Spyware / Malware / Virus Removal

Duplicate browser opens when navigating in IE. Cannot access alt.domai

6 min read

Looking for the outcome? Ask AI

Swoop Topic Starter

Post #1January 20, 2012, 6:05 PM UTC

Below is the OTL logfile. Please reply if more info is needed. Thanks

OTL logfile created on: 1/20/2012 9:53:17 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Shannen\Videos
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.48 Gb Total Physical Memory | 2.02 Gb Available Physical Memory | 58.08% Memory free
6.95 Gb Paging File | 5.26 Gb Available in Paging File | 75.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.23 Gb Total Space | 533.32 Gb Free Space | 91.76% Space Free | Partition Type: NTFS

Computer Name: SHANNEN-PC | User Name: Shannen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Shannen\Videos\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Uniblue\RegistryBooster\registrybooster.exe (Uniblue Systems Limited)
PRC - C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe (Symantec Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Uniblue\RegistryBooster\locale\en\en.dll ()
MOD - C:\Program Files (x86)\Uniblue\RegistryBooster\InstallerExtensions.dll ()
MOD - C:\Program Files (x86)\Uniblue\RegistryBooster\cwebpage.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (TOSHIBA eco Utility Service) – C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation)
SRV:64bit: - (TPCHSrv) – C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (EPSON_EB_RPCV4_04) – C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE (SEIKO EPSON CORPORATION)
SRV:64bit: - (EPSON_PM_RPCV4_04) – C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (SEIKO EPSON CORPORATION)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (N360) – C:\Program Files (x86)\Norton 360\Engine\4.4.0.12\ccSvcHst.exe ()
SRV - (TMachInfo) – C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (PCCUJobMgr) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe (Symantec Corporation)
SRV - (Norton PC Checkup Application Launcher) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (NWVZHelper) – C:\Program Files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe (Novatel Wireless Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SYMTDIv) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\symtdiv.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\symefa64.sys (Symantec Corporation)
DRV:64bit: - (ccHP) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\cchpx64.sys (Symantec Corporation)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (tosrfbd) – C:\Windows\SysNative\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (PGEffect) – C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Tosrfusb) – C:\Windows\SysNative\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RSUSBVSTOR) – C:\Windows\SysNative\drivers\rtsuvstor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (Tosrfcom) – C:\Windows\SysNative\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (tosrfbnp) – C:\Windows\SysNative\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV:64bit: - (BtFilter) – C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (Tosrfhid) – C:\Windows\SysNative\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV:64bit: - (NWADI) – C:\Windows\SysNative\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV:64bit: - (NWUSBPort2_000) Novatel Wireless USB Status2 Port Driver (vGEN) – C:\Windows\SysNative\drivers\nwusbser2_000.sys (Novatel Wireless Inc.)
DRV:64bit: - (NWUSBPort_000) Novatel Wireless USB Status Port Driver (vGEN) – C:\Windows\SysNative\drivers\nwusbser_000.sys (Novatel Wireless Inc.)
DRV:64bit: - (NWUSBModem_000) Novatel Wireless USB Modem Driver (vGEN) – C:\Windows\SysNative\drivers\nwusbmdm_000.sys (Novatel Wireless Inc.)
DRV:64bit: - (NWUSBCDFIL64) – C:\Windows\SysNative\drivers\NwUsbCdFil64.sys (Novatel Wireless Inc.)
DRV:64bit: - (tosrfec) – C:\Windows\SysNative\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\ironx64.sys (Symantec Corporation)
DRV:64bit: - (TosRfSnd) – C:\Windows\SysNative\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\N360x64\0404000.00C\symds64.sys (Symantec Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (tosrfnds) – C:\Windows\SysNative\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TVALZFL) – C:\Windows\SysNative\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV:64bit: - (tosporte) – C:\Windows\SysNative\drivers\tosporte.sys (TOSHIBA Corporation)
DRV:64bit: - (QIOMem) – C:\Windows\SysNative\drivers\QIOMem.sys (TOSHIBA)
DRV:64bit: - (SrvHsfV92) – C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfWinac) – C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfHDA) – C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WN111v2) – C:\Windows\SysNative\drivers\WN111v2x.sys (Atheros Communications, Inc.)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111109.030\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20111027.001\BHDrvx64.sys (Symantec Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Shannen\Videos
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie9
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@airarena/KMP: C:\Program Files (x86)\Altnet Music Plugin\ffXPI\Plugins\npAMPff.dll (Airarena Pty Ltd.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2011/11/02 22:01:51 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn_2010_9_0_6 [2011/11/29 15:01:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{494d1265-1d59-43c6-8fa1-eb1d9224278a}: C:\Program Files (x86)\Altnet Music Plugin\ffXPI [2011/12/20 14:32:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/20 00:21:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/01/20 00:21:41 | 000,000,000 | —D | M] (No name found) – C:\Users\Shannen\AppData\Roaming\Mozilla\Extensions
[2012/01/20 00:21:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/12/21 01:24:52 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/12/20 22:30:41 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/20 22:30:41 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\4.4.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\4.4.0.12\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaAppPlace] C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [RegistryBooster] C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: cnet.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: firefox.com ([www] * in Local intranet)
O15 - HKCU\..Trusted Domains: firefox.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: firstload.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: google.com ([www] https in Trusted sites)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://oas.support.microsoft.com/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20844425-EBE4-4898-B531-875BDEF96A7E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E4EBC7E-2E95-4007-B1D5-D5A5651DF213}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/20 09:21:48 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Roaming\Uniblue
[2012/01/20 09:21:45 | 000,000,000 | -H-D | C] – C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2012/01/20 09:21:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2012/01/20 09:21:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2012/01/20 09:21:22 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Local\PackageAware
[2012/01/20 08:30:45 | 000,000,000 | —D | C] – C:\windows\pss
[2012/01/20 00:21:41 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Roaming\Mozilla
[2012/01/20 00:21:41 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Local\Mozilla
[2012/01/20 00:21:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/01/17 10:49:28 | 001,447,936 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\lsasrv.dll
[2012/01/17 10:49:28 | 000,395,776 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\webio.dll
[2012/01/17 10:49:28 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\webio.dll
[2012/01/17 10:49:28 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\sspicli.dll
[2012/01/17 10:49:27 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\sspisrv.dll
[2012/01/17 10:49:27 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\secur32.dll
[2012/01/12 20:21:25 | 000,000,000 | —D | C] – C:\Users\Shannen\Documents\Bluetooth
[2012/01/11 21:59:02 | 000,000,000 | —D | C] – C:\Users\Shannen\Tracing
[2012/01/10 21:30:41 | 001,572,864 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\quartz.dll
[2012/01/10 21:30:40 | 001,328,128 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\quartz.dll
[2012/01/10 21:30:40 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\qdvd.dll
[2012/01/10 21:30:40 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\qdvd.dll
[2012/01/10 21:30:38 | 001,731,920 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ntdll.dll
[2012/01/10 21:30:37 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\packager.dll
[2012/01/10 21:30:37 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\packager.dll
[2012/01/08 12:01:41 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Local\{C57C8568-81C4-4F29-9B4E-95AD5D8D2BDF}
[2012/01/07 04:06:16 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Local\BaDoinkULTRA
[2012/01/07 04:06:15 | 000,000,000 | —D | C] – C:\Users\Shannen\My Library
[2012/01/07 03:52:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
[2012/01/07 03:52:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\K-Lite Codec Pack
[2012/01/06 09:46:42 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Roaming\WinRAR
[2012/01/06 09:46:42 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/01/06 09:46:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/01/06 09:45:54 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2011/12/28 22:48:38 | 000,000,000 | —D | C] – C:\Users\Shannen\Documents\New folder
[2011/12/27 12:45:29 | 000,000,000 | —D | C] – C:\Users\Shannen\Documents\Firstload
[2011/12/23 17:47:34 | 000,000,000 | —D | C] – C:\Users\Shannen\Documents\Misc
[2011/12/23 17:44:19 | 000,000,000 | —D | C] – C:\Users\Shannen\Documents\Comp & Rhetoric 1301
[2011/12/23 17:39:49 | 000,000,000 | —D | C] – C:\Users\Shannen\Documents\Med Term
[3 C:\Users\Shannen\Documents\*.tmp files -> C:\Users\Shannen\Documents\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/20 09:21:53 | 000,000,348 | —- | M] () – C:\windows\tasks\RegistryBooster.job
[2012/01/20 09:21:48 | 000,001,804 | —- | M] () – C:\Users\Shannen\Desktop\Uniblue RegistryBooster.lnk
[2012/01/20 09:21:48 | 000,001,794 | —- | M] () – C:\Users\Shannen\Application Data\Microsoft\Internet Explorer\Quick Launch\Uniblue RegistryBooster.lnk
[2012/01/20 08:50:25 | 000,024,608 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/20 08:50:25 | 000,024,608 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/20 08:47:25 | 000,729,688 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2012/01/20 08:47:25 | 000,626,278 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2012/01/20 08:47:25 | 000,107,522 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2012/01/20 08:42:53 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2012/01/20 08:42:48 | 2798,804,992 | -HS- | M] () – C:\hiberfil.sys
[2012/01/20 00:21:32 | 000,001,153 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/01/19 10:35:57 | 000,000,000 | —- | M] () – C:\Users\Shannen\Documents\Online instructor info_docx.v16cmpg.partial
[2012/01/18 23:01:43 | 000,000,000 | —- | M] () – C:\Users\Shannen\Documents\King7eCh01_ppt.zkjma7g.partial
[2012/01/12 20:15:15 | 000,000,000 | -H– | M] () – C:\Users\Shannen\Documents\Default.rdp
[2012/01/08 02:02:54 | 000,416,776 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2012/01/06 09:46:42 | 000,000,990 | —- | M] () – C:\Users\Public\Desktop\WinRAR.lnk
[2012/01/05 00:16:27 | 000,003,584 | —- | M] () – C:\Users\Shannen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/04 17:15:16 | 052,128,560 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\MRT.exe
[2012/01/03 22:42:32 | 000,001,340 | —- | M] () – C:\Users\Shannen\Documents\Office_Pro_2010_Academic_x64 - Shortcut.lnk
[2012/01/03 21:57:30 | 000,000,632 | RHS- | M] () – C:\Users\Shannen\ntuser.pol
[3 C:\Users\Shannen\Documents\*.tmp files -> C:\Users\Shannen\Documents\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/20 09:21:50 | 000,000,348 | —- | C] () – C:\windows\tasks\RegistryBooster.job
[2012/01/20 09:21:48 | 000,001,804 | —- | C] () – C:\Users\Shannen\Desktop\Uniblue RegistryBooster.lnk
[2012/01/20 09:21:48 | 000,001,794 | —- | C] () – C:\Users\Shannen\Application Data\Microsoft\Internet Explorer\Quick Launch\Uniblue RegistryBooster.lnk
[2012/01/20 00:21:32 | 000,001,165 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/01/20 00:21:32 | 000,001,153 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/01/19 10:35:57 | 000,000,000 | —- | C] () – C:\Users\Shannen\Documents\Online instructor info_docx.v16cmpg.partial
[2012/01/18 23:01:43 | 000,000,000 | —- | C] () – C:\Users\Shannen\Documents\King7eCh01_ppt.zkjma7g.partial
[2012/01/12 20:15:15 | 000,000,000 | -H– | C] () – C:\Users\Shannen\Documents\Default.rdp
[2012/01/07 03:52:55 | 000,178,176 | —- | C] () – C:\windows\SysWow64\unrar.dll
[2012/01/06 09:46:42 | 000,000,990 | —- | C] () – C:\Users\Public\Desktop\WinRAR.lnk
[2012/01/05 00:16:27 | 000,003,584 | —- | C] () – C:\Users\Shannen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/03 21:56:32 | 000,000,632 | RHS- | C] () – C:\Users\Shannen\ntuser.pol
[2011/11/30 06:48:31 | 000,743,534 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/11/01 20:02:34 | 000,000,079 | —- | C] () – C:\windows\ENX130.ini
[2011/06/21 13:58:14 | 000,000,000 | —- | C] () – C:\windows\ativpsrm.bin
[2011/06/21 13:55:59 | 000,003,155 | —- | C] () – C:\windows\SysWow64\atipblag.dat
[2011/02/03 20:56:58 | 000,066,856 | —- | C] () – C:\windows\SysWow64\SynTPEnhPS.dll
[2009/07/13 23:38:36 | 000,067,584 | –S- | C] () – C:\windows\bootstat.dat
[2009/07/13 20:35:51 | 000,000,741 | —- | C] () – C:\windows\SysWow64\NOISE.DAT
[2009/07/13 20:34:42 | 000,215,943 | —- | C] () – C:\windows\SysWow64\dssec.dat
[2009/07/13 18:10:29 | 000,043,131 | —- | C] () – C:\windows\mib.bin
[2009/07/13 17:42:10 | 000,064,000 | —- | C] () – C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:59 | 000,364,544 | —- | C] () – C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 15:26:10 | 000,673,088 | —- | C] () – C:\windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/12/21 06:17:45 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Book Place
[2011/11/29 15:02:27 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Elluminate
[2011/12/18 10:07:40 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Epson
[2011/11/02 22:01:47 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Leader Technologies
[2011/11/24 13:05:22 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\PC Cleaners
[2011/09/25 10:05:45 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Tific
[2011/11/25 09:44:16 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Toshiba
[2012/01/20 09:21:48 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Uniblue
[2011/09/25 01:52:11 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\WinBatch
[2011/12/11 01:54:08 | 000,000,000 | —D | M] – C:\Users\Shannen\AppData\Roaming\Windows Live Writer
[2012/01/20 09:21:53 | 000,000,348 | —- | M] () – C:\windows\Tasks\RegistryBooster.job
[2009/07/13 23:08:49 | 000,025,774 | —- | M] () – C:\windows\Tasks\SCHEDLGU(304).TXT
[2012/01/17 20:30:54 | 000,032,570 | —- | M] () – C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/20 21:23:51 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2011/04/29 15:27:05 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/01/20 08:42:48 | 2798,804,992 | -HS- | M] () – C:\hiberfil.sys
[2012/01/20 08:42:50 | 3731,742,720 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/13 23:32:31 | 000,026,040 | —- | M] () – C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:32:31 | 000,026,489 | —- | M] () – C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:32:31 | 000,029,779 | —- | M] () – C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:32:31 | 000,043,318 | —- | M] () – C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:49:50 | 000,000,065 | —- | M] () – C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 03:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\windows\WLXPGSS.SCR
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/09/26 02:45:16 | 000,001,670 | -HS- | M] () – C:\Users\Shannen\AppData\Roaming\Microsoft\LastFlashConfig.wfc

< %PROGRAMFILES%\*.* >
[2009/07/13 22:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/10/10 09:39:02 | 000,000,221 | -HS- | M] () – C:\Users\Shannen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >[/color

jeffce

Post #2January 27, 2012, 3:49 PM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
Please subscribe to this topic, if you haven't already.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view
Choose to "show hidden files and folders,"
Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
Close the window with OK

———-

Please download aswMBR to your desktop.

Right click and Run as Administrator the aswMBR icon to run it.
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

Swoop

Post #3January 28, 2012, 5:05 AM UTC

I did all the steps you mentioned however, I was given a File Not Safe message. After download it said smart screen filter would not allow because file not safe and could harm computer. Whats next? Thank You!

jeffce

Post #4January 28, 2012, 2:40 PM UTC

Hi,

Ok we can come back to that.

———-

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Shannen\Videos
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie9
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{494d1265-1d59-43c6-8fa1-eb1d9224278a}: C:\Program Files (x86)\Altnet Music Plugin\ffXPI [2011/12/20 14:32:56 | 000,000,000 | —D | M]
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [] File not found
O15 - HKCU\..Trusted Domains: cnet.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: firefox.com ([www] * in Local intranet)
O15 - HKCU\..Trusted Domains: firefox.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: firstload.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: google.com ([www] https in Trusted sites)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[2012/01/20 09:21:45 | 000,000,000 | -H-D | C] – C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2012/01/08 12:01:41 | 000,000,000 | —D | C] – C:\Users\Shannen\AppData\Local\{C57C8568-81C4-4F29-9B4E-95AD5D8D2BDF}
[3 C:\Users\Shannen\Documents\*.tmp files -> C:\Users\Shannen\Documents\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[2012/01/05 00:16:27 | 000,003,584 | —- | M] () – C:\Users\Shannen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

:Files
ipconfig /flushdns /c
dir C:\Users\Shannen\AppData\Local\BaDoinkULTRA /s /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Swoop

Post #5January 30, 2012, 4:30 PM UTC

I recieved a message from Trend Micro RUBotted saying I was infected with Kraken Botnet Does this change where we go from here?

jeffce

Post #6January 30, 2012, 5:55 PM UTC

Hi, Thanks for letting me know about that. Go ahead and run OTL with the fix that I provided and we can go from there.

Swoop

Post #7January 30, 2012, 11:35 PM UTC

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default Download Directory| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0\ deleted successfully.
C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll moved successfully.
File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{494d1265-1d59-43c6-8fa1-eb1d9224278a}: C:\Program Files (x86)\Altnet Music Plugin\ffXPI not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\cnet.com\www\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefox.com\www\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firefox.com\www\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\firstload.com\www\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\google.com\www\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.
File Protocol\Handler\wlpg - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} folder moved successfully.
C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1} folder moved successfully.
C:\Users\Shannen\AppData\Local\{C57C8568-81C4-4F29-9B4E-95AD5D8D2BDF} folder moved successfully.
C:\Users\Shannen\Documents\~WRL0005.tmp deleted successfully.
C:\Users\Shannen\Documents\~WRL0006.tmp deleted successfully.
C:\Users\Shannen\Documents\~WRL2789.tmp deleted successfully.
C:\windows\msdownld.tmp folder deleted successfully.
C:\Users\Shannen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Shannen\Documents\cmd.bat deleted successfully.
C:\Users\Shannen\Documents\cmd.txt deleted successfully.
< dir C:\Users\Shannen\AppData\Local\BaDoinkULTRA /s /c >
Volume in drive C is TI106166W0D
Volume Serial Number is 92EF-5B6E
Directory of C:\Users\Shannen\AppData\Local\BaDoinkULTRA
01/07/2012 04:06 AM .
01/07/2012 04:06 AM ..
01/07/2012 04:06 AM BaDoinkULTRA
0 File(s) 0 bytes
Directory of C:\Users\Shannen\AppData\Local\BaDoinkULTRA\BaDoinkULTRA
01/07/2012 04:06 AM .
01/07/2012 04:06 AM ..
01/07/2012 04:06 AM cache
01/07/2012 04:06 AM 172 cookies.ini
1 File(s) 172 bytes
Directory of C:\Users\Shannen\AppData\Local\BaDoinkULTRA\BaDoinkULTRA\cache
01/07/2012 04:06 AM .
01/07/2012 04:06 AM ..
01/07/2012 04:06 AM badoink
0 File(s) 0 bytes
Directory of C:\Users\Shannen\AppData\Local\BaDoinkULTRA\BaDoinkULTRA\cache\badoink
01/07/2012 04:06 AM .
01/07/2012 04:06 AM ..
01/07/2012 04:06 AM http
0 File(s) 0 bytes
Directory of C:\Users\Shannen\AppData\Local\BaDoinkULTRA\BaDoinkULTRA\cache\badoink\http
01/07/2012 04:06 AM .
01/07/2012 04:06 AM ..
0 File(s) 0 bytes
Total Files Listed:
1 File(s) 172 bytes
14 Dir(s) 571,882,651,648 bytes free
C:\Users\Shannen\Documents\cmd.bat deleted successfully.
C:\Users\Shannen\Documents\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: General
->Temp folder emptied: 198780 bytes
->Temporary Internet Files folder emptied: 231243066 bytes
->Flash cache emptied: 59554 bytes

User: Public

User: Shannen
->Temp folder emptied: 70969965 bytes
->Temporary Internet Files folder emptied: 722126248 bytes
->Java cache emptied: 13184212 bytes
->FireFox cache emptied: 5632841 bytes
->Flash cache emptied: 99481 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17712125 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 740332 bytes
RecycleBin emptied: 1804 bytes

Total Files Cleaned = 1,013.00 mb

C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 01302012_171430

Files\Folders moved on Reboot…
C:\Users\Shannen\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot…

before I ran the above I received a few errors:
Registry backup will continue but no restore info for the erdnt will be saved
error saving file continue to the next
RegCreateKeyEx:5
unable to create file
c:\windows\erdnt\autobackup\1-30-2012\edrnt.inf
c:\windows\erdnt\autobackup\1-30-2012\system
c:\windows\erdnt\autobackup\1-30-2012\bcd
c:\windows\erdnt\autobackup\1-30-2012\software
c:\windows\erdnt\autobackup\1-30-2012\default
c:\windows\erdnt\autobackup\1-30-2012\security
c:\windows\erdnt\autobackup\1-30-2012\sam

c:\windows\erdnt\autobackup\1-30-2012\users\00000001\ntuser.dat
c:\windows\erdnt\autobackup\1-30-2012\users\00000002\usrclass.dat

jeffce

Post #8January 31, 2012, 12:46 AM UTC

Hi,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

———-

Swoop

Post #9February 2, 2012, 4:51 AM UTC

I have uninstalled everything I can and there is still something preventing me from going any farther. what do i do?

jeffce

Post #10February 2, 2012, 12:44 PM UTC

there is still something preventing me from going any farther

Let me know exactly what you mean by that? Are you not able to download ComboFix, run ComboFix, getting warning messages or explain what you mean.

jeffce

Post #11February 4, 2012, 3:55 PM UTC

Hi, Are you still with me?

Swoop

Post #12February 5, 2012, 3:06 AM UTC

ComboFix 12-01-30.02 - Shannen 02/04/2012 20:37:48.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3559.2205 [GMT -6:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton 360 *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . - REDUCED FUNCTIONALITY MODE - . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . —- Previous Run ——- . c:\users\Shannen\Favorites\Videos.url . . ((((((((((((((((((((((((( Files Created from 2012-01-05 to 2012-02-05 ))))))))))))))))))))))))))))))) . . 2012-02-05 02:38 . 2012-02-05 02:38 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-02-03 08:22 . 2007-12-10 00:00 55808 —-a-w- c:\windows\system32\Spool\prtprocs\x64\ZIMFPRNT.DLL 2012-02-03 08:21 . 2007-12-10 00:00 61952 —-a-w- c:\windows\system32\ZIMF.DLL 2012-02-03 08:21 . 2007-12-10 00:00 567296 —-a-w- c:\windows\system32\ZSHP1018.EXE 2012-02-03 08:21 . 2007-12-10 00:00 49664 —-a-w- c:\windows\system32\ZTAG.DLL 2012-02-03 08:21 . 2007-12-10 00:00 127488 —-a-w- c:\windows\system32\ZSPOOL.DLL 2012-02-03 08:21 . 2007-12-10 00:00 115200 —-a-w- c:\windows\system32\ZLhp1018.DLL 2012-02-03 07:47 . 2012-02-03 07:47 ——– d—–w- c:\programdata\Hewlett-Packard 2012-02-03 07:35 . 2012-01-17 10:39 8602168 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{05AAFDB6-CD6D-4F31-A8DB-0254696E52C6}\mpengine.dll 2012-02-02 04:57 . 2012-02-02 04:57 ——– d—–w- c:\program files\HP 2012-02-01 05:48 . 2012-02-03 07:28 ——– d—–w- c:\program files\Microsoft Security Client 2012-01-31 05:20 . 2012-01-31 05:20 ——– d—–w- c:\program files\Microsoft Games 2012-01-30 23:14 . 2012-01-30 23:14 ——– d—–w- C:\_OTL 2012-01-30 22:29 . 2012-01-30 22:29 ——– d—–w- c:\users\Shannen\AppData\Roaming\Uniblue 2012-01-30 22:29 . 2012-01-30 22:29 ——– d—–w- c:\program files (x86)\Uniblue 2012-01-30 22:18 . 2012-01-30 22:19 ——– d—–w- c:\program files (x86)\ERUNT 2012-01-30 18:42 . 2012-01-30 18:46 ——– d—–w- c:\program files (x86)\Safer Networking 2012-01-26 06:27 . 2012-01-26 06:27 ——– d—–w- c:\programdata\Trend Micro 2012-01-22 23:09 . 2010-11-02 18:58 41280 —-a-w- c:\windows\system32\drivers\PCASp50a64.sys 2012-01-22 23:09 . 2012-01-22 23:09 ——– d—–w- c:\programdata\Novatel Wireless 2012-01-22 23:08 . 2012-01-22 23:08 ——– d—–w- c:\windows\Downloaded Installations 2012-01-21 18:30 . 2012-01-21 18:30 0 —-a-w- c:\windows\ativpsrm.bin 2012-01-21 17:18 . 2012-01-21 17:24 ——– d—–w- c:\users\Shannen\AppData\Local\Browser Guard 2012-01-21 17:14 . 2012-01-21 17:14 ——– d—–w- c:\program files (x86)\WinPcap 2012-01-21 17:09 . 2012-01-21 17:09 388096 —-a-r- c:\users\Shannen\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-01-21 17:09 . 2012-01-21 17:18 ——– d—–w- c:\program files (x86)\Trend Micro 2012-01-20 15:21 . 2012-01-20 15:21 ——– d—–w- c:\users\Shannen\AppData\Local\PackageAware 2012-01-20 06:21 . 2012-01-20 06:21 ——– d—–w- c:\users\Shannen\AppData\Local\Mozilla 2012-01-15 18:04 . 2012-02-03 07:29 ——– d—–w- c:\users\General 2012-01-12 03:59 . 2012-01-12 03:59 ——– d—–w- c:\users\Shannen\Tracing 2012-01-11 03:30 . 2011-10-26 05:25 1572864 —-a-w- c:\windows\system32\quartz.dll 2012-01-11 03:30 . 2011-10-26 05:25 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-01-11 03:30 . 2011-10-26 04:32 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-01-11 03:30 . 2011-10-26 04:32 1328128 —-a-w- c:\windows\SysWow64\quartz.dll 2012-01-11 03:30 . 2011-11-17 06:41 1731920 —-a-w- c:\windows\system32\ntdll.dll 2012-01-11 03:30 . 2011-11-17 05:38 1292080 —-a-w- c:\windows\SysWow64\ntdll.dll 2012-01-11 03:30 . 2011-11-19 14:58 77312 —-a-w- c:\windows\system32\packager.dll 2012-01-11 03:30 . 2011-11-19 14:01 67072 —-a-w- c:\windows\SysWow64\packager.dll 2012-01-07 10:06 . 2012-02-03 07:26 ——– d—–w- c:\users\Shannen\AppData\Local\BaDoinkULTRA 2012-01-07 10:06 . 2012-01-09 04:31 ——– d—–w- c:\users\Shannen\My Library 2012-01-07 09:52 . 2009-12-12 14:15 178176 —-a-w- c:\windows\SysWow64\unrar.dll 2012-01-07 09:52 . 2012-01-07 09:53 ——– d—–w- c:\program files (x86)\K-Lite Codec Pack . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-27 06:52 . 2010-11-21 03:27 279656 ——w- c:\windows\system32\MpSigStub.exe 2011-11-30 05:07 . 2011-10-02 15:48 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-24 04:52 . 2011-12-13 23:24 3145216 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RegistryBooster"="c:\program files (x86)\Uniblue\RegistryBooster\launcher.exe" [2011-11-07 67456] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-04-20 336384] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-02-11 1295736] "ToshibaAppPlace"="c:\program files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [2010-09-23 552960] "Trend Micro RUBotted V2.0 Beta"="c:\program files (x86)\Trend Micro\RUBotted\RUBottedGUI.exe" [2010-12-17 1103184] "Trend Micro Browser Guard"="c:\program files (x86)\Trend Micro\Browser Guard\BGUI.EXE" [2011-02-26 787984] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] . c:\users\Shannen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT\AUTOBACK.EXE [2005-10-20 38912] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20111027.001\BHDrvx64.sys [2011-10-15 1155704] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\4.4.0.12\ccSvcHst.exe [2011-08-04 126400] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x] R3 NWUSBCDFIL64;Novatel Wireless Installation CD;c:\windows\system32\DRIVERS\NwUsbCdFil64.sys [x] R3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\DRIVERS\nwusbmdm_000.sys [x] R3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\DRIVERS\nwusbser_000.sys [x] R3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\DRIVERS\nwusbser2_000.sys [x] R3 NWVMModem;Virgin Mobile USB Modem Driver;c:\windows\system32\DRIVERS\nwvmmdm.sys [x] R3 NWVMPort;Virgin Mobile USB Status Port Driver;c:\windows\system32\DRIVERS\nwvmser.sys [x] R3 NWVMPort2;Virgin Mobile USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwvmser2.sys [x] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\DRIVERS\WN111v2x.sys [x] R4 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2009-09-13 166400] R4 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2009-09-13 128512] R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0404000.00C\SYMDS64.SYS [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0404000.00C\SYMEFA64.SYS [x] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360x64\0404000.00C\ccHPx64.sys [x] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20111109.030\IDSvia64.sys [2011-10-28 488568] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0404000.00C\Ironx64.SYS [x] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360x64\0404000.00C\SYMTDIV.SYS [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe [2011-02-03 123320] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 NvtlService;NovaCore SDK Service;c:\program files (x86)\Novatel Wireless\Novacore\Server\NvtlSrvr.exe [2010-11-02 87888] S2 NWVZHelper;Novatel Wireless Verizon Device Helper;c:\program files (x86)\Novatel Wireless\Verizon\Drivers\NWHelper_001.exe [2010-06-14 270848] S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe [2011-02-03 126392] S2 RUBotSrv;Trend Micro RUBotted Service;c:\program files (x86)\Trend Micro\RUBotted\RUBotSrv.exe [2010-12-17 439632] S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-04-07 294328] S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x] S3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x] S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [x] S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-02-11 54136] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632] S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2011-04-06 828336] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-02-05 c:\windows\Tasks\RegistryBooster.job - c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2012-01-30 08:26] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yahoo.com/?ilc=21 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Shannen\AppData\Roaming\Mozilla\Firefox\Profiles\6ay33l80.default\ . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-Mobilink3 - (no file) HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360] "ImagePath"="\"c:\program files (x86)\Norton 360\Engine\4.4.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\4.4.0.12\diMaster.dll\" /prefetch:1" – . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Trend Micro\Browser Guard\tmiegsrv.exe . ************************************************************************** . Completion time: 2012-02-04 20:43:46 - machine was rebooted ComboFix-quarantined-files.txt 2012-02-05 02:43 . Pre-Run: 572,278,452,224 bytes free Post-Run: 572,134,105,088 bytes free . - - End Of File - - 672D1B0E05D7E4A89524B3D91354D3F1

jeffce

Post #13February 5, 2012, 3:28 AM UTC

Hi Swoop,

I may have overlooked it but could you post the Extras.txt log that was created when you ran OTL the first time. If you still have that could you post that please?
———-

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

ClearJavaCache::

RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

jeffce

Post #14February 6, 2012, 10:11 PM UTC

Hi Swoop, Are you still needing help?

jeffce

Post #15February 7, 2012, 8:15 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Duplicate browser opens when navigating in IE. Cannot access alt.domai

✨ Ask AI

Ask AI