Spyware / Malware / Virus Removal

Slow response and problems w/ google [Closed]

15 min read

Looking for the outcome? Ask AI

jdcats007

Post #16February 18, 2012, 6:33 PM UTC

I think I finally got it.

ComboFix 12-02-17.02 - Owner 02/18/2012 12:16:17.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.342 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2012-01-18 to 2012-02-18 )))))))))))))))))))))))))))))))
.
.
2012-02-17 15:05 . 2012-02-17 15:05 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2012-02-17 15:05 . 2012-02-17 15:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-02-17 15:05 . 2012-02-17 15:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-02-17 15:05 . 2011-12-10 21:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-16 21:06 . 2012-01-11 19:06 3072 -c—-w- c:\windows\system32\dllcache\iacenc.dll
2012-02-16 21:06 . 2012-01-11 19:06 3072 ——w- c:\windows\system32\iacenc.dll
2012-02-06 19:52 . 2012-02-06 19:52 ——– d—–w- c:\documents and settings\Owner\Application Data\AVG2012
2012-02-06 19:50 . 2012-02-07 01:02 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG2012
2012-01-31 01:39 . 2012-02-18 17:27 134104 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-01-31 01:39 . 2012-02-16 22:17 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-01-31 01:39 . 2012-02-16 22:17 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-01-31 01:39 . 2012-02-18 17:27 97240 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-01-31 01:39 . 2012-02-18 17:27 437208 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-01-31 01:39 . 2012-02-18 17:27 1911768 —-a-w- c:\program files\Mozilla Firefox\mozjs.dll
2012-01-31 01:39 . 2012-02-18 17:27 15832 —-a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2012-01-31 01:39 . 2012-02-18 17:27 801752 —-a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-01-31 01:39 . 2012-02-18 17:27 45016 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-31 01:39 . 2012-02-16 22:17 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-31 01:39 . 2012-02-16 22:17 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-31 01:39 . 2012-02-16 22:17 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 16:54 . 2008-04-25 20:33 1869056 —-a-w- c:\windows\system32\win32k.sys
2011-12-17 19:46 . 2008-04-25 20:33 916992 —-a-w- c:\windows\system32\wininet.dll
2011-12-17 19:46 . 2008-04-25 20:33 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-12-17 19:46 . 2008-04-25 20:33 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-12-16 12:22 . 2008-04-25 20:33 385024 —-a-w- c:\windows\system32\html.iec
2011-11-25 21:57 . 2008-04-25 20:33 293376 —-a-w- c:\windows\system32\winsrv.dll
2012-02-18 17:27 . 2012-01-31 01:39 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-05-26 488960]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-30 17529856]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-04-06 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-04-06 348160]
"PersistenceThread"="c:\windows\system32\PersistenceThread.exe" [2009-04-06 86016]
"OA012Mon"="c:\windows\OA012Mon.exe" [2009-04-02 24576]
"WSED"="c:\program files\WSED\WSED.exe" [2009-05-27 247080]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2008-11-05 623912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-02-18 2441216]
"CapsLKNotify"="c:\program files\CapsLKNotify\CapsLKNotify.exe" [2009-03-17 320808]
"PCMAgent"="c:\program files\Dell\Media Experience\PCMAgent.exe" [2008-12-11 148776]
"CLMLServer"="c:\program files\Dell\Media Experience\Kernel\CLML\CLMLSvc.exe" [2008-12-11 202024]
"PlayMovie"="c:\program files\Dell\PlayMovie\PMVService.exe" [2008-12-11 177384]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell Video Chat\\DellVideoChat.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [9/13/2010 4:27 PM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/7/2010 3:48 AM 32592]
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [8/28/2009 9:59 PM 14248]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [9/7/2010 3:48 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/7/2010 3:49 AM 295248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [8/19/2010 9:42 PM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [8/19/2010 9:42 PM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [8/19/2010 9:42 PM 16720]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [8/28/2009 10:05 PM 143840]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [8/29/2009 12:28 AM 93952]
R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [8/29/2009 12:28 AM 5088896]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [8/29/2009 12:28 AM 110080]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [8/29/2009 12:28 AM 135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [8/29/2009 12:28 AM 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [8/29/2009 12:28 AM 272032]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [8/29/2009 12:28 AM 157696]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4433248]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8/29/2009 12:28 AM 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/7/2008 11:23 AM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [5/9/2008 10:08 AM 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [3/20/2009 6:03 PM 32408]
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5fin9ofu.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/?loc=IB_DS&a=6OyoCjQ87S&&i=26&search=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-18 12:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1120)
c:\windows\System32\BCMLogon.dll
c:\windows\system32\l3codeca.acm
c:\windows\system32\sirenacm.dll
.
- - - - - - - > 'explorer.exe'(2612)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-02-18 12:26:34
ComboFix-quarantined-files.txt 2012-02-18 18:26
ComboFix2.txt 2012-02-17 15:01
ComboFix3.txt 2012-02-16 22:16
.
Pre-Run: 125,414,252,544 bytes free
Post-Run: 125,403,725,824 bytes free
.
- - End Of File - - EE2B8D9CC3EF08E2CC48B1DC0C7CCB17

jdcats007

Post #17February 18, 2012, 6:57 PM UTC

Here is the log from he latest virus scan aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software Run date: 2012-02-18 12:31:31 —————————– 12:31:31.937 OS Version: Windows 5.1.2600 Service Pack 3 12:31:31.937 Number of processors: 2 586 0x1C02 12:31:31.937 ComputerName: FAMILY UserName: Owner 12:31:33.515 Initialize success 12:35:10.531 AVAST engine defs: 12021800 12:35:16.125 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 12:35:16.140 Disk 0 Vendor: SAMSUNG_HM160HI HH100-15 Size: 152627MB BusType: 3 12:35:16.171 Disk 0 MBR read successfully 12:35:16.171 Disk 0 MBR scan 12:35:16.218 Disk 0 Windows VISTA default MBR code 12:35:16.218 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63 12:35:16.250 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 152586 MB offset 81920 12:35:16.265 Disk 0 scanning sectors +312579760 12:35:16.390 Disk 0 scanning C:\WINDOWS\system32\drivers 12:35:30.218 Service scanning 12:35:31.531 Modules scanning 12:35:40.843 Disk 0 trace - called modules: 12:35:40.890 ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 12:35:40.906 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86b2cab8] 12:35:40.921 3 CLASSPNP.SYS[f763dfd7] -> nt!IofCallDriver -> \Device\00000066[0x86b2e9e8] 12:35:40.921 5 ACPI.sys[f74d4620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86b73940] 12:35:41.875 AVAST engine scan C:\WINDOWS 12:35:58.937 AVAST engine scan C:\WINDOWS\system32 12:40:12.671 AVAST engine scan C:\WINDOWS\system32\drivers 12:40:36.000 AVAST engine scan C:\Documents and Settings\Owner 12:45:53.265 AVAST engine scan C:\Documents and Settings\All Users 12:48:21.515 Scan finished successfully 12:55:55.734 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\Desktop\MBR.dat" 12:55:55.750 The log file has been saved successfully to "C:\Documents and Settings\Owner\Desktop\aswMBR3.txt"

Satchfan

Post #18February 19, 2012, 11:19 AM UTC

There doesn’t appear to be much in your logs except remnants of Incredibar so let's remove that and have a fresh look with OTL

Open ComboFix

Please do the following:

close any open browsers.
close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
open notepad and copy/paste the text in the codebox below into it:

Firefox:: FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5fin9ofu.default\ FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/?loc=IB_DS&a=6OyoCjQ87S&&i=26&search=

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

===========================================

Re-run OTL

open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
post the OTL.txt log it produces in your next reply.

Please post back with the log and the ComboFix log.

Can you also tell me how your computer is running now.

Thanks

Satchfan

jdcats007

Post #19February 20, 2012, 2:08 PM UTC

The system is running alot smoother than before. Thanks

ComboFix 12-02-17.02 - Owner 02/19/2012 18:59:42.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.383 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2012-01-20 to 2012-02-20 )))))))))))))))))))))))))))))))
.
.
2012-02-17 15:05 . 2012-02-17 15:05 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2012-02-17 15:05 . 2012-02-17 15:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-02-17 15:05 . 2012-02-17 15:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-02-17 15:05 . 2011-12-10 21:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-16 21:06 . 2012-01-11 19:06 3072 -c—-w- c:\windows\system32\dllcache\iacenc.dll
2012-02-16 21:06 . 2012-01-11 19:06 3072 ——w- c:\windows\system32\iacenc.dll
2012-02-06 19:52 . 2012-02-06 19:52 ——– d—–w- c:\documents and settings\Owner\Application Data\AVG2012
2012-02-06 19:50 . 2012-02-07 01:02 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG2012
2012-01-31 01:39 . 2012-02-18 17:27 134104 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-01-31 01:39 . 2012-02-16 22:17 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-01-31 01:39 . 2012-02-16 22:17 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-01-31 01:39 . 2012-02-18 17:27 97240 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-01-31 01:39 . 2012-02-18 17:27 437208 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-01-31 01:39 . 2012-02-18 17:27 1911768 —-a-w- c:\program files\Mozilla Firefox\mozjs.dll
2012-01-31 01:39 . 2012-02-18 17:27 15832 —-a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2012-01-31 01:39 . 2012-02-18 17:27 801752 —-a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-01-31 01:39 . 2012-02-18 17:27 45016 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-31 01:39 . 2012-02-16 22:17 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-31 01:39 . 2012-02-16 22:17 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-31 01:39 . 2012-02-16 22:17 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 16:54 . 2008-04-25 20:33 1869056 —-a-w- c:\windows\system32\win32k.sys
2011-12-17 19:46 . 2008-04-25 20:33 916992 —-a-w- c:\windows\system32\wininet.dll
2011-12-17 19:46 . 2008-04-25 20:33 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-12-17 19:46 . 2008-04-25 20:33 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-12-16 12:22 . 2008-04-25 20:33 385024 —-a-w- c:\windows\system32\html.iec
2011-11-25 21:57 . 2008-04-25 20:33 293376 —-a-w- c:\windows\system32\winsrv.dll
2012-02-18 17:27 . 2012-01-31 01:39 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-05-26 488960]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-30 17529856]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-04-06 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-04-06 348160]
"PersistenceThread"="c:\windows\system32\PersistenceThread.exe" [2009-04-06 86016]
"OA012Mon"="c:\windows\OA012Mon.exe" [2009-04-02 24576]
"WSED"="c:\program files\WSED\WSED.exe" [2009-05-27 247080]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2008-11-05 623912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-02-18 2441216]
"CapsLKNotify"="c:\program files\CapsLKNotify\CapsLKNotify.exe" [2009-03-17 320808]
"PCMAgent"="c:\program files\Dell\Media Experience\PCMAgent.exe" [2008-12-11 148776]
"CLMLServer"="c:\program files\Dell\Media Experience\Kernel\CLML\CLMLSvc.exe" [2008-12-11 202024]
"PlayMovie"="c:\program files\Dell\PlayMovie\PMVService.exe" [2008-12-11 177384]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell Video Chat\\DellVideoChat.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [9/13/2010 4:27 PM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/7/2010 3:48 AM 32592]
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [8/28/2009 9:59 PM 14248]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [9/7/2010 3:48 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/7/2010 3:49 AM 295248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [8/19/2010 9:42 PM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [8/19/2010 9:42 PM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [8/19/2010 9:42 PM 16720]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [8/28/2009 10:05 PM 143840]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [8/29/2009 12:28 AM 93952]
R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [8/29/2009 12:28 AM 5088896]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [8/29/2009 12:28 AM 110080]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [8/29/2009 12:28 AM 135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [8/29/2009 12:28 AM 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [8/29/2009 12:28 AM 272032]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [8/29/2009 12:28 AM 157696]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4433248]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8/29/2009 12:28 AM 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/7/2008 11:23 AM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [5/9/2008 10:08 AM 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [3/20/2009 6:03 PM 32408]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - aswMBR
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5fin9ofu.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-19 19:07
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1120)
c:\windows\System32\BCMLogon.dll
c:\windows\system32\l3codeca.acm
c:\windows\system32\sirenacm.dll
.
- - - - - - - > 'explorer.exe'(236)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-02-19 19:10:44
ComboFix-quarantined-files.txt 2012-02-20 01:10
ComboFix2.txt 2012-02-18 18:26
ComboFix3.txt 2012-02-17 15:01
ComboFix4.txt 2012-02-16 22:16
.
Pre-Run: 125,547,757,568 bytes free
Post-Run: 125,592,952,832 bytes free
.
- - End Of File - - CC2BAB202B36A68EBEA741C726FB4766

OTL logfile created on: 2/19/2012 7:27:21 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.20 Mb Total Physical Memory | 275.34 Mb Available Physical Memory | 27.15% Memory free
2.38 Gb Paging File | 1.58 Gb Available in Paging File | 66.33% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.01 Gb Total Space | 116.99 Gb Free Space | 78.51% Space Free | Partition Type: NTFS

Computer Name: FAMILY | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\WSED\WSED.exe (Dell)
PRC - C:\WINDOWS\system32\PersistenceThread.exe (Intel Corporation)
PRC - C:\WINDOWS\OA012Mon.exe (Creative Technology Ltd.)
PRC - C:\Program Files\Dell\PlayMovie\PMVService.exe (CyberLink Corp.)
PRC - C:\Program Files\Dell\Media Experience\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files\Dell\Media Experience\PCMAgent.exe (CyberLink Corp.)
PRC - C:\Program Files\Battery Meter\BTMeter.exe (Dell)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Works\WksWP.exe (Microsoft® Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\77e1279cbf4eecfb0284b63316fe43fe\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\9e3803cd2a11f056291862e306a8e2b2\System.ni.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\WINDOWS\system32\preflib.dll ()
MOD - C:\WINDOWS\system32\bcm1xsup.dll ()
MOD - C:\WINDOWS\system32\EMSC.DLL ()
MOD - C:\Program Files\Dell\Media Experience\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Program Files\Dell\Media Experience\Kernel\CLML\CLMLSvcPS.dll ()
MOD - C:\WINDOWS\system32\tsd32.dll ()

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)

========== Driver Services (SafeList) ==========

DRV - (catchme) – File not found
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (IntcHdmiAddService) Intel® – C:\WINDOWS\system32\drivers\IntcHdmi.sys (Intel® Corporation)
DRV - (OA012Vid) – C:\WINDOWS\system32\drivers\OA012Vid.sys (Creative Technology Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (SMSIVZAM5) – C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (OA012Afx) – C:\WINDOWS\system32\drivers\OA012Afx.sys (Creative Technology Ltd.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (CtClsFlt) – C:\WINDOWS\system32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (OA012Ufd) – C:\WINDOWS\system32\drivers\OA012Ufd.sys (Creative Technology Ltd.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (RSUSBSTOR) – C:\WINDOWS\system32\drivers\RTS5121.sys (Realtek Semiconductor Corp.)
DRV - (EMSC) – C:\WINDOWS\system32\DRIVERS\EMSC.SYS (Windows ® Codename Longhorn DDK provider)
DRV - (NWUSBCDFIL) – C:\WINDOWS\system32\drivers\NwUsbCdFil.sys (Novatel Wireless Inc.)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (NWUSBPort2) – C:\WINDOWS\system32\drivers\nwusbser2.sys (Novatel Wireless Inc.)
DRV - (NWUSBPort) – C:\WINDOWS\system32\drivers\nwusbser.sys (Novatel Wireless Inc.)
DRV - (NWUSBModem) – C:\WINDOWS\system32\drivers\nwusbmdm.sys (Novatel Wireless Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USCON/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1416

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/02/06 13:54:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/18 11:27:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/17 08:39:19 | 000,000,000 | —D | M]

[2009/12/13 00:04:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2012/01/30 19:11:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5fin9ofu.default\extensions
[2010/06/14 18:49:02 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\5fin9ofu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/03/21 17:28:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/02/18 11:27:49 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 16:17:29 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 16:17:29 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/02/16 16:12:14 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BTMeter] C:\Program Files\Battery Meter\BTMeter.exe (Dell)
O4 - HKLM..\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe (Compal Electronics, Inc)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Dell\Media Experience\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [OA012Mon] C:\WINDOWS\OA012Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PCMAgent] C:\Program Files\Dell\Media Experience\PCMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PersistenceThread] C:\WINDOWS\System32\PersistenceThread.exe (Intel Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Dell\PlayMovie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WSED] C:\Program Files\WSED\WSED.exe (Dell)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C903EF9D-59D2-45BA-82E3-79119B693D18}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 19:45:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/18 11:33:09 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/02/18 11:33:09 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/02/18 11:33:09 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/02/18 11:33:09 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/02/18 11:31:25 | 004,406,994 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2012/02/17 09:05:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2012/02/17 09:05:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/17 09:05:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/02/17 09:05:44 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/02/17 09:05:44 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/02/17 08:38:08 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/02/16 15:13:47 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/02/16 15:09:25 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2012/02/16 15:09:17 | 000,000,000 | —D | C] – C:\Qoobox
[2012/02/16 08:32:43 | 004,733,440 | —- | C] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2012/02/15 09:58:47 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Identities
[2012/02/15 09:29:45 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/02/07 19:06:31 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2012/02/07 19:06:24 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2012/02/07 18:41:27 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2012/02/07 18:18:04 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/02/07 18:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/02/06 13:54:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2012
[2012/02/06 13:52:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG2012
[2012/02/06 13:50:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG2012
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/19 15:05:29 | 000,012,972 | —- | M] () – C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2012/02/19 08:34:16 | 089,457,073 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/02/18 12:55:55 | 000,000,512 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2012/02/18 11:31:32 | 004,406,994 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2012/02/17 17:28:27 | 000,175,893 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/02/17 09:05:46 | 000,000,786 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/17 08:39:22 | 000,001,731 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/02/17 03:27:50 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/02/17 03:27:41 | 000,167,504 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/17 03:27:40 | 1063,538,688 | -HS- | M] () – C:\hiberfil.sys
[2012/02/17 03:05:36 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/02/17 01:47:44 | 000,032,213 | —- | M] () – C:\Documents and Settings\Owner\Desktop\batman logo+bat+man+logo 5.jpg
[2012/02/17 00:00:30 | 000,163,705 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Batman_Logo_.jpg
[2012/02/16 16:12:14 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/02/16 15:13:53 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/02/16 08:33:27 | 004,733,440 | —- | M] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2012/02/16 03:05:02 | 000,443,482 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/02/16 03:05:02 | 000,072,582 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/02/15 09:29:52 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/02/14 11:45:26 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/02/13 08:07:55 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/02/09 17:35:08 | 000,024,064 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Hutchens_Resume works.wps
[2012/02/06 13:54:35 | 000,000,704 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2012/01/28 10:08:09 | 000,013,459 | —- | M] () – C:\Documents and Settings\Owner\Desktop\2890_batman_symbol__43108.jpg
[2012/01/26 18:14:02 | 000,012,288 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/18 11:33:09 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/02/18 11:33:09 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/02/18 11:33:09 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/02/18 11:33:09 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/02/18 11:33:09 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/02/17 09:05:46 | 000,000,786 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/17 08:39:21 | 000,001,731 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/02/17 08:39:19 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 9.lnk
[2012/02/17 01:47:42 | 000,032,213 | —- | C] () – C:\Documents and Settings\Owner\Desktop\batman logo+bat+man+logo 5.jpg
[2012/02/17 00:00:27 | 000,163,705 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Batman_Logo_.jpg
[2012/02/16 15:13:53 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/02/16 15:13:50 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/02/16 15:06:18 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/16 15:06:18 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\dllcache\iacenc.dll
[2012/02/16 08:47:48 | 000,000,512 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MBR.dat
[2012/02/06 13:54:35 | 000,000,704 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2012/01/30 19:39:21 | 000,000,666 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/01/28 10:08:06 | 000,013,459 | —- | C] () – C:\Documents and Settings\Owner\Desktop\2890_batman_symbol__43108.jpg
[2010/12/10 00:50:10 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/02/10 17:20:53 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2010/01/23 22:30:59 | 000,012,972 | —- | C] () – C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2009/12/20 21:53:40 | 000,012,288 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/13 01:07:07 | 000,000,164 | —- | C] () – C:\WINDOWS\install.dat
[2009/12/13 00:04:07 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/08/29 00:28:56 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2009/08/29 00:28:34 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\igdlogin.dll
[2009/08/29 00:25:03 | 000,001,155 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2009/08/28 22:24:09 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/08/28 22:06:37 | 000,000,075 | RHS- | C] () – C:\WINDOWS\CT4CET.bin
[2009/08/28 22:01:01 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2009/08/28 22:01:00 | 000,025,088 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2009/08/28 22:00:59 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/08/28 21:59:14 | 000,577,536 | —- | C] () – C:\WINDOWS\System32\EMSC.DLL
[2008/04/25 19:47:34 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 19:44:05 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 19:42:57 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 14:33:19 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 14:33:18 | 000,443,482 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 14:33:18 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 14:33:18 | 000,072,582 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 14:33:18 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 14:33:17 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 14:33:17 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 14:33:16 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 14:33:14 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 14:33:14 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 14:33:10 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 14:33:06 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 07:39:19 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 07:38:33 | 000,167,504 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2006/09/28 14:55:34 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\PhysXLoader.dll
[2006/09/26 14:01:40 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2006/09/08 09:01:50 | 000,045,056 | R— | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll

========== LOP Check ==========

[2012/02/06 19:02:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2010/11/13 10:17:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2011/11/13 17:17:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canon IJ Network Tool
[2011/11/10 03:44:57 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/12/19 16:31:58 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonIJScan
[2010/12/10 00:53:32 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2009/10/03 13:47:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Geek Squad
[2012/02/19 08:34:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2009/08/28 22:04:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCDr
[2009/08/28 22:04:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/08/28 21:59:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vista32
[2009/08/28 21:59:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vista64
[2009/08/28 22:07:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\XP32
[2010/06/29 11:17:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/13 02:11:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2012/02/06 13:52:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG2012
[2011/12/19 16:31:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Canon
[2011/10/10 18:48:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Pokemon Online
[2009/08/28 22:11:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PowerCinema
[2011/05/28 11:35:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Smith Micro
[2010/02/22 11:16:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template
[2009/10/03 13:35:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Windows Search

========== Purity Check ==========

< End of report >

Satchfan

Post #20February 20, 2012, 3:47 PM UTC

That’s looking good and as things are running well I think we’re nearly there.

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL FF - prefs.js..browser.search.defaultenginename: "MyStart Search" :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

================================================

Run Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

================================================

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Please let me know if there are any remaining problems

Logs to include in the next post:

OTL fix log
New OTL log
checkup.txt

Satchfan

Satchfan

Post #21February 23, 2012, 12:20 PM UTC

Hello jdcats007 It has been several days since my last response. Please let me know if you are having a problem and still need help. Satchfan

jdcats007

Post #22February 23, 2012, 4:31 PM UTC

Sorry for the delay. I ran the test but when my system rebooted I lost the logs. Do you know where they are saved? Also I am using AVG virus software (free edition) and it will only allow me to temporarily turn off the service for 15 mins and the last scan took over an hour. Would that coming back on mess it up?

Satchfan

Post #23February 23, 2012, 4:48 PM UTC

The OTL fix log can be found at C:\_OTL\MovedFiles. The file name will consist of numbers that reflect the date and time the fix was run. It will be something like 20022012_111009.log.

==================================

Also I am using AVG virus software (free edition) and it will only allow me to temporarily turn off the service for 15 mins and the last scan took over an hour. Would that coming back on mess it up?

Yes, very likely.

The log created by the Eset scan can be found here:

C:\Program Files\ESET\EsetOnlineScanner\log.txt

If it didn’t work properly, I suggest you temporarily uninstall AVG and re-install it when the scan is finished. The Eset scan is important to make sure that there is nothing left.

Satchfan

Satchfan

Post #24February 27, 2012, 4:17 PM UTC

Are you still with us?

Satchfan

Post #25March 1, 2012, 8:47 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Slow response and problems w/ google [Closed]

✨ Ask AI

Ask AI