 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/01/11 20:07:02 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciseq.dll
[2012/01/11 20:06:55 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\packager.dll
[2012/01/11 20:06:53 | 000,376,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/01/11 20:06:40 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/01/11 20:06:40 | 000,497,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2009/03/26 14:44:29 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxdainpa.dll
[2009/03/26 14:44:29 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\LXDAhcp.dll
[2009/03/26 14:44:28 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxdaserv.dll
[2009/03/26 14:44:28 | 000,991,232 | —- | C] ( ) – C:\Windows\System32\lxdausb1.dll
[2009/03/26 14:44:28 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxdapmui.dll
[2009/03/26 14:44:28 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxdalmpm.dll
[2009/03/26 14:44:28 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxdaiesc.dll
[2009/03/26 14:44:28 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxdaprox.dll
[2009/03/26 14:44:28 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxdapplc.dll
[2009/03/26 14:44:27 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxdahbn3.dll
[2009/03/26 14:44:27 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxdacomc.dll
[2009/03/26 14:44:27 | 000,537,520 | —- | C] ( ) – C:\Windows\System32\lxdacoms.exe
[2009/03/26 14:44:27 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxdacomm.dll
[2009/03/26 14:44:27 | 000,385,968 | —- | C] ( ) – C:\Windows\System32\lxdaih.exe
[2009/03/26 14:44:27 | 000,381,872 | —- | C] ( ) – C:\Windows\System32\lxdacfg.exe
[2009/01/06 17:40:41 | 000,047,360 | —- | C] (VSO Software) – C:\Users\VJones\AppData\Roaming\pcouffin.sys
========== Files - Modified Within 30 Days ==========
[2012/01/21 17:42:02 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/21 17:42:00 | 000,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{04F1B430-67A1-4B31-962C-B500816EFE55}.job
[2012/01/21 17:42:00 | 000,000,414 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{09CC4FE3-90EB-45E2-9902-ADEE35007982}.job
[2012/01/21 17:41:00 | 000,000,400 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{3E4E7D37-EA7D-43AC-8038-284715408613}.job
[2012/01/21 16:10:06 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/21 16:03:29 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/21 16:03:29 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/21 16:03:25 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/21 16:03:23 | 2136,133,632 | -HS- | M] () – C:\hiberfil.sys
[2012/01/21 13:33:21 | 000,000,424 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{26438954-F43E-45EA-B377-13E87D63FBD8}.job
[2012/01/21 13:17:24 | 001,474,832 | —- | M] () – C:\Windows\System32\drivers\sfi.dat
[2012/01/21 10:20:49 | 000,604,950 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/21 10:20:49 | 000,108,282 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/20 19:55:35 | 000,000,476 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for VJones.job
[2012/01/16 17:32:06 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
========== Files Created - No Company Name ==========
[2012/01/21 15:43:04 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/01/21 15:43:04 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/01/21 15:43:04 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/01/21 15:43:04 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/01/21 15:43:04 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/03/31 20:54:27 | 000,000,036 | —- | C] () – C:\Users\VJones\AppData\Local\housecall.guid.cache
[2011/02/02 17:42:21 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2011/02/02 17:42:16 | 000,795,648 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/02/02 17:42:15 | 000,130,048 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/02/02 17:42:11 | 000,084,480 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/12/17 16:55:23 | 002,392,064 | —- | C] () – C:\Windows\System32\videotrans.dll
[2009/12/17 16:55:23 | 000,215,040 | —- | C] () – C:\Windows\System32\videoformat.dll
[2009/12/17 16:55:22 | 000,061,440 | —- | C] () – C:\Windows\System32\imgscaler.dll
[2009/12/17 16:55:22 | 000,022,016 | —- | C] () – C:\Windows\System32\img_utils.dll
[2009/09/15 18:37:21 | 001,474,832 | —- | C] () – C:\Windows\System32\drivers\sfi.dat
[2009/09/13 23:34:07 | 000,000,088 | —- | C] () – C:\Users\VJones\AppData\Roaming\wklnhst.dat
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/21 22:02:22 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/07/21 22:02:21 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/03/26 14:44:29 | 000,274,432 | —- | C] () – C:\Windows\System32\LXDAinst.dll
[2009/03/26 14:44:28 | 000,413,696 | —- | C] () – C:\Windows\System32\lxdautil.dll
[2009/03/18 12:24:34 | 000,000,308 | —- | C] () – C:\Windows\LEXSTAT.INI
[2009/01/22 21:29:28 | 000,027,648 | —- | C] () – C:\Windows\System32\AVSredirect.dll
[2009/01/21 20:31:33 | 000,014,848 | —- | C] () – C:\Users\VJones\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/06 17:40:41 | 000,007,887 | —- | C] () – C:\Users\VJones\AppData\Roaming\pcouffin.cat
[2009/01/06 17:40:41 | 000,001,144 | —- | C] () – C:\Users\VJones\AppData\Roaming\pcouffin.inf
[2009/01/02 19:31:21 | 000,000,552 | —- | C] () – C:\Users\VJones\AppData\Local\d3d8caps.dat
[2009/01/02 19:28:17 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/01/02 18:03:58 | 000,000,680 | —- | C] () – C:\Users\VJones\AppData\Local\d3d9caps.dat
[2008/02/11 19:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2008/02/11 19:34:48 | 002,215,364 | —- | C] () – C:\Windows\System32\igklg400.bin
[2008/02/11 19:34:48 | 001,971,732 | —- | C] () – C:\Windows\System32\igklg450.bin
[2008/02/11 19:34:48 | 000,029,932 | —- | C] () – C:\Windows\System32\igmedcompkrn.bin
[2007/01/22 09:49:34 | 000,344,064 | —- | C] () – C:\Windows\System32\lxdacoin.dll
[2006/11/02 12:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 003,631,240 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,604,950 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,108,282 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 10:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 08:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/03/27 12:19:20 | 000,040,960 | —- | C] () – C:\Windows\System32\lxdavs.dll
[2002/10/15 22:54:04 | 000,153,088 | —- | C] () – C:\Windows\System32\unrar.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D1B5B4F1
< End of report >
mowman
Run the OTL fix below,after doing this you believe there are no more problems with the computer then yes you can reinstall comodo.
Run OTL.exe
Run OTL.exe
- Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:Services :Otl IE - HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:59636 O2 - BHO: (XBTBPos00 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_int.dll File not found O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D1B5B4F1 :Commands [emptytemp] [Reboot] - Then click the Run Fix button at the top
- Let the program run unhindered, reboot when it is done
- Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Deleted Member
After doing the fix and reboot, i double clicked OTL to do a scan/log and a notepad popped up with this
Am i all clear to reinstall COMODO? Also do you have a link to COMODO, i want to make sure i download the right thing.
Also should i use ATFcleaner to clean out cookies? if i do delete cookies could this cause problems with signing in to various sites, i've heard of people having problems.
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\S-1-5-21-3208327182-2709425978-4292038597-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\ProgramData\TEMP:D1B5B4F1 deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Caz
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 622845 bytes
->Java cache emptied: 398013 bytes
->FireFox cache emptied: 487330722 bytes
->Google Chrome cache emptied: 440145204 bytes
->Flash cache emptied: 163559 bytes
User: CHughes
->Temp folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Ultimo Lee
->Temp folder emptied: 74170 bytes
->Temporary Internet Files folder emptied: 4869476 bytes
->Java cache emptied: 11256464 bytes
->FireFox cache emptied: 52232747 bytes
->Google Chrome cache emptied: 376432162 bytes
->Flash cache emptied: 85516 bytes
User: UltimoLee
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: VJones
->Temp folder emptied: 31911 bytes
->Temporary Internet Files folder emptied: 4658447 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 71437255 bytes
->Flash cache emptied: 1208 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 43 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1,383.00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 01212012_204731
Files\Folders moved on Reboot…
Registry entries deleted on Reboot…
mowman
I use it regularly and have never had any problems.Also should i use ATFcleaner to clean out cookies? if i do delete cookies could this cause problems with signing in to various sites, i've heard of people having problems.
As I saidAm i all clear to reinstall COMODO? Also do you have a link to COMODO, i want to make sure i download the right thing.
if you believe there are no more problems with the computer then yes you can reinstall comodo.
I don't know which version of comodo you had so you don't have a specific link,should not be very hard to find though.
If there are no more problems let me know and we will clen up the tools we have used.
Deleted Member
The pc was very slow on start up, i restarted and it seems to be faster than usual.
I reinstalled COMODO but Windows is still saying i don't have malware protection
[external image: Posted Image]
I reinstalled COMODO but Windows is still saying i don't have malware protection
[external image: Posted Image]
mowman
Comodo defense+ is not an antivirus,that is why you are getting that message,you need to uninstall that and install antivirus software.
You appear clean of infections,please do the following.
Delete Tdsskiller,ESET,HJT and any logs you have
ComboFix - Cleanup
Time for some housekeeping
Clean up with OTL:
Here are some recommendations to help you stay clean.
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/
Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.
please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:
Preventing Infections in the Future
Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
Update Non-Microsoft Programs
You appear clean of infections,please do the following.
Delete Tdsskiller,ESET,HJT and any logs you have
ComboFix - Cleanup
Time for some housekeeping
- Click Start…select Run from the menu.
- Copy and paste the following into the text entry box:
Combofix /Uninstall - Click the OK button. (See image below as reference.)
Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
Here are some recommendations to help you stay clean.
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/
Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.
please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:
Preventing Infections in the Future
Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
- So How did I get infected?
- Miekies' prevention suggestions
- Hardening Windows Security - Part 1 & Part 2.
- Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.
Update Non-Microsoft Programs
Deleted Member
I thought i would need the firewall plus an Antivirus program? like this oneComodo defense+ is not an antivirus,that is why you are getting that message,you need to uninstall that and install antivirus software.
COMODO
or do i only need that?
mowman
You need an antivirus and a firewall.If you add the av you supplied the link to you will have everything you need,I think.
I have no experience of Comodo antivirus as I have never used It,it doesn't have the best reputation.
Deleted Member
Looking around the best option seems to be Comodo firewall plus avast antivirus.You need an antivirus and a firewall.If you add the av you supplied the link to you will have everything you need,I think.
I have no experience of Comodo antivirus as I have never used It,it doesn't have the best reputation.
ComboFix and OTL are uninstalled. Should i delete Hijackthis?
What should i do with the file on my desktop with the back ups? if i delete it will windows still be backing up?
Also is it advisable to regularly run MBAM scans?
mowman
Good choice.Looking around the best option seems to be Comodo firewall plus avast antivirus.
You can delete,hijackthis and the backups which are just to do with the malware we removed.
Running an updated MBAM scan weekly is advisable.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI