Spyware / Malware / Virus Removal

searchnu.com/406 [Solved]

27 min read

Looking for the outcome? Ask AI

catofisher Topic Starter

Post #1March 15, 2012, 12:47 PM UTC

hello
i've managed to download this on both our computers from ilivid
this computer is running xp the other is windows 7
here is the otl log:

OTL logfile created on: 15/03/2012 12:15:48 - Run 2
OTL by OldTimer - Version 3.2.37.0 Folder = C:\Documents and Settings\dad\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.11 Mb Total Physical Memory | 236.05 Mb Available Physical Memory | 23.28% Memory free
2.38 Gb Paging File | 1.73 Gb Available in Paging File | 72.57% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 33.56 Gb Free Space | 45.03% Space Free | Partition Type: NTFS

Computer Name: MICHAEL-77DA7CF | User Name: dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\dad\My Documents\Downloads\OTL(2).exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark)
PRC - C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\lxdxcoms.exe ( )
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12031500\algo.dll ()
MOD - C:\Program Files\AVAST Software\Avast\defs\12031400\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QtNetwork4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdxdrpp.dll ()

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (GuffinsService) – C:\Program Files\Guffins\bar\1.bin\u4barsvc.exe (COMPANYVERS_NAME)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (lxdx_device) – C:\WINDOWS\system32\lxdxcoms.exe ( )

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (RT73) – system32\DRIVERS\rt73.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (cerc6) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (LVUVC) Logitech Webcam C210(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9bd172ba-3f40-4303-bca1-0484b5ba2a7b}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKCU\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=283&systemid=406&sr=0&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\1.bin\NPu4Stub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/12/03 20:49:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Guffins\bar\1.bin [2012/01/29 10:07:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/03 18:32:16 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/11/13 09:58:46 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\dad\Application Data\Mozilla\Extensions
[2012/03/03 18:45:39 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\dad\Application Data\Mozilla\Firefox\Profiles\qf9fxed2.default\extensions
[2012/03/03 18:45:39 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\dad\Application Data\Mozilla\Firefox\Profiles\qf9fxed2.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/03/10 13:39:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/03/07 17:10:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\[removed]
[2012/02/16 14:55:34 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 11:08:43 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/02/16 10:48:01 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 11:08:43 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/02/16 11:08:43 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/03/07 16:19:05 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/02/16 11:08:43 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2008/04/14 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Toolbar BHO) - {a916eefe-6a17-4d7d-a131-2738b260bb55} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark)
O2 - BHO: (Search Assistant BHO) - {d6a34acb-76fa-4a14-88ea-5d54797a2028} - C:\Program Files\Guffins\bar\1.bin\u4SrcAs.dll (MindSpark)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME)
O4 - HKLM..\Run: [Guffins Search Scope Monitor] C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://tbedits.guffins.com/one-toolbaredit…mp;n=2012013112 File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{03DE02F7-6964-484B-A273-43CF0557253B}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\dad\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\dad\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/10/30 17:38:23 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/03/12 00:50:22 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2012/03/11 09:31:32 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2012/03/11 09:31:32 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2012/03/10 14:21:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2012/03/10 13:37:29 | 000,000,000 | —D | C] – C:\Documents and Settings\dad\Local Settings\Application Data\PackageAware
[2012/03/10 11:28:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2012/03/10 11:28:04 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2012/03/07 23:40:48 | 000,000,000 | —D | C] – C:\Documents and Settings\dad\Application Data\Sun
[2012/03/07 17:11:33 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2012/03/07 17:11:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2012/03/07 17:11:21 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/03/07 17:10:30 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2012/03/07 17:10:29 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2012/03/07 17:10:29 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2012/03/07 17:10:29 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2012/03/07 17:10:29 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2012/03/07 17:10:04 | 000,000,000 | —D | C] – C:\Program Files\Java
[2012/03/07 17:07:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\GrooveDown
[2012/03/07 17:06:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\TuneUp Companion
[2012/03/07 17:04:56 | 000,000,000 | —D | C] – C:\Program Files\TuneUpMedia
[2012/03/07 17:04:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TuneUpMedia
[2012/03/07 17:01:49 | 000,000,000 | —D | C] – C:\Downloads
[2012/03/07 17:01:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Orbit
[2012/03/07 17:01:25 | 000,000,000 | —D | C] – C:\Program Files\Orbitdownloader
[2012/03/07 16:19:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2012/02/29 10:43:59 | 000,172,032 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxres.dll
[2012/02/29 10:30:16 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2012/02/29 10:29:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Punto Switcher
[2012/02/29 10:29:45 | 000,000,000 | —D | C] – C:\Program Files\Punto Switcher
[2012/02/29 10:28:28 | 000,000,000 | —D | C] – C:\Program Files\Opera
[2012/02/29 10:27:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\WinDjView
[2012/02/29 10:27:44 | 000,000,000 | —D | C] – C:\Program Files\WinDjView
[2012/02/29 10:27:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2012/02/29 10:27:24 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/02/29 10:27:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/02/29 10:26:56 | 000,839,680 | —- | C] (http://www.mp3dev.org/) – C:\WINDOWS\System32\lameACM.acm
[2012/02/29 10:26:50 | 000,237,568 | —- | C] (www.helixcommunity.org) – C:\WINDOWS\System32\yv12vfw.dll
[2012/02/29 10:26:50 | 000,151,552 | —- | C] (fccHandler) – C:\WINDOWS\System32\ac3acm.acm
[2012/02/29 10:26:37 | 000,000,000 | —D | C] – C:\Program Files\K-Lite Codec Pack
[2012/02/29 10:20:06 | 000,920,088 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\igxpun.exe
[2012/02/29 10:20:06 | 000,000,000 | —D | C] – C:\WINDOWS\System32\x64
[2012/02/29 10:17:10 | 000,319,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\difxapi.dll
[2012/02/29 10:16:05 | 000,172,032 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrslv.lrc
[2012/02/29 10:16:04 | 000,176,128 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrsky.lrc
[2012/02/29 10:15:51 | 000,122,880 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxcpl.cpl
[2012/02/29 10:15:49 | 000,151,040 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxpgd32.dll
[2012/02/29 10:15:49 | 000,057,344 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxprd32.dll
[2012/02/29 10:15:48 | 002,643,968 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxpdx32.dll
[2012/02/29 10:15:48 | 001,670,144 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxpdv32.dll
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/03/15 12:15:00 | 000,000,982 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1005UA.job
[2012/03/15 12:12:00 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1007UA.job
[2012/03/15 08:22:31 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/03/15 08:21:33 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/03/14 16:42:56 | 000,000,654 | —- | M] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010301.JPG.lnk
[2012/03/14 16:42:33 | 000,000,654 | —- | M] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010298.JPG.lnk
[2012/03/14 08:11:58 | 000,090,296 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/03/14 01:17:42 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/03/14 00:15:01 | 000,000,930 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1005Core.job
[2012/03/13 19:12:03 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1007Core.job
[2012/03/07 21:11:38 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/03/07 17:10:12 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2012/03/07 17:10:12 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2012/03/07 17:10:12 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2012/03/07 17:10:12 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2012/03/07 17:10:12 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2012/03/03 18:32:18 | 000,000,742 | —- | M] () – C:\Documents and Settings\dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/29 10:27:41 | 000,312,172 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/02/29 10:27:41 | 000,040,394 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/02/23 10:34:10 | 000,022,016 | —- | M] () – C:\Documents and Settings\dad\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/16 14:40:15 | 000,000,754 | —- | M] () – C:\WINDOWS\WORDPAD.INI
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/03/14 16:42:56 | 000,000,654 | —- | C] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010301.JPG.lnk
[2012/03/14 16:42:33 | 000,000,654 | —- | C] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010298.JPG.lnk
[2012/03/03 18:32:18 | 000,000,742 | —- | C] () – C:\Documents and Settings\dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/03/03 18:32:18 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/02/29 10:27:05 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2012/02/29 10:27:04 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2012/02/29 10:26:56 | 000,000,414 | —- | C] () – C:\WINDOWS\System32\lame_acm.xml
[2012/02/29 10:26:49 | 000,810,496 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/02/29 10:26:49 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/02/29 10:26:49 | 000,080,896 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2012/02/29 10:15:48 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2012/02/15 11:02:59 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/15 11:02:59 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\dllcache\iacenc.dll
[2012/01/08 09:28:45 | 000,022,016 | —- | C] () – C:\Documents and Settings\dad\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/28 21:13:58 | 001,105,920 | —- | C] ( ) – C:\WINDOWS\System32\lxdxserv.dll
[2011/12/28 21:13:58 | 000,843,776 | —- | C] ( ) – C:\WINDOWS\System32\lxdxusb1.dll
[2011/12/28 21:13:58 | 000,053,248 | —- | C] ( ) – C:\WINDOWS\System32\lxdxprox.dll
[2011/12/28 21:13:58 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxdxvs.dll
[2011/12/28 21:13:57 | 000,663,552 | —- | C] ( ) – C:\WINDOWS\System32\lxdxhbn3.dll
[2011/12/28 21:13:57 | 000,647,168 | —- | C] ( ) – C:\WINDOWS\System32\lxdxpmui.dll
[2011/12/28 21:13:57 | 000,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxdxinpa.dll
[2011/12/28 21:13:57 | 000,339,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdxiesc.dll
[2011/12/28 21:13:57 | 000,315,392 | —- | C] ( ) – C:\WINDOWS\System32\lxdxih.exe
[2011/12/28 21:13:57 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxdxgrd.dll
[2011/12/28 21:13:56 | 000,851,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcomc.dll
[2011/12/28 21:13:56 | 000,589,824 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcoms.exe
[2011/12/28 21:13:56 | 000,376,832 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcomm.dll
[2011/12/28 21:13:56 | 000,360,448 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcfg.exe
[2011/12/28 21:13:55 | 000,569,344 | —- | C] ( ) – C:\WINDOWS\System32\lxdxlmpm.dll
[2011/12/28 21:09:35 | 000,782,336 | —- | C] () – C:\WINDOWS\System32\lxdxdrs.dll
[2011/12/28 21:09:35 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\lxdxcaps.dll
[2011/12/28 21:09:35 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\lxdxcnv4.dll
[2011/11/18 14:41:52 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2011/11/12 19:40:51 | 000,012,736 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/10/30 20:21:56 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2011/10/30 19:23:41 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/30 17:41:28 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/10/30 17:34:36 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/10/30 17:24:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/10/30 17:23:16 | 000,090,296 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/10 02:45:32 | 000,102,744 | —- | C] () – C:\WINDOWS\System32\LogiDPPApp.exe
[2010/11/10 02:45:30 | 010,871,128 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2010/11/10 02:45:20 | 000,316,248 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2010/11/10 02:31:42 | 000,026,286 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/05/07 18:46:36 | 000,014,168 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2010/05/07 18:43:30 | 000,025,824 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys

========== LOP Check ==========

[2011/11/01 11:07:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/03/09 08:20:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2012/03/14 08:19:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUpMedia
[2011/11/12 19:28:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/11/18 20:37:52 | 000,000,000 | —D | M] – C:\Documents and Settings\dad\Application Data\PacificPoker

========== Purity Check ==========

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.* >
[2011/10/30 17:38:23 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/10/30 17:30:52 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2011/10/30 19:37:13 | 000,222,620 | —- | M] () – C:\chipset.log
[2011/10/30 17:38:23 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/10/30 17:38:23 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/10/30 17:38:23 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 12:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 12:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/03/15 08:21:28 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2011/10/30 19:37:19 | 000,000,047 | —- | M] () – C:\vga.log

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2011/10/30 17:37:55 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/10/16 18:12:46 | 000,147,968 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdxdrpp.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/11/28 18:01:25 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2011/10/30 17:22:21 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2011/10/30 17:22:21 | 001,089,536 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2011/10/30 17:22:21 | 000,909,312 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/10/30 17:38:32 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/11/13 09:58:20 | 000,000,060 | -HS- | M] () – C:\Documents and Settings\dad\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2011/11/13 09:58:20 | 000,000,079 | —- | M] () – C:\Documents and Settings\dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-03-14 01:21:01

< End of report >
hope you can help

JonTom

Post #2March 15, 2012, 4:39 PM UTC

Hello catofisher and

My name is JonTom

Malware Logs can sometimes take a lot of time to research and interpret.
Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

i've managed to download this on both our computers

Please keep both computers isolated from each other while we clean them.

We will deal with this one (XP) first and then once it is clean, we'll take a look at the Win 7 machine.

Before we begin I would like to see the log created from the following scan:

aswMBR
Download aswMBR.exe to your desktop.
Double click the aswMBR.exe to run it.
When asked if you want to download Avast's virus definitions please select Yes.
Click the "Scan" button to start scan.

[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply.

[external image: Posted Image]

Please post the aswMBR log in your next reply.

catofisher

Post #3March 16, 2012, 12:49 PM UTC

hi jon tom thanks for your time….here is the text: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-03-16 12:26:15 —————————– 12:26:15.609 OS Version: Windows 5.1.2600 Service Pack 3 12:26:15.609 Number of processors: 2 586 0xE0C 12:26:15.609 ComputerName: MICHAEL-77DA7CF UserName: dad 12:26:18.718 Initialize success 12:26:20.265 AVAST engine defs: 12031600 12:27:44.406 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e 12:27:44.406 Disk 0 Vendor: Hitachi_HTS541280H9SA00 HP3OC20F Size: 76319MB BusType: 3 12:27:44.437 Disk 0 MBR read successfully 12:27:44.437 Disk 0 MBR scan 12:27:44.531 Disk 0 Windows XP default MBR code 12:27:44.531 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76308 MB offset 63 12:27:44.546 Disk 0 scanning sectors +156280320 12:27:44.625 Disk 0 scanning C:\WINDOWS\system32\drivers 12:27:58.015 Service scanning 12:28:15.343 Modules scanning 12:28:26.468 Disk 0 trace - called modules: 12:28:26.468 12:28:27.109 AVAST engine scan C:\WINDOWS 12:28:41.890 AVAST engine scan C:\WINDOWS\system32 12:31:07.140 AVAST engine scan C:\WINDOWS\system32\drivers 12:31:18.562 AVAST engine scan C:\Documents and Settings\dad 12:39:07.390 AVAST engine scan C:\Documents and Settings\All Users 12:39:46.687 Scan finished successfully 12:41:08.015 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\dad\Desktop\MBR.dat" 12:41:08.015 The log file has been saved successfully to "C:\Documents and Settings\dad\Desktop\aswMBR.txt"

JonTom

Post #4March 16, 2012, 2:12 PM UTC

Hello catofisher

Thank you for the log.

P2P Programs:
- P2P programs are a major source of Malware infections.
- From your log I see you may have uTorrent. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
- The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
- If you wish to keep the program(s), please do not use them until your computer is cleaned.
- Information regarding the risk of using these programs can be found from here and here.
- It is strongly recommend that you uninstall any P2P programs you have on your system.
- To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
- A list of currently installed programs will be displayed.
- Find the "uTorrent" program, click on it once and then click on the "Remove" button.
- If you are prompted to re-boot your computer to complete the uninstall please do so.
  
  PLEASE NOTE:
- Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.
Please make a backup of your Registry
- The following fix requires altering your Windows Registry. Therefore we need to back it up in case we run into problems:
- Download ERUNT to your Desktop (Right click the link, select "Save Link/Target As"…, select your Desktop and press Save).
- Right click erunt.zip, choose "Extract All…" and follow the prompts to unzip the program.
- Open the ERUNT folder on your Desktop and double click ERUNT.exe to start the program.
- Click OK for all the prompts to back up your registry to the default location.
- Note: if it becomes necessary to restore the registry, open the backup folder and start ERDNT.exe.

Please open OTL

Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark)
PRC - C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME)
SRV - (GuffinsService) – C:\Program Files\Guffins\bar\1.bin\u4barsvc.exe (COMPANYVERS_NAME)
IE - HKLM\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9bd172ba-3f40-4303-bca1-0484b5ba2a7b}
IE - HKCU\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\1.bin\NPu4Stub.dll (MindSpark)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Guffins\bar\1.bin [2012/01/29 10:07:13 | 000,000,000 | —D | M]
O2 - BHO: (Toolbar BHO) - {a916eefe-6a17-4d7d-a131-2738b260bb55} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark)
O2 - BHO: (Search Assistant BHO) - {d6a34acb-76fa-4a14-88ea-5d54797a2028} - C:\Program Files\Guffins\bar\1.bin\u4SrcAs.dll (MindSpark)
O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME)
O4 - HKLM..\Run: [Guffins Search Scope Monitor] C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark)
O8 - Extra context menu item: &Search - http://tbedits.guffins.com/one-toolbaredit…mp;n=2012013112 File not found
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

:Services
GuffinsService

:Files
C:\Program Files\Guffins

:Commands
[purity]
[resethosts]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
Allow the program to run unhindered.
Your machine will re-start itself. This is normal.
A log will be created after your machine reboots. Please post the contents of the log in your next reply.

OTL
- Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, underneath Output at the top change it to Minimal Output.
- Check the box beside Scan All Users.
- In the Extra Registry section change it to All.
- UNCheck the boxes beside LOP Check and Purity Check.
- Click the Run Scan button. Do not change any settings unless told to do so. The scan will not take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Please post the OTL fix log, OTL.Txt log and the Extras.Txt log in your next reply.

catofisher

Post #5March 16, 2012, 6:14 PM UTC

Hi Jon Tom
here is OTL:

OTL logfile created on: 16/03/2012 18:05:17 - Run 3
OTL by OldTimer - Version 3.2.37.0 Folder = C:\Documents and Settings\dad\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.11 Mb Total Physical Memory | 477.31 Mb Available Physical Memory | 47.07% Memory free
2.38 Gb Paging File | 1.97 Gb Available in Paging File | 82.62% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 33.27 Gb Free Space | 44.65% Space Free | Partition Type: NTFS

Computer Name: MICHAEL-77DA7CF | User Name: dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\dad\My Documents\Downloads\OTL(2).exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\lxdxcoms.exe ( )
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12031600\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QtNetwork4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdxdrpp.dll ()
MOD - C:\WINDOWS\system32\lxdxcaps.dll ()
MOD - C:\WINDOWS\system32\lxdxdrs.dll ()
MOD - C:\WINDOWS\system32\lxdxcnv4.dll ()

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (lxdx_device) – C:\WINDOWS\system32\lxdxcoms.exe ( )

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (RT73) – system32\DRIVERS\rt73.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (cerc6) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (LVUVC) Logitech Webcam C210(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKLM\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-73586283-1960408961-1177238915-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
IE - HKU\S-1-5-21-73586283-1960408961-1177238915-1008\..\SearchScopes,DefaultScope = {9bd172ba-3f40-4303-bca1-0484b5ba2a7b}
IE - HKU\S-1-5-21-73586283-1960408961-1177238915-1008\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKU\S-1-5-21-73586283-1960408961-1177238915-1008\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKU\S-1-5-21-73586283-1960408961-1177238915-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid;=283&systemid;=406&sr;=0&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/12/03 20:49:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/03 18:32:16 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/11/13 09:58:46 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\dad\Application Data\Mozilla\Extensions
[2012/03/03 18:45:39 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\dad\Application Data\Mozilla\Firefox\Profiles\qf9fxed2.default\extensions
[2012/03/03 18:45:39 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\dad\Application Data\Mozilla\Firefox\Profiles\qf9fxed2.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/03/10 13:39:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/03/07 17:10:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\DOCUMENTS AND SETTINGS\DAD\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\QF9FXED2.DEFAULT\EXTENSIONS\[removed]
[2012/02/16 14:55:34 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 11:08:43 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/02/16 10:48:01 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 11:08:43 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/02/16 11:08:43 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/03/07 16:19:05 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/02/16 11:08:43 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2008/04/14 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-73586283-1960408961-1177238915-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{03DE02F7-6964-484B-A273-43CF0557253B}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\dad\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\dad\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/10/30 17:38:23 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/16 18:01:39 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2012/03/16 18:00:14 | 000,000,000 | —D | C] – C:\Documents and Settings\dad\Desktop\erunt
[2012/03/16 16:31:46 | 000,000,000 | —D | C] – C:\Documents and Settings\dad\Application Data\Orbit
[2012/03/16 16:30:32 | 000,689,552 | —- | C] (MindSpark) – C:\Program Files\u4Uninstall Guffins.dll
[2012/03/16 16:29:33 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/03/12 00:50:22 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2012/03/11 09:31:32 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2012/03/11 09:31:32 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2012/03/10 14:21:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2012/03/10 13:37:29 | 000,000,000 | —D | C] – C:\Documents and Settings\dad\Local Settings\Application Data\PackageAware
[2012/03/10 11:28:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2012/03/10 11:28:04 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2012/03/07 23:40:48 | 000,000,000 | —D | C] – C:\Documents and Settings\dad\Application Data\Sun
[2012/03/07 17:11:33 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2012/03/07 17:11:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2012/03/07 17:11:21 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/03/07 17:10:30 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2012/03/07 17:10:29 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2012/03/07 17:10:29 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2012/03/07 17:10:29 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2012/03/07 17:10:29 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2012/03/07 17:10:04 | 000,000,000 | —D | C] – C:\Program Files\Java
[2012/03/07 17:01:49 | 000,000,000 | —D | C] – C:\Downloads
[2012/03/07 16:19:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2012/02/29 10:43:59 | 000,172,032 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxres.dll
[2012/02/29 10:30:16 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2012/02/29 10:28:28 | 000,000,000 | —D | C] – C:\Program Files\Opera
[2012/02/29 10:27:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/02/29 10:26:56 | 000,839,680 | —- | C] (http://www.mp3dev.org/) – C:\WINDOWS\System32\lameACM.acm
[2012/02/29 10:26:50 | 000,237,568 | —- | C] (www.helixcommunity.org) – C:\WINDOWS\System32\yv12vfw.dll
[2012/02/29 10:26:50 | 000,151,552 | —- | C] (fccHandler) – C:\WINDOWS\System32\ac3acm.acm
[2012/02/29 10:26:37 | 000,000,000 | —D | C] – C:\Program Files\K-Lite Codec Pack
[2012/02/29 10:20:06 | 000,920,088 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\igxpun.exe
[2012/02/29 10:20:06 | 000,000,000 | —D | C] – C:\WINDOWS\System32\x64
[2012/02/29 10:17:10 | 000,319,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\difxapi.dll
[2012/02/29 10:16:05 | 000,172,032 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrslv.lrc
[2012/02/29 10:16:04 | 000,176,128 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrsky.lrc
[2012/02/29 10:15:51 | 000,122,880 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxcpl.cpl
[2012/02/29 10:15:49 | 000,151,040 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxpgd32.dll
[2012/02/29 10:15:49 | 000,057,344 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxprd32.dll
[2012/02/29 10:15:48 | 002,643,968 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxpdx32.dll
[2012/02/29 10:15:48 | 001,670,144 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igxpdv32.dll
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/03/16 17:58:47 | 000,513,320 | —- | M] () – C:\Documents and Settings\dad\Desktop\erunt.zip
[2012/03/16 17:15:00 | 000,000,982 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1005UA.job
[2012/03/16 17:12:00 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1007UA.job
[2012/03/16 16:50:04 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/03/16 16:49:13 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/03/16 16:10:34 | 000,005,802 | —- | M] () – C:\Documents and Settings\dad\Desktop\Document.rtf
[2012/03/16 12:41:08 | 000,000,512 | —- | M] () – C:\Documents and Settings\dad\Desktop\MBR.dat
[2012/03/16 00:15:02 | 000,000,930 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1005Core.job
[2012/03/15 19:12:00 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-73586283-1960408961-1177238915-1007Core.job
[2012/03/14 16:42:56 | 000,000,654 | —- | M] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010301.JPG.lnk
[2012/03/14 16:42:33 | 000,000,654 | —- | M] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010298.JPG.lnk
[2012/03/14 08:11:58 | 000,090,296 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/03/14 01:17:42 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/03/07 21:11:38 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/03/07 17:10:12 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2012/03/07 17:10:12 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2012/03/07 17:10:12 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2012/03/07 17:10:12 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2012/03/07 17:10:12 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2012/03/03 18:32:18 | 000,000,742 | —- | M] () – C:\Documents and Settings\dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/29 10:27:41 | 000,312,172 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/02/29 10:27:41 | 000,040,394 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/02/23 10:34:10 | 000,022,016 | —- | M] () – C:\Documents and Settings\dad\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/16 14:40:15 | 000,000,754 | —- | M] () – C:\WINDOWS\WORDPAD.INI
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/03/16 17:58:46 | 000,513,320 | —- | C] () – C:\Documents and Settings\dad\Desktop\erunt.zip
[2012/03/16 16:30:32 | 000,161,712 | —- | C] () – C:\Program Files\u4res.dll
[2012/03/16 16:10:34 | 000,005,802 | —- | C] () – C:\Documents and Settings\dad\Desktop\Document.rtf
[2012/03/16 12:41:08 | 000,000,512 | —- | C] () – C:\Documents and Settings\dad\Desktop\MBR.dat
[2012/03/14 16:42:56 | 000,000,654 | —- | C] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010301.JPG.lnk
[2012/03/14 16:42:33 | 000,000,654 | —- | C] () – C:\Documents and Settings\dad\Desktop\Shortcut to P1010298.JPG.lnk
[2012/03/03 18:32:18 | 000,000,742 | —- | C] () – C:\Documents and Settings\dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/03/03 18:32:18 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/02/29 10:27:05 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2012/02/29 10:27:04 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2012/02/29 10:26:56 | 000,000,414 | —- | C] () – C:\WINDOWS\System32\lame_acm.xml
[2012/02/29 10:26:49 | 000,810,496 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/02/29 10:26:49 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/02/29 10:26:49 | 000,080,896 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2012/02/29 10:15:48 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2012/02/15 11:02:59 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/08 09:28:45 | 000,022,016 | —- | C] () – C:\Documents and Settings\dad\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/28 21:13:58 | 001,105,920 | —- | C] ( ) – C:\WINDOWS\System32\lxdxserv.dll
[2011/12/28 21:13:58 | 000,843,776 | —- | C] ( ) – C:\WINDOWS\System32\lxdxusb1.dll
[2011/12/28 21:13:58 | 000,053,248 | —- | C] ( ) – C:\WINDOWS\System32\lxdxprox.dll
[2011/12/28 21:13:58 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxdxvs.dll
[2011/12/28 21:13:57 | 000,663,552 | —- | C] ( ) – C:\WINDOWS\System32\lxdxhbn3.dll
[2011/12/28 21:13:57 | 000,647,168 | —- | C] ( ) – C:\WINDOWS\System32\lxdxpmui.dll
[2011/12/28 21:13:57 | 000,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxdxinpa.dll
[2011/12/28 21:13:57 | 000,339,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdxiesc.dll
[2011/12/28 21:13:57 | 000,315,392 | —- | C] ( ) – C:\WINDOWS\System32\lxdxih.exe
[2011/12/28 21:13:57 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxdxgrd.dll
[2011/12/28 21:13:56 | 000,851,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcomc.dll
[2011/12/28 21:13:56 | 000,589,824 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcoms.exe
[2011/12/28 21:13:56 | 000,376,832 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcomm.dll
[2011/12/28 21:13:56 | 000,360,448 | —- | C] ( ) – C:\WINDOWS\System32\lxdxcfg.exe
[2011/12/28 21:13:55 | 000,569,344 | —- | C] ( ) – C:\WINDOWS\System32\lxdxlmpm.dll
[2011/12/28 21:09:35 | 000,782,336 | —- | C] () – C:\WINDOWS\System32\lxdxdrs.dll
[2011/12/28 21:09:35 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\lxdxcaps.dll
[2011/12/28 21:09:35 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\lxdxcnv4.dll
[2011/11/18 14:41:52 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2011/11/12 19:40:51 | 000,012,736 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/10/30 20:21:56 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2011/10/30 19:23:41 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/30 17:41:28 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/10/30 17:34:36 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/10/30 17:24:30 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/10/30 17:23:16 | 000,090,296 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/10 02:45:32 | 000,102,744 | —- | C] () – C:\WINDOWS\System32\LogiDPPApp.exe
[2010/11/10 02:45:30 | 010,871,128 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2010/11/10 02:45:20 | 000,316,248 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2010/11/10 02:31:42 | 000,026,286 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/05/07 18:46:36 | 000,014,168 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2010/05/07 18:43:30 | 000,025,824 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys

========== Custom Scans ==========

< :OTL >

< PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) >

< PRC - C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark) >

< PRC - C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME) >

< SRV - (GuffinsService) – C:\Program Files\Guffins\bar\1.bin\u4barsvc.exe (COMPANYVERS_NAME) >

< IE - HKLM\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms} >

< IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - No CLSID value found >

< IE - HKCU\..\SearchScopes,DefaultScope = {9bd172ba-3f40-4303-bca1-0484b5ba2a7b} >

< IE - HKCU\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms} >

< FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406" >

< FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\1.bin\NPu4Stub.dll (MindSpark) >
Invalid Switch: Plugin: C:\Program Files\Guffins\bar\1.bin\NPu4Stub.dll (MindSpark)

< FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Guffins\bar\1.bin [2012/01/29 10:07:13 | 000,000,000 | —D | M] >
Invalid Switch: 29 10:07:13 | 000,000,000 | —D | M]

< O2 - BHO: (Toolbar BHO) - {a916eefe-6a17-4d7d-a131-2738b260bb55} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark) >

< O2 - BHO: (Search Assistant BHO) - {d6a34acb-76fa-4a14-88ea-5d54797a2028} - C:\Program Files\Guffins\bar\1.bin\u4SrcAs.dll (MindSpark) >

< O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark) >

< O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. >

< O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME) >

< O4 - HKLM..\Run: [Guffins Search Scope Monitor] C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark) >

< O8 - Extra context menu item: &Search; - http://tbedits.guffins.com/one-toolbaredit…mp;n=2012013112 File not found >
Invalid Switch: one-toolbaredit…mp;n=2012013112 File not found

< [6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] >

< [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] >

< >

< :Services >

< GuffinsService >

< >

< :Files >

< C:\Program Files\Guffins >

< >

< :Commands >

< [purity] >

< [resethosts] >

< [emptytemp] >

< [emptyflash] >

< [start explorer] >

< [Reboot] >

< End of report >

and here is extras:

OTL Extras logfile created on: 16/03/2012 18:05:17 - Run 3
OTL by OldTimer - Version 3.2.37.0 Folder = C:\Documents and Settings\dad\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.11 Mb Total Physical Memory | 477.31 Mb Available Physical Memory | 47.07% Memory free
2.38 Gb Paging File | 1.97 Gb Available in Paging File | 82.62% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 33.27 Gb Free Space | 44.65% Space Free | Partition Type: NTFS

Computer Name: MICHAEL-77DA7CF | User Name: dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (All) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.bat [@ = batfile] – "%1" %*
.chm [@ = chm.file] – C:\WINDOWS\hh.exe (Microsoft Corporation)
.cmd [@ = cmdfile] – "%1" %*
.com [@ = comfile] – "%1" %*
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.exe [@ = exefile] – "%1" %*
.hlp [@ = hlpfile] – C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\WINDOWS\System32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.inf [@ = inffile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l
.js [@ = JSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.pif [@ = piffile] – "%1" %*
.reg [@ = regfile] – C:\WINDOWS\regedit.exe (Microsoft Corporation)
.scr [@ = scrfile] – "%1" /S
.txt [@ = txtfile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-73586283-1960408961-1177238915-1008\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – winhlp32.exe %1 (Microsoft Corporation)
hlpfile [open] – %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
inffile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
InternetShortcut [print] – rundll32.exe C:\WINDOWS\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
jsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
vbsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wsffile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
wsffile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
wsffile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wshfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Documents and Settings\willem\Application Data\Spotify\spotify.exe" = C:\Documents and Settings\willem\Application Data\Spotify\spotify.exe:*:Enabled:Spotify – (Spotify Ltd)
"C:\WINDOWS\system32\lxdxcoms.exe" = C:\WINDOWS\system32\lxdxcoms.exe:*:Enabled:3600-4600 Series Server – ( )
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe:*:Enabled:Printer Status Window Interface – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe:*:Enabled:Lexmