Spyware / Malware / Virus Removal

bad case of system check [Solved]

78 min read

Looking for the outcome? Ask AI

anas_dad

Post #16February 14, 2012, 11:03 PM UTC

not quite sure what happened.
ran fix as asked
rebooted & had proxy problems again but switched it back and are on line once again
did not have a new OTL log on the desk top
reopened OTL and this showed up:

========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 56525 removed from network.proxy.http_port
C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\defaults\preferences folder moved successfully.
C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\defaults folder moved successfully.
C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\chrome folder moved successfully.
Folder move failed. C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013} scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\354.exe deleted successfully.
C:\Program Files\LP\6875\354.exe moved successfully.
Registry value HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Microsoft\Windows\CurrentVersion\Run\\CITY LOUD LOCKS EQ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Cool Road deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1001\Software\Microsoft\Windows\CurrentVersion\Run\\1453276227 deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr not found.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Windows\system32\config\systemprofile\AppData\Roaming\569F3\02968.exe deleted successfully.
File \Windows\system32\config\systemprofile\AppData\Roaming\569F3\02968.exe) -C:\Windows\System32\config\systemprofile\AppData\Roaming\569F3\02968.exe not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Windows\system32\config\systemprofile\AppData\Roaming\569F3\02968.exe deleted successfully.
File \Windows\system32\config\systemprofile\AppData\Roaming\569F3\02968.exe) -C:\Windows\System32\config\systemprofile\AppData\Roaming\569F3\02968.exe not found.
Registry value HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1001_Classes\exefile\shell\open\command\\'' updated successfully.
File "C:\Users\Brie\AppData\Local\vfj.exe" -a "%1" %* not found.
Registry key HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1001_Classes\.exe\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1001_Classes\exefile\ deleted successfully.
HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!
C:\ProgramData\tWk0ZUp9RkTgZp moved successfully.
C:\ProgramData\mess iso iso.8p3v2hg moved successfully.
C:\ProgramData\mess iso iso.rov1tbz moved successfully.
C:\ProgramData\mess iso iso.fk8ee7 moved successfully.
C:\ProgramData\mess iso iso.1hy6j2 moved successfully.
C:\ProgramData\mess iso iso.7yskg moved successfully.
C:\ProgramData\mess iso iso.70nph moved successfully.
C:\ProgramData\mess iso iso.x4xmx moved successfully.
C:\ProgramData\mess iso iso.qr2oz moved successfully.
C:\ProgramData\mess iso iso.xg2c04 moved successfully.
C:\ProgramData\mess iso iso.zx1h7u moved successfully.
C:\ProgramData\mess iso iso.cj8kcq moved successfully.
C:\ProgramData\mess iso iso.xtpwhlo moved successfully.
C:\ProgramData\mess iso iso.wv4i78 moved successfully.
C:\ProgramData\mess iso iso.0b0d38 moved successfully.
C:\ProgramData\mess iso iso.mzg4bb moved successfully.
C:\ProgramData\mess iso iso.ouh8pkh moved successfully.
C:\ProgramData\mess iso iso.m6nvgap moved successfully.
C:\ProgramData\mess iso iso.mnaep6a moved successfully.
C:\ProgramData\mess iso iso.8d3km moved successfully.
C:\ProgramData\mess iso iso.289km moved successfully.
C:\ProgramData\mess iso iso.jqxw8i moved successfully.
C:\ProgramData\mess iso iso.w2i28ak moved successfully.
C:\ProgramData\mess iso iso.m3bxoqx moved successfully.
C:\ProgramData\mess iso iso.zf22y moved successfully.
C:\ProgramData\mess iso iso.4b7g8 moved successfully.
C:\ProgramData\mess iso iso.rhzy1v moved successfully.
C:\ProgramData\mess iso iso.kpv3uz3 moved successfully.
C:\ProgramData\mess iso iso.hs1zym moved successfully.
C:\ProgramData\mess iso iso.pivyl moved successfully.
C:\ProgramData\mess iso iso.0oa17 moved successfully.
C:\ProgramData\mess iso iso.5hwh2fb moved successfully.
C:\ProgramData\mess iso iso.zf0da moved successfully.
C:\ProgramData\mess iso iso.izq48oe moved successfully.
C:\ProgramData\mess iso iso.he1y8k6 moved successfully.
C:\ProgramData\mess iso iso.nie18o moved successfully.
C:\ProgramData\mess iso iso.qmuj8 moved successfully.
C:\ProgramData\mess iso iso.pa51a moved successfully.
C:\ProgramData\mess iso iso.8gb8xj moved successfully.
C:\ProgramData\mess iso iso.69xfvg moved successfully.
C:\ProgramData\mess iso iso.7dzp5 moved successfully.
C:\ProgramData\mess iso iso.xx5ae04 moved successfully.
C:\ProgramData\mess iso iso.l6ix0b moved successfully.
C:\ProgramData\mess iso iso.gcrw49 moved successfully.
C:\ProgramData\mess iso iso.mjkfl moved successfully.
C:\ProgramData\mess iso iso.3wu98pq moved successfully.
C:\ProgramData\mess iso iso.9kgzx moved successfully.
C:\ProgramData\mess iso iso.6liiyav moved successfully.
C:\ProgramData\mess iso iso.db773c moved successfully.
C:\ProgramData\mess iso iso.6llr1 moved successfully.
C:\ProgramData\mess iso iso.vzq9h4 moved successfully.
C:\ProgramData\mess iso iso.ko8oev moved successfully.
C:\ProgramData\mess iso iso.k7b11t1 moved successfully.
C:\ProgramData\mess iso iso.t92icm7 moved successfully.
C:\ProgramData\mess iso iso.48b2k moved successfully.
C:\ProgramData\mess iso iso.bptz0 moved successfully.
C:\ProgramData\mess iso iso.gxgq59 moved successfully.
C:\ProgramData\mess iso iso.9w36u1 moved successfully.
C:\ProgramData\mess iso iso.nnomtjj moved successfully.
C:\ProgramData\mess iso iso.kz43m moved successfully.
C:\ProgramData\mess iso iso.d3uuyt8 moved successfully.
C:\ProgramData\mess iso iso.6z3vskh moved successfully.
C:\ProgramData\mess iso iso.zidpe moved successfully.
C:\ProgramData\mess iso iso.y8zwc9 moved successfully.
C:\ProgramData\mess iso iso.d3c7m moved successfully.
C:\ProgramData\mess iso iso.hkurt moved successfully.
C:\ProgramData\mess iso iso.yalyun moved successfully.
C:\ProgramData\mess iso iso.lhevo6 moved successfully.
C:\ProgramData\mess iso iso.m6u7gp moved successfully.
C:\ProgramData\mess iso iso.5xxqw moved successfully.
C:\ProgramData\mess iso iso.p0x9l moved successfully.
C:\ProgramData\mess iso iso.vw32p moved successfully.
C:\ProgramData\mess iso iso.r67vw moved successfully.
C:\ProgramData\mess iso iso.blz9m moved successfully.
C:\ProgramData\mess iso iso.hoxzs moved successfully.
C:\ProgramData\mess iso iso.e9jy0 moved successfully.
C:\ProgramData\mess iso iso.qkjdkn moved successfully.
C:\ProgramData\mess iso iso.04wu7 moved successfully.
C:\ProgramData\mess iso iso.ccp5wa4 moved successfully.
C:\ProgramData\mess iso iso.uldjl moved successfully.
C:\ProgramData\mess iso iso.m23d80m moved successfully.
C:\ProgramData\mess iso iso.hbcbkem moved successfully.
C:\ProgramData\mess iso iso.5359m moved successfully.
C:\ProgramData\mess iso iso.px5354 moved successfully.
C:\ProgramData\mess iso iso.mt67g13 moved successfully.
C:\ProgramData\mess iso iso.is2lsen moved successfully.
C:\ProgramData\mess iso iso.x6it33v moved successfully.
C:\ProgramData\mess iso iso.l5cjaez moved successfully.
C:\ProgramData\mess iso iso.3rkf5 moved successfully.
C:\ProgramData\mess iso iso.5yzpu moved successfully.
C:\ProgramData\mess iso iso.wp8ab moved successfully.
C:\ProgramData\mess iso iso.iap60w6 moved successfully.
C:\ProgramData\mess iso iso.05n4b moved successfully.
C:\ProgramData\mess iso iso.uwtf4g moved successfully.
C:\ProgramData\mess iso iso.stmyw moved successfully.
C:\ProgramData\mess iso iso.91xi1 moved successfully.
C:\ProgramData\mess iso iso.5xkahhm moved successfully.
C:\ProgramData\mess iso iso.gq6wb moved successfully.
C:\ProgramData\mess iso iso.blr9u moved successfully.
C:\ProgramData\mess iso iso.jgaqlt moved successfully.
C:\ProgramData\mess iso iso.xp63t moved successfully.
C:\ProgramData\mess iso iso.ud0twk5 moved successfully.
C:\ProgramData\mess iso iso.e5a22v moved successfully.
C:\ProgramData\mess iso iso.raa7b6 moved successfully.
C:\ProgramData\mess iso iso.t4229k moved successfully.
C:\ProgramData\mess iso iso.2v1c56 moved successfully.
C:\ProgramData\mess iso iso.7a4hl moved successfully.
C:\ProgramData\mess iso iso.mbn29 moved successfully.
C:\ProgramData\mess iso iso.g7vja moved successfully.
C:\ProgramData\mess iso iso.f30thm moved successfully.
C:\ProgramData\mess iso iso.940lk moved successfully.
C:\ProgramData\mess iso iso.y029g7w moved successfully.
C:\ProgramData\mess iso iso.kk81qn8 moved successfully.
C:\ProgramData\mess iso iso.w0tgb0 moved successfully.
C:\ProgramData\mess iso iso.ttvglq moved successfully.
C:\ProgramData\mess iso iso.bc3ue3 moved successfully.
C:\ProgramData\mess iso iso.y7ne1 moved successfully.
C:\ProgramData\mess iso iso.lgrbz moved successfully.
C:\ProgramData\mess iso iso.ebwbk moved successfully.
C:\ProgramData\mess iso iso.trs55 moved successfully.
C:\ProgramData\mess iso iso.zxoifk5 moved successfully.
C:\ProgramData\mess iso iso.yk2id moved successfully.
C:\ProgramData\mess iso iso.sdydqyk moved successfully.
C:\ProgramData\mess iso iso.86kq6qz moved successfully.
C:\ProgramData\mess iso iso.eb9bkx moved successfully.
C:\ProgramData\mess iso iso.mp0ee moved successfully.
C:\ProgramData\mess iso iso.owjh9aw moved successfully.
C:\ProgramData\mess iso iso.ac4perb moved successfully.
C:\ProgramData\mess iso iso.4wk9s08 moved successfully.
C:\ProgramData\mess iso iso.yo8p9 moved successfully.
C:\ProgramData\mess iso iso.pqsqv moved successfully.
C:\ProgramData\mess iso iso.1g8qluz moved successfully.
C:\ProgramData\mess iso iso.p6oml moved successfully.
C:\ProgramData\mess iso iso.98shqqh moved successfully.
C:\ProgramData\mess iso iso.hsc30 moved successfully.
C:\ProgramData\mess iso iso.2xanyx moved successfully.
C:\ProgramData\mess iso iso.3ecxtf moved successfully.
C:\ProgramData\mess iso iso.9f965du moved successfully.
C:\ProgramData\mess iso iso.xp4k1yy moved successfully.
C:\ProgramData\mess iso iso.45816ko moved successfully.
C:\ProgramData\mess iso iso.iphzh93 moved successfully.
C:\ProgramData\mess iso iso.e6fr7 moved successfully.
C:\ProgramData\mess iso iso.lk8zd moved successfully.
C:\ProgramData\mess iso iso.lxp5q7 moved successfully.
C:\ProgramData\mess iso iso.qk5uh moved successfully.
C:\ProgramData\mess iso iso.yjjf9 moved successfully.
C:\ProgramData\mess iso iso.6ftep moved successfully.
C:\ProgramData\mess iso iso.17l3f moved successfully.
C:\ProgramData\mess iso iso.jio5irz moved successfully.
C:\ProgramData\mess iso iso.41t14 moved successfully.
C:\ProgramData\mess iso iso.r277qm moved successfully.
C:\ProgramData\mess iso iso.nluoou moved successfully.
C:\ProgramData\mess iso iso.fcvmi moved successfully.
C:\ProgramData\mess iso iso.2kjc5o moved successfully.
C:\ProgramData\mess iso iso.ksikj1 moved successfully.
C:\ProgramData\mess iso iso.4jsde moved successfully.
C:\ProgramData\mess iso iso.58ekz moved successfully.
C:\ProgramData\mess iso iso.r5i9skm moved successfully.
C:\ProgramData\mess iso iso.8q4sdhp moved successfully.
C:\ProgramData\mess iso iso.5z0f2hr moved successfully.
C:\ProgramData\mess iso iso.kxhfi moved successfully.
C:\ProgramData\mess iso iso.w5q4n5v moved successfully.
C:\ProgramData\mess iso iso.va8g9 moved successfully.
C:\ProgramData\mess iso iso.vhcg1z moved successfully.
C:\ProgramData\mess iso iso.0g7hy moved successfully.
C:\ProgramData\mess iso iso.szhj74p moved successfully.
C:\ProgramData\mess iso iso.mbx1n moved successfully.
C:\ProgramData\mess iso iso.5q0gdw moved successfully.
C:\ProgramData\mess iso iso.utbzoj moved successfully.
C:\ProgramData\mess iso iso.ym7la moved successfully.
C:\ProgramData\mess iso iso.bzubpq moved successfully.
C:\ProgramData\mess iso iso.mhu0c9 moved successfully.
C:\ProgramData\mess iso iso.mssyiq moved successfully.
C:\ProgramData\mess iso iso.d3424 moved successfully.
C:\ProgramData\mess iso iso.16a88g moved successfully.
C:\ProgramData\mess iso iso.kfc8rn moved successfully.
C:\ProgramData\mess iso iso.kpfvmzj moved successfully.
C:\ProgramData\mess iso iso.1fbft moved successfully.
C:\ProgramData\mess iso iso.h4wsv moved successfully.
C:\ProgramData\mess iso iso.9m8xp45 moved successfully.
C:\ProgramData\mess iso iso.nzmspl moved successfully.
C:\ProgramData\mess iso iso.rd6o5x moved successfully.
C:\ProgramData\mess iso iso.uszw7 moved successfully.
C:\ProgramData\mess iso iso.81l08 moved successfully.
C:\ProgramData\mess iso iso.8k1bt moved successfully.
C:\ProgramData\mess iso iso.sbzmb moved successfully.
C:\ProgramData\mess iso iso.ioicinc moved successfully.
C:\ProgramData\mess iso iso.3mfk9p moved successfully.
C:\ProgramData\mess iso iso.xukrnto moved successfully.
C:\ProgramData\mess iso iso.xoz34 moved successfully.
C:\ProgramData\hope dead army.1alpp moved successfully.
C:\ProgramData\mess iso iso.yy6qoge moved successfully.
========== FILES ==========
< dir /s "C:\Users\Ana\AppData\Local\Temp\smtmp\1" /c >
Volume in drive C is HP
Volume Serial Number is 569F-3C43
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM Programs
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM 7-Zip
02/11/2012 05:04 PM Accessories
02/11/2012 05:04 PM Administrative Tools
02/11/2012 05:04 PM Adobe
02/11/2012 05:04 PM Aquatic Life 3D Screensaver
02/11/2012 05:04 PM AVG 2011
02/11/2012 05:04 PM Bamboo
02/11/2012 05:04 PM DAEMON Tools Lite
02/11/2012 05:04 PM Driver Performer
02/11/2012 05:04 PM Extras and Upgrades
02/11/2012 05:04 PM Games
02/11/2012 05:04 PM Graboid Video
02/11/2012 05:04 PM HijackThis
02/11/2012 05:04 PM HP
02/11/2012 05:04 PM HP Games
02/11/2012 05:04 PM Lavasoft
02/11/2012 05:04 PM LightScribe Direct Disc Labeling
02/11/2012 05:04 PM MagicDisc
02/11/2012 05:04 PM MagicISO
02/11/2012 05:04 PM Maintenance
02/11/2012 05:04 PM Microsoft Games
02/11/2012 05:04 PM Microsoft Silverlight
02/11/2012 05:04 PM Microsoft Works
02/11/2012 05:04 PM My HP Games
02/11/2012 05:04 PM NETGEAR WG311v3 Smart Wizard
02/11/2012 05:04 PM Norton Internet Security
02/11/2012 05:04 PM Online Services
02/11/2012 05:04 PM Origin
02/11/2012 05:04 PM PC Help & Tools
02/11/2012 05:04 PM Quicken Financial Center
02/11/2012 05:04 PM QuickTime
02/11/2012 05:04 PM SeaStorm 3D Screensaver
02/11/2012 05:04 PM Sierra
02/11/2012 05:04 PM Sims2Pack Clean Installer
02/11/2012 05:04 PM Skype
02/11/2012 05:04 PM Spybot - Search & Destroy
02/11/2012 05:04 PM Startup
02/11/2012 05:04 PM Try Microsoft Office for 60 days
02/11/2012 05:04 PM User Guides
02/11/2012 05:04 PM Windows Live
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\7-Zip
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Accessories
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM Accessibility
02/11/2012 05:04 PM System Tools
02/11/2012 05:04 PM Windows PowerShell
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Accessories\Accessibility
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Accessories\System Tools
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Accessories\Windows PowerShell
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Administrative Tools
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Adobe
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Aquatic Life 3D Screensaver
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\AVG 2011
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Bamboo
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\DAEMON Tools Lite
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Driver Performer
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Extras and Upgrades
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Games
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Graboid Video
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\HijackThis
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\HP
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM HP Advisor
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\HP\HP Advisor
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\HP Games
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Lavasoft
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM Ad-Aware
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Lavasoft\Ad-Aware
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\LightScribe Direct Disc Labeling
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\MagicDisc
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\MagicISO
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Maintenance
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Games
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM Age of Mythology
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Games\Age of Mythology
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM Age of Mythology Docs
02/11/2012 05:04 PM Diagnostics
02/11/2012 05:04 PM Web Links
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Games\Age of Mythology\Age of Mythology Docs
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Games\Age of Mythology\Diagnostics
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Games\Age of Mythology\Web Links
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Silverlight
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Microsoft Works
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\My HP Games
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\NETGEAR WG311v3 Smart Wizard
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Norton Internet Security
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Online Services
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM United States
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Online Services\United States
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Origin
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\PC Help & Tools
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Quicken Financial Center
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\QuickTime
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\SeaStorm 3D Screensaver
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Sierra
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
02/11/2012 05:04 PM Emperor - Rise of the Middle Kingdom
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Sierra\Emperor - Rise of the Middle Kingdom
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Sims2Pack Clean Installer
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Skype
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Spybot - Search & Destroy
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Startup
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Try Microsoft Office for 60 days
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\User Guides
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\1\Programs\Windows Live
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
158 Dir(s) 41,001,955,328 bytes free
C:\Users\Ana\Desktop\cmd.bat deleted successfully.
C:\Users\Ana\Desktop\cmd.txt deleted successfully.
< dir /s "C:\Users\Ana\AppData\Local\Temp\smtmp\4" /c >
Volume in drive C is HP
Volume Serial Number is 569F-3C43
Directory of C:\Users\Ana\AppData\Local\Temp\smtmp\4
02/11/2012 05:04 PM .
02/11/2012 05:04 PM ..
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
2 Dir(s) 41,001,971,712 bytes free
C:\Users\Ana\Desktop\cmd.bat deleted successfully.
C:\Users\Ana\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.31.0 log created on 02142012_064351

Files\Folders moved on Reboot…
C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013} folder moved successfully.

Registry entries deleted on Reboot…

I hope this is what you are looking for
Patrick

oldman960

Post #17February 15, 2012, 1:41 AM UTC

Hi anas_dad, What items are still missing in the problem accounts? Open OTL and click the Run Scan button. Please post the log produced.

anas_dad

Post #18February 15, 2012, 2:36 AM UTC

Hi Oldman960,
As far as I can tell the only things still missing are from the start menu.
attached are 2 screen shots of the start menus from both users.
#1 only has "recent items" & "computer" on the righthand side while #2 has a complete list of choices
maybe this isn't an issue I should worry about ?
anyway here is the OTL log file
OTL logfile created on: 2/14/2012 8:20:13 PM - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ana\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 62.50% Memory free
3.98 Gb Paging File | 3.47 Gb Available in Paging File | 87.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.03 Gb Total Space | 38.23 Gb Free Space | 27.70% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 1.49 Gb Free Space | 13.57% Space Free | Partition Type: NTFS
Drive E: | 621.23 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 778.49 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: TOBE | User Name: Ana | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/13 10:37:21 | 000,924,632 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/02/12 11:57:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
PRC - [2009/04/10 22:27:38 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/09/10 13:01:28 | 000,611,664 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
PRC - [2008/01/20 20:34:45 | 000,485,376 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mspaint.exe
PRC - [2008/01/20 20:33:37 | 000,498,176 | —- | M] (Microsoft Corporation) – C:\Windows\HelpPane.exe

========== Modules (No Company Name) ==========

MOD - [2012/02/13 10:37:21 | 001,911,768 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/11/29 15:45:24 | 008,527,008 | —- | M] () – C:\Windows\System32\Macromed\Flash\NPSWF32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – – (PlugPlay32)
SRV - [2012/01/13 14:53:18 | 000,652,360 | —- | M] (Malwarebytes Corporation) [Auto | Stopped] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2011/05/25 00:09:06 | 002,214,504 | —- | M] (NVIDIA Corporation) [Auto | Stopped] – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe – (nvUpdatusService)
SRV - [2010/11/19 06:57:14 | 001,150,936 | —- | M] (PC Tools) [On_Demand | Stopped] – C:\Program Files\PC Tools Security\pctsSvc.exe – (sdCoreService)
SRV - [2010/10/21 08:38:32 | 004,869,488 | —- | M] (Wacom Technology, Corp.) [Auto | Stopped] – C:\Program Files\Tablet\Pen\Pen_Tablet.exe – (TabletServicePen)
SRV - [2010/10/21 08:38:32 | 000,416,112 | —- | M] (Wacom Technology, Corp.) [Auto | Stopped] – C:\Program Files\Tablet\Pen\Pen_TouchService.exe – (TouchServicePen)
SRV - [2010/03/30 19:38:55 | 000,655,624 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/03/15 14:02:36 | 000,366,840 | —- | M] (PC Tools) [On_Demand | Stopped] – C:\Program Files\PC Tools Security\pctsAuxs.exe – (sdAuxService)
SRV - [2008/09/10 13:01:28 | 000,611,664 | —- | M] (Lavasoft) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe – (aawservice)

========== Driver Services (SafeList) ==========

DRV - [2011/12/10 15:24:06 | 000,020,464 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\mbam.sys – (MBAMProtector)
DRV - [2011/05/25 00:09:05 | 010,589,800 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2010/12/10 13:24:12 | 000,239,168 | —- | M] (PC Tools) [Kernel | Boot | Running] – C:\Windows\system32\drivers\PCTCore.sys – (PCTCore)
DRV - [2010/10/05 13:26:00 | 000,014,120 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2010/07/16 14:59:54 | 000,338,880 | —- | M] (PC Tools) [Kernel | Boot | Running] – C:\Windows\system32\drivers\pctDS.sys – (pctDS)
DRV - [2009/12/20 10:17:49 | 000,691,696 | —- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] – C:\Windows\System32\Drivers\sptd.sys – (sptd)
DRV - [2009/08/27 17:06:32 | 000,016,168 | —- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wacmoumonitor.sys – (wacmoumonitor)
DRV - [2009/07/09 11:16:24 | 000,013,480 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WacomVTHid.sys – (WacomVTHid)
DRV - [2009/02/24 18:42:14 | 000,116,736 | —- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mcdbus.sys – (mcdbus)
DRV - [2008/06/06 13:13:40 | 000,133,152 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvrd32.sys – (nvrd32)
DRV - [2008/06/06 13:13:10 | 000,145,440 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\nvstor32.sys – (nvstor32)
DRV - [2008/05/22 13:20:54 | 000,020,640 | —- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] – C:\Program Files\PC-Doctor for Windows\pcd5srvc.pkms – (PCD5SRVC{BD6912E3-AC9D80E8-05040000})
DRV - [2008/05/22 03:39:34 | 000,015,360 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvsmu.sys – (nvsmu)
DRV - [2008/05/21 05:44:10 | 001,049,760 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvmfdx32.sys – (NVENETFD)
DRV - [2008/02/12 09:27:34 | 000,207,360 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSXHWBS3.sys – (HSXHWBS3)
DRV - [2008/02/12 09:25:22 | 000,985,600 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_DP.sys – (HSF_DP)
DRV - [2007/10/18 09:36:54 | 000,008,704 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2007/05/03 08:11:14 | 000,256,000 | —- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\MRVW13B.sys – (MRV6X32P)
DRV - [2007/02/16 10:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2005/12/12 11:27:00 | 000,019,072 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\PS2.sys – (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=ZUGO&form;=ZGAPHP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.msn.com/?wl=true
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E7 4E B6 01 10 F2 F7 42 A0 83 DB DB 0C 31 F6 0E [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.meebo.com/|http://www.menewsha.com/|http://crysandrea.com/"
FF - prefs.js..extensions.enabledItems: [removed]:0.9.11
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.81
FF - prefs.js..extensions.enabledItems: [removed]:1.6.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1151
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "http://www.google.com/search?sourceid=navclient&hl;=en&q;="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 56525
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\PROGRA~1\SONYON~1\npsoe.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ana\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ana\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1d5287d1-8a92-0001-1f31-1cec198018d8}: C:\Program Files\AVG\AVG8\ToolbarFF
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/13 10:37:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/09 10:19:51 | 000,000,000 | —D | M]

[2008/12/29 19:29:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Extensions
[2012/02/14 16:53:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions
[2010/05/18 08:25:57 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/12 14:09:31 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/03/25 10:50:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}-trash
[2011/03/28 16:13:41 | 000,000,000 | —D | M] (Personas) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2010/02/25 10:07:16 | 000,000,000 | —D | M] (Panda3D Game Engine Plug-In) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2011/01/02 21:33:24 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2011/01/02 21:33:26 | 000,001,919 | —- | M] () – C:\Users\Ana\AppData\Roaming\Mozilla\Firefox\Profiles\d5btn3lz.default\searchplugins\bing-zugo.xml
[2012/02/13 10:37:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/07/19 19:57:48 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) – C:\USERS\ANA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D5BTN3LZ.DEFAULT\EXTENSIONS\{AE93811A-5C9A-4D34-8462-F7B864FC4696}.XPI
File not found (No name found) – C:\USERS\ANA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D5BTN3LZ.DEFAULT\EXTENSIONS\{C8D9FF79-5AAA-4DE6-AFB9-FBBF30DAA013}
[2012/02/13 10:37:21 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/07/19 04:05:25 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/03/20 19:52:56 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2012/02/13 10:37:17 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/13 10:37:17 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\15.0.874.121\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Pando Web Installer (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Ana\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Extension = C:\Users\Ana\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0\
CHR - Extension: AT_WesCravenV2 = C:\Users\Ana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahooofggegjbnodalhoibemeabkapop\3\

O1 HOSTS File: ([2006/09/18 15:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll File not found
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [1A:Stardock TrayMonitor] File not found
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DPService] C:\Program Files\HP\DVDPlay\DPService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunServices: [1A:Stardock TrayMonitor] File not found
O4 - Startup: C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C3EFEE7-B1F5-406C-9ACB-9AABE3B7F973}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C517DEB-59CF-4806-A1BA-A71265252F3D}: DhcpNameServer = 192.168.0.1 [removed]
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (MrvGINA.dll) - File not found
O24 - Desktop WallPaper: C:\Users\Ana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/25 07:12:57 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2002/07/15 14:09:40 | 000,032,768 | R— | M] (Aeon) - E:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2002/07/08 11:42:16 | 000,000,220 | R— | M] () - E:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2007/08/04 09:54:31 | 000,000,000 | —D | M] - G:\AutoRun – [ CDFS ]
O32 - AutoRun File - [2007/08/04 09:54:31 | 000,700,416 | R— | M] (Electronic Arts Inc.) - G:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2007/08/04 08:09:54 | 000,659,456 | R— | M] (Electronic Arts Inc.) - G:\AutoRunGUI.dll – [ CDFS ]
O32 - AutoRun File - [2007/08/04 10:00:52 | 000,000,152 | R— | M] () - G:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{071cf126-b64a-11de-9ccc-002354029687}\Shell\Auto\command - "" = G:\launcher.exe
O33 - MountPoints2\{071cf126-b64a-11de-9ccc-002354029687}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\launcher.exe
O33 - MountPoints2\{692cae14-7c15-11dd-b3a6-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{692cae14-7c15-11dd-b3a6-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe – [2002/07/15 14:09:40 | 000,032,768 | R— | M] (Aeon)
O33 - MountPoints2\{79554103-d694-11dd-93c0-002354029687}\Shell - "" = AutoRun
O33 - MountPoints2\{79554103-d694-11dd-93c0-002354029687}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/13 18:23:31 | 004,733,440 | —- | C] (AVAST Software) – C:\Users\Ana\Desktop\aswMBR.exe
[2012/02/13 10:33:10 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\F3C43
[2012/02/13 10:32:52 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{7D0CFB31-503B-40BC-9ABB-F72E19779501}
[2012/02/13 10:32:50 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{4AB2A8D6-5FD4-4C12-85FD-610A4D1F5A7F}
[2012/02/13 10:31:47 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\569F3
[2012/02/13 08:48:05 | 000,000,000 | —D | C] – C:\_OTL
[2012/02/12 23:02:31 | 000,000,000 | —D | C] – C:\Program Files\F3C43
[2012/02/12 23:01:56 | 000,000,000 | —D | C] – C:\Program Files\LP
[2012/02/12 14:06:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2012/02/12 11:57:37 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
[2012/02/12 03:07:37 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciseq.dll
[2012/02/12 03:03:38 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/02/12 03:03:38 | 000,497,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2012/02/11 19:23:58 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{BD1CEDE5-6EF3-4C7A-85D0-A9AC360F0B31}
[2012/02/11 19:23:47 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{9734659A-CD14-4F8D-9671-80982881F240}
[2012/02/11 19:02:42 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\Malwarebytes
[2012/02/11 19:02:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/11 19:02:35 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/02/11 19:02:34 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/02/11 19:02:34 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/02/11 17:55:04 | 000,656,320 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctEFA.sys
[2012/02/11 17:55:04 | 000,338,880 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctDS.sys
[2012/02/11 17:55:01 | 000,251,560 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctgntdi.sys
[2012/02/11 17:55:01 | 000,103,232 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctwfpfilter.sys
[2012/02/11 17:54:55 | 000,239,168 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTCore.sys
[2012/02/11 17:54:55 | 000,160,448 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTAppEvent.sys
[2012/02/11 17:54:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security
[2012/02/11 17:54:49 | 000,070,536 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctplsg.sys
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Program Files\PC Tools Security
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\PC Tools
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2012/02/11 17:47:36 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools
[2012/02/11 17:01:29 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{D15A6F1B-B210-44A7-8F82-D124A3AEF183}

========== Files - Modified Within 30 Days ==========

[2012/02/14 20:18:12 | 000,090,632 | —- | M] () – C:\Users\Ana\Desktop\desktop2.jpg
[2012/02/14 20:14:50 | 000,072,366 | —- | M] () – C:\Users\Ana\Desktop\desktop1.jpg
[2012/02/14 16:48:44 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/02/14 06:47:38 | 000,001,356 | —- | M] () – C:\Users\Ana\AppData\Local\d3d9caps.dat
[2012/02/13 18:37:24 | 000,000,120 | —- | M] () – C:\Users\Ana\Desktop\MBR.zip
[2012/02/13 18:26:38 | 000,000,512 | —- | M] () – C:\Users\Ana\Desktop\MBR.dat
[2012/02/13 18:23:52 | 004,733,440 | —- | M] (AVAST Software) – C:\Users\Ana\Desktop\aswMBR.exe
[2012/02/13 10:47:23 | 261,136,407 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/02/13 10:44:19 | 000,282,624 | —- | M] () – C:\Users\Ana\AppData\Roaming\firefox.exe
[2012/02/13 10:35:35 | 000,000,414 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{613A91CE-67C1-4421-90F1-050F3F9C0DEE}.job
[2012/02/13 10:32:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
[2012/02/13 08:58:37 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/13 08:58:37 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/12 14:44:26 | 000,111,872 | —- | M] () – C:\Windows\System32\drivers\TrueSight.sys
[2012/02/12 14:04:49 | 001,202,688 | —- | M] () – C:\Users\Ana\Desktop\RogueKiller.exe
[2012/02/12 11:57:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
[2012/02/12 03:02:11 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/02/12 03:02:11 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/02/11 21:40:04 | 000,000,314 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForAna.job
[2012/02/11 19:32:07 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
[2012/02/11 19:02:36 | 000,000,868 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/11 17:54:52 | 000,001,748 | —- | M] () – C:\Users\Public\Desktop\Spyware Doctor.lnk

========== Files Created - No Company Name ==========

[2012/02/14 20:18:12 | 000,090,632 | —- | C] () – C:\Users\Ana\Desktop\desktop2.jpg
[2012/02/14 20:14:50 | 000,072,366 | —- | C] () – C:\Users\Ana\Desktop\desktop1.jpg
[2012/02/13 18:37:24 | 000,000,120 | —- | C] () – C:\Users\Ana\Desktop\MBR.zip
[2012/02/13 18:26:38 | 000,000,512 | —- | C] () – C:\Users\Ana\Desktop\MBR.dat
[2012/02/13 10:37:05 | 000,282,624 | —- | C] () – C:\Users\Ana\AppData\Roaming\firefox.exe
[2012/02/12 14:06:31 | 000,001,987 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Live Messenger .lnk
[2012/02/12 14:06:31 | 000,000,940 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/02/12 14:06:31 | 000,000,778 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/02/12 14:06:30 | 000,002,032 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/02/12 14:06:30 | 000,001,081 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/02/12 14:06:30 | 000,000,945 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/02/12 14:06:30 | 000,000,832 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/12 14:06:30 | 000,000,258 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/02/12 14:06:30 | 000,000,240 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/02/12 14:05:50 | 000,111,872 | —- | C] () – C:\Windows\System32\drivers\TrueSight.sys
[2012/02/12 14:04:48 | 001,202,688 | —- | C] () – C:\Users\Ana\Desktop\RogueKiller.exe
[2012/02/11 19:27:07 | 000,000,900 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
[2012/02/11 19:27:06 | 000,000,848 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
[2012/02/11 19:02:36 | 000,000,868 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/11 17:54:52 | 000,001,748 | —- | C] () – C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010/12/20 20:45:23 | 000,018,604 | —- | C] () – C:\Users\Ana\AppData\Roaming\UserTile.png
[2010/11/10 19:20:54 | 000,000,000 | —- | C] () – C:\Users\Ana\AppData\Local\prvlcl.dat
[2010/10/05 20:14:29 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/10/05 20:13:44 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2010/06/29 23:12:16 | 000,013,312 | —- | C] () – C:\Windows\LPRES.DLL
[2009/12/21 19:17:10 | 000,028,688 | —- | C] () – C:\ProgramData\mess iso iso.lwy2o
[2009/10/15 19:30:35 | 000,003,584 | —- | C] () – C:\Users\Ana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/05/26 22:39:53 | 000,069,632 | —- | C] () – C:\Windows\System32\xmltok.dll
[2009/05/26 22:39:53 | 000,036,864 | —- | C] () – C:\Windows\System32\xmlparse.dll
[2009/03/25 20:50:37 | 000,000,604 | —- | C] () – C:\Users\Ana\AppData\Local\Notes.stt
[2009/03/25 20:50:37 | 000,000,008 | —- | C] () – C:\Users\Ana\AppData\Local\Reminders.stt
[2009/01/09 09:31:30 | 000,000,446 | —- | C] () – C:\Windows\Sierra.ini
[2008/12/30 01:59:36 | 000,016,976 | —- | C] () – C:\Users\Ana\AppData\Roaming\wklnhst.dat
[2008/12/29 20:11:08 | 000,001,356 | —- | C] () – C:\Users\Ana\AppData\Local\d3d9caps.dat
[2008/12/29 19:36:36 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/08/25 07:13:58 | 000,107,357 | —- | C] () – C:\Windows\hpqins13.dat
[2008/08/25 06:46:22 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2008/08/25 06:46:22 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2008/05/16 10:58:04 | 000,012,632 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2006/11/02 06:53:49 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:44:53 | 002,243,000 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Thanks once again for your help & patience
Patrick

Attachments:

oldman960

Post #19February 15, 2012, 3:44 AM UTC last edited February 21, 2012, 4:10 PM UTC

Hi ana_dad,

Try this. Click start

right click on a blank spot in the right hand panel
click properties
on the Start Menu tab click customize
using the screenshot of the profile that is displaying the items in the right hand panel as a reference
check Display as a link beside the missing items and click ok

Let me know how you make out and we'll continue cleaning this machine.

anas_dad

Post #20February 15, 2012, 12:39 PM UTC

Ok, that works. Now that I know where to find it I can set it up any way she likes it. Thanks, Patrick

oldman960

Post #21February 15, 2012, 6:55 PM UTC last edited February 15, 2012, 6:56 PM UTC

Hi anas_dad,

Good. I think you should be able to boot to normal windows and we can go after the rest. The only thing I see that respawned is the Firefox proxy but you know how to get around it or use Internet Explorer.

Before you boot to normal windows let's see if we can disble Spybot's Teatimer in msconfig.

Press the Windows key (it may say win or have the windows logo on it) and the R key. This will open a run box. Into the run box copy and paste the following and click ok.

msconfig

When the system Configuration box opens

click on the startup tab
Locate and uncheck any entries with Spybot, Teatimer or Safer Networks
click apply, click ok
You will be prompted to reboot

Reboot to normal windows.

You may recieve a message from windows similar to some items have been disabled….

there is a small check box with don't show this again
check it, that will keep the box from appearing on each restart.

We can re-enable the items later.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3.CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

Thanks

anas_dad

Post #22February 16, 2012, 12:22 AM UTC

Oldman960,
Ok, ran combofix log is posted below.
Still have the firefox proxy issue.
Also, I seem to have picked up a "hover ad" where if the cursor crosses a certain word an ad pops up
Other than that, things seem to be looking quite good.
Once again, thanks
Patrick

ComboFix 12-02-15.01 - Ana 02/15/2012 17:44:42.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1918.852 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\LP
c:\program files\LP\6875\601C.tmp
c:\program files\LP\6875\624F.tmp
c:\program files\LP\6875\810.exe
c:\program files\LP\6875\810.tmp
c:\program files\LP\6875\90F6.tmp
c:\program files\LP\6875\E12D.tmp
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbar.dll
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\program files\Search Toolbar\SearchToolbarUpdater.exe
c:\users\Ana\AppData\Roaming\.#
c:\users\Ana\AppData\Roaming\firefox.exe
c:\users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Spy Protection.lnk
c:\users\Ana\AppData\Roaming\Mozilla\Firefox\Profiles\d5btn3lz.default\searchplugins\bing-zugo.xml
c:\users\Ana\Minecraft.exe
c:\users\Brie\AppData\Roaming\Mozilla\Firefox\Profiles\vntc5lax.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}
c:\users\Brie\AppData\Roaming\Mozilla\Firefox\Profiles\vntc5lax.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\chrome.manifest
c:\users\Brie\AppData\Roaming\Mozilla\Firefox\Profiles\vntc5lax.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\chrome\xulcache.jar
c:\users\Brie\AppData\Roaming\Mozilla\Firefox\Profiles\vntc5lax.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\defaults\preferences\xulcache.js
c:\users\Brie\AppData\Roaming\Mozilla\Firefox\Profiles\vntc5lax.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\install.rdf
c:\windows\system32\jucheck.exe
c:\windows\system32\jusched.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-01-16 to 2012-02-16 )))))))))))))))))))))))))))))))
.
.
2012-02-16 00:05 . 2012-02-16 00:05 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-16 00:05 . 2012-02-16 00:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-02-16 00:05 . 2012-02-16 00:05 ——– d—–w- c:\users\Brie\AppData\Local\temp
2012-02-16 00:05 . 2012-02-16 00:06 ——– d—–w- c:\users\Ana\AppData\Local\temp
2012-02-16 00:01 . 2012-02-16 00:01 0 —ha-w- c:\users\Ana\BIT699C.tmp
2012-02-13 16:37 . 2012-02-13 16:37 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-02-13 16:37 . 2012-02-13 16:37 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-02-13 16:37 . 2012-02-13 16:37 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-02-13 16:37 . 2012-02-13 16:37 45016 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-02-13 16:33 . 2012-02-13 16:33 ——– d—–w- c:\users\Ana\AppData\Roaming\F3C43
2012-02-13 16:31 . 2012-02-13 16:32 282624 —-a-w- c:\users\Ana\AppData\Roaming\Microsoft\6875\354.exe
2012-02-13 16:31 . 2012-02-13 16:45 ——– d—–w- c:\users\Ana\AppData\Roaming\569F3
2012-02-13 14:48 . 2012-02-13 14:48 ——– d—–w- C:\_OTL
2012-02-13 05:02 . 2012-02-13 10:13 ——– d—–w- c:\program files\F3C43
2012-02-12 20:05 . 2012-02-12 20:44 111872 —-a-w- c:\windows\system32\drivers\TrueSight.sys
2012-02-12 09:07 . 2011-10-14 16:03 189952 —-a-w- c:\windows\system32\winmm.dll
2012-02-12 09:07 . 2011-10-14 16:00 23552 —-a-w- c:\windows\system32\mciseq.dll
2012-02-12 09:03 . 2011-10-25 15:58 1314816 —-a-w- c:\windows\system32\quartz.dll
2012-02-12 09:03 . 2011-10-25 15:58 497152 —-a-w- c:\windows\system32\qdvd.dll
2012-02-12 06:33 . 2011-12-01 15:21 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-02-12 01:02 . 2012-02-12 01:02 ——– d—–w- c:\users\Ana\AppData\Roaming\Malwarebytes
2012-02-12 01:02 . 2012-02-12 01:02 ——– d—–w- c:\programdata\Malwarebytes
2012-02-12 01:02 . 2012-02-12 01:02 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-02-12 01:02 . 2011-12-10 21:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-11 23:55 . 2010-07-16 20:59 656320 —-a-w- c:\windows\system32\drivers\pctEFA.sys
2012-02-11 23:55 . 2010-07-16 20:59 338880 —-a-w- c:\windows\system32\drivers\pctDS.sys
2012-02-11 23:55 . 2011-01-17 15:10 251560 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2012-02-11 23:55 . 2010-12-16 14:38 103232 —-a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2012-02-11 23:54 . 2010-12-10 22:57 160448 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2012-02-11 23:54 . 2010-12-10 19:24 239168 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2012-02-11 23:54 . 2010-12-16 14:46 70536 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2012-02-11 23:54 . 2012-02-12 00:34 ——– d—–w- c:\program files\PC Tools Security
2012-02-11 23:54 . 2012-02-12 00:01 ——– d—–w- c:\program files\Common Files\PC Tools
2012-02-11 23:54 . 2012-02-11 23:54 ——– d—–w- c:\users\Ana\AppData\Roaming\PC Tools
2012-02-11 23:47 . 2012-02-11 23:54 ——– d—–w- c:\programdata\PC Tools
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-29 21:45 . 2011-09-02 18:38 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 13:37 . 2011-12-14 06:14 2043904 —-a-w- c:\windows\system32\win32k.sys
2012-02-13 16:37 . 2011-06-09 16:19 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Ana\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Ana\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Ana\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2010-06-30 1689144]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-03-21 2937528]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-02 75008]
"DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-06-12 90112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...10.0.1416" [?]
.
c:\users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-1-18 24246216]
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-11-18 576000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-16 113664]
NETGEAR WG311v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG311v3\wlancfg5.exe [2007-3-5 1679360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2008-09-16 18:16 1833296 –s-a-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
- c:\users\Ana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-30 09:51]
.
2012-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
- c:\users\Ana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-30 09:51]
.
2012-02-12 c:\windows\Tasks\HPCeeScheduleForAna.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-08-25 03:03]
.
2012-02-15 c:\windows\Tasks\User_Feed_Synchronization-{613A91CE-67C1-4421-90F1-050F3F9C0DEE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=84&bd=Pavilion&pf=cndt
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 192.168.0.1 [removed]
FF - ProfilePath - c:\users\Ana\AppData\Roaming\Mozilla\Firefox\Profiles\d5btn3lz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.meebo.com/|http://www.menewsha.com/|http://crysandrea.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 56525
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKLM-Run-1A:Stardock TrayMonitor - (no file)
AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe
AddRemove-{980A182F-E0A2-4A40-94C1-AE0C1235902E} - c:\program files\Pando Networks\Media Booster\uninst.exe
AddRemove-Driver Performer 2010 - c:\program files\Driver Performer\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-15 18:05
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6002 Disk: Hitachi_ rev.GMBO -> Harddisk0\DR0 ->
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys acpi.sys hal.dll >>UNKNOWN [0x863D449F]<<
c:\windows\system32\drivers\PCTCore.sys PC Tools Kernel Driver Suite
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x863db738]; MOV EAX, [0x863db8ac]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x8208C912] -> \Device\Harddisk0\DR0[0x85C0F3F0]
3 CLASSPNP[0x828978B3] -> ntkrnlpa!IofCallDriver[0x8208C912] -> [0x85C0FC58]
5 PCTCore[0x82960099] -> ntkrnlpa!IofCallDriver[0x8208C912] -> [0x851F8B68]
7 acpi[0x8275E6BC] -> ntkrnlpa!IofCallDriver[0x8208C912] -> [0x851D7538]
\Driver\nvstor32[0x862E3860] -> IRP_MJ_CREATE -> 0x863D449F
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x5d; }
detected disk devices:
\Device\00000056 -> \??\SCSI#Disk&Ven_Hitachi&Prod_HDP725016GLA#4&18252d01&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi -> 0x851391f8
user & kernel MBR OK
sectors 312581806 (+7): user != kernel
Warning: possible TDL3 rootkit infection !
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(652)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2012-02-15 18:10:40
ComboFix-quarantined-files.txt 2012-02-16 00:10
.
Pre-Run: 40,928,030,720 bytes free
Post-Run: 41,670,520,832 bytes free
.
- - End Of File - - E10F6CA550B5C945DFE2D633AA8249C4

oldman960

Post #23February 16, 2012, 2:37 AM UTC

Hi anas_dad,

Do you have an example of the web pages where this happens?

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Next

We will be using Combofix again but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/index.php?showtopic=122313&st=15

Collect::
c:\users\Ana\AppData\Roaming\Microsoft\6875\354.exe

Folder::
c:\users\Ana\AppData\Roaming\F3C43
c:\users\Ana\AppData\Roaming\Microsoft\6875
c:\users\Ana\AppData\Roaming\569F3
c:\program files\F3C43

Firefox::
FF - ProfilePath - c:\users\Ana\AppData\Roaming\Mozilla\Firefox\Profiles\d5btn3lz.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 56525

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

Please post back with the combofix log.

anas_dad

Post #24February 16, 2012, 3:33 AM UTC

Tried combofix twice, will not run received error message on spelling so I checked it and tried it again attached are some screen shots #1 is of the error message #2 is of my login page for the forums notice how the words "your account" are double underlined ? If I hover over this I get a pop up ad. thanks, Patrick

Attachments:

oldman960

Post #25February 16, 2012, 6:12 AM UTC

Hi anas_dad,

Try this.

Press the Windows key and the R key. A run box should open. Copy and paste the following into the run box and click ok. (don't miss the " at the beginning and end)

"c:\users\Ana\Desktop\ComboFix.exe" "c:\users\Ana\Desktop\CFScript.txt"

anas_dad

Post #26February 16, 2012, 3:10 PM UTC

Ok, got it to run but the paste feature would not work on the run box so I had to type it in.
Mbam popped up again w/ 2 notices, I've included a screen shot of them.
Still have proxy issues
Below is the combofix log file

ComboFix 12-02-15.01 - Ana 02/16/2012 7:11.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1918.839 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\Combofix.exe
Command switches used :: c:\users\Ana\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Ana\PenTablet_5.2.4-6.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-01-16 to 2012-02-16 )))))))))))))))))))))))))))))))
.
.
2012-02-16 13:27 . 2012-02-16 13:28 ——– d—–w- c:\users\Ana\AppData\Local\temp
2012-02-16 13:27 . 2012-02-16 13:27 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2012-02-16 13:27 . 2012-02-16 13:27 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-02-16 13:27 . 2012-02-16 13:27 ——– d—–w- c:\users\Brie\AppData\Local\temp
2012-02-13 16:37 . 2012-02-13 16:37 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-02-13 16:37 . 2012-02-13 16:37 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-02-13 16:37 . 2012-02-13 16:37 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-02-13 16:37 . 2012-02-13 16:37 45016 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-02-13 16:33 . 2012-02-13 16:33 ——– d—–w- c:\users\Ana\AppData\Roaming\F3C43
2012-02-13 16:31 . 2012-02-13 16:32 282624 —-a-w- c:\users\Ana\AppData\Roaming\Microsoft\6875\354.exe
2012-02-13 16:31 . 2012-02-13 16:45 ——– d—–w- c:\users\Ana\AppData\Roaming\569F3
2012-02-13 14:48 . 2012-02-13 14:48 ——– d—–w- C:\_OTL
2012-02-13 05:02 . 2012-02-13 10:13 ——– d—–w- c:\program files\F3C43
2012-02-12 20:05 . 2012-02-12 20:44 111872 —-a-w- c:\windows\system32\drivers\TrueSight.sys
2012-02-12 09:07 . 2011-10-14 16:03 189952 —-a-w- c:\windows\system32\winmm.dll
2012-02-12 09:07 . 2011-10-14 16:00 23552 —-a-w- c:\windows\system32\mciseq.dll
2012-02-12 09:03 . 2011-10-25 15:58 1314816 —-a-w- c:\windows\system32\quartz.dll
2012-02-12 09:03 . 2011-10-25 15:58 497152 —-a-w- c:\windows\system32\qdvd.dll
2012-02-12 06:33 . 2011-12-01 15:21 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-02-12 01:02 . 2012-02-12 01:02 ——– d—–w- c:\users\Ana\AppData\Roaming\Malwarebytes
2012-02-12 01:02 . 2012-02-12 01:02 ——– d—–w- c:\programdata\Malwarebytes
2012-02-12 01:02 . 2012-02-12 01:02 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-02-12 01:02 . 2011-12-10 21:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-11 23:55 . 2010-07-16 20:59 656320 —-a-w- c:\windows\system32\drivers\pctEFA.sys
2012-02-11 23:55 . 2010-07-16 20:59 338880 —-a-w- c:\windows\system32\drivers\pctDS.sys
2012-02-11 23:55 . 2011-01-17 15:10 251560 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2012-02-11 23:55 . 2010-12-16 14:38 103232 —-a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2012-02-11 23:54 . 2010-12-10 22:57 160448 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2012-02-11 23:54 . 2010-12-10 19:24 239168 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2012-02-11 23:54 . 2010-12-16 14:46 70536 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2012-02-11 23:54 . 2012-02-12 00:34 ——– d—–w- c:\program files\PC Tools Security
2012-02-11 23:54 . 2012-02-12 00:01 ——– d—–w- c:\program files\Common Files\PC Tools
2012-02-11 23:54 . 2012-02-11 23:54 ——– d—–w- c:\users\Ana\AppData\Roaming\PC Tools
2012-02-11 23:47 . 2012-02-11 23:54 ——– d—–w- c:\programdata\PC Tools
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-29 21:45 . 2011-09-02 18:38 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-23 13:37 . 2011-12-14 06:14 2043904 —-a-w- c:\windows\system32\win32k.sys
2012-02-13 16:37 . 2011-06-09 16:19 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Ana\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Ana\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Ana\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2010-06-30 1689144]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-03-21 2937528]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-02 75008]
"DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-06-12 90112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...10.0.1416" [?]
.
c:\users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-1-18 24246216]
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-11-18 576000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-16 113664]
NETGEAR WG311v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG311v3\wlancfg5.exe [2007-3-5 1679360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2008-09-16 18:16 1833296 –s-a-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
- c:\users\Ana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-30 09:51]
.
2012-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
- c:\users\Ana\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-30 09:51]
.
2012-02-12 c:\windows\Tasks\HPCeeScheduleForAna.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-08-25 03:03]
.
2012-02-15 c:\windows\Tasks\User_Feed_Synchronization-{613A91CE-67C1-4421-90F1-050F3F9C0DEE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=84&bd=Pavilion&pf=cndt
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 192.168.0.1 [removed]
FF - ProfilePath - c:\users\Ana\AppData\Roaming\Mozilla\Firefox\Profiles\d5btn3lz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.meebo.com/|http://www.menewsha.com/|http://crysandrea.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 56525
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-16 07:27
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6002 Disk: Hitachi_ rev.GMBO -> Harddisk0\DR0 ->
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys acpi.sys hal.dll
c:\windows\system32\drivers\PCTCore.sys PC Tools Kernel Driver Suite
1 ntkrnlpa!IofCallDriver[0x8208A912] -> \Device\Harddisk0\DR0[0x85B2A820]
3 CLASSPNP[0x8276B8B3] -> ntkrnlpa!IofCallDriver[0x8208A912] -> [0x8570F4D8]
5 PCTCore[0x8286F099] -> ntkrnlpa!IofCallDriver[0x8208A912] -> [0x843E64F0]
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x5d; }
detected disk devices:
\Device\00000054 -> \??\SCSI#Disk&Ven_Hitachi&Prod_HDP725016GLA#4&18252d01&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user & kernel MBR OK
sectors 312581806 (+7): user != kernel
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(640)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2012-02-16 07:31:19
ComboFix-quarantined-files.txt 2012-02-16 13:31
ComboFix2.txt 2012-02-16 00:10
.
Pre-Run: 41,642,844,160 bytes free
Post-Run: 41,615,400,960 bytes free
.
- - End Of File - - 498488F9D055E4C35A8490538291A4A1

Attachments:

📎screen3.jpg

oldman960

Post #27February 16, 2012, 5:08 PM UTC

Hi anas_dad,

Ok we'll try something different. None of the script worked, seems like combfix didn't see it. The MBAM detection was one of the files we were after.

MBAM may be interfering. Please disable it.

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 56525
[2012/02/13 10:32:52 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{7D0CFB31-503B-40BC-9ABB-F72E19779501}
[2012/02/13 10:32:50 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{4AB2A8D6-5FD4-4C12-85FD-610A4D1F5A7F}
[2012/02/11 19:23:58 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{BD1CEDE5-6EF3-4C7A-85D0-A9AC360F0B31}
[2012/02/11 19:23:47 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{9734659A-CD14-4F8D-9671-80982881F240}

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-

:Files
C:\ProgramData\mess iso iso.lwy2o
c:\users\Ana\AppData\Roaming\Microsoft\6875\354.exe
c:\users\Ana\AppData\Roaming\F3C43
c:\users\Ana\AppData\Roaming\Microsoft\6875
c:\users\Ana\AppData\Roaming\569F3
c:\program files\F3C43

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Please post back with

OTL fix log
aswMBR log
mbr.zip {(attached)

anas_dad

Post #28February 16, 2012, 6:26 PM UTC

Oldman 960, OTL stopped working I an back on my laptop so no screen shots The only thing I see is: a) desktop background

sidebar w/ clock c) OTL window (grayed out) d) M/S dialog box "OTL has stopped working" I have not clicked or done anything since I started OTL

oldman960

Post #29February 16, 2012, 7:02 PM UTC

Hi anas_dad,

OTL stalled. You can end it's process via taskmanger. Right click ear the clock and click task manager. click on the applications tab and click on OTL and end task. You can also open task manager by pressing ctrl-alt-del at the same time. If you desktop does not appear normal after ending OTL reboot the computer. The reason the desktop looks like it does is because explorer has been stopped (normal when running some of our tools) along with other processes. Something just did not want to be stopped.

See if OTL will run with just the following script.

:Services

:OTL
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 56525
[2012/02/13 10:32:52 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{7D0CFB31-503B-40BC-9ABB-F72E19779501}
[2012/02/13 10:32:50 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{4AB2A8D6-5FD4-4C12-85FD-610A4D1F5A7F}
[2012/02/11 19:23:58 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{BD1CEDE5-6EF3-4C7A-85D0-A9AC360F0B31}
[2012/02/11 19:23:47 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{9734659A-CD14-4F8D-9671-80982881F240}

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-

:Files
C:\ProgramData\mess iso iso.lwy2o
c:\users\Ana\AppData\Roaming\Microsoft\6875\354.exe
c:\users\Ana\AppData\Roaming\F3C43
c:\users\Ana\AppData\Roaming\Microsoft\6875
c:\users\Ana\AppData\Roaming\569F3
c:\program files\F3C43

If not please go ahead with the aswMBR scan.

anas_dad

Post #30February 16, 2012, 8:38 PM UTC

Ok, I have done both the combo fix and the aswMBR scan. The Mbam was just the free trial. I couldn't figure out how to disable it so I uninstalled it. ========== SERVICES/DRIVERS ========== ========== OTL ========== Prefs.js: "127.0.0.1" removed from network.proxy.http Prefs.js: 56525 removed from network.proxy.http_port Folder C:\Users\Ana\AppData\Local\{7D0CFB31-503B-40BC-9ABB-F72E19779501}\ not found. Folder C:\Users\Ana\AppData\Local\{4AB2A8D6-5FD4-4C12-85FD-610A4D1F5A7F}\ not found. Folder C:\Users\Ana\AppData\Local\{BD1CEDE5-6EF3-4C7A-85D0-A9AC360F0B31}\ not found. Folder C:\Users\Ana\AppData\Local\{9734659A-CD14-4F8D-9671-80982881F240}\ not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\AvgUninstallURL not found. ========== FILES ========== File\Folder C:\ProgramData\mess iso iso.lwy2o not found. File\Folder c:\users\Ana\AppData\Roaming\Microsoft\6875\354.exe not found. File\Folder c:\users\Ana\AppData\Roaming\F3C43 not found. File\Folder c:\users\Ana\AppData\Roaming\Microsoft\6875 not found. File\Folder c:\users\Ana\AppData\Roaming\569F3 not found. File\Folder c:\program files\F3C43 not found. OTL by OldTimer - Version 3.2.31.0 log created on 02162012_132518 aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software Run date: 2012-02-16 13:27:59 —————————– 13:27:59.370 OS Version: Windows 6.0.6002 Service Pack 2 13:27:59.370 Number of processors: 2 586 0x6B02 13:27:59.372 ComputerName: TOBE UserName: Ana 13:28:00.015 Initialize success 14:03:07.562 AVAST engine defs: 12021600 14:03:31.097 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000032 14:03:31.103 Disk 0 Vendor: Hitachi_ GMBO Size: 152627MB BusType: 3 14:03:31.106 Device \Device\00000054 -> \??\SCSI#Disk&Ven_Hitachi&Prod_HDP725016GLA#4&18252d01&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found 14:03:31.110 Disk 0 MBR read error 0 14:03:31.113 Disk 0 MBR scan 14:03:31.143 Disk 0 unknown MBR code 14:03:31.146 MBR BIOS signature not found 0 14:03:31.151 Disk 0 scanning sectors +312576705 14:03:31.193 Disk 0 scanning C:\Windows\system32\drivers 14:03:42.323 Service scanning 14:03:43.729 Modules scanning 14:03:52.679 Disk 0 trace - called modules: 14:03:52.689 ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys acpi.sys hal.dll >>UNKNOWN [0x8645549f]<< 14:03:52.698 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85bf5640] 14:03:52.704 3 CLASSPNP.SYS[827318b3] -> nt!IofCallDriver -> [0x85bf5e40] 14:03:52.712 5 PCTCore.sys[8281f099] -> nt!IofCallDriver -> [0x843a85f8] 14:03:52.719 7 acpi.sys[8260e6bc] -> nt!IofCallDriver -> [0x847b0890] 14:03:52.727 \Driver\nvstor32[0x86423240] -> IRP_MJ_CREATE -> 0x8645549f 14:03:53.252 AVAST engine scan C:\Windows 14:03:56.960 AVAST engine scan C:\Windows\system32 14:04:38.484 File: C:\Windows\system32\jureg.exe **INFECTED** Win32:SMSSend-IG [Trj] 14:07:12.555 AVAST engine scan C:\Windows\system32\drivers 14:07:31.056 AVAST engine scan C:\Users\Ana 14:15:04.907 AVAST engine scan C:\ProgramData 14:17:10.902 Scan finished successfully 14:19:48.200 Disk 0 MBR has been saved successfully to "C:\Users\Ana\Desktop\MBR.dat" 14:19:48.211 The log file has been saved successfully to "C:\Users\Ana\Desktop\aswMBR 2.txt"

Attachments:

📎MBR.zip

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

bad case of system check [Solved]

✨ Ask AI

Ask AI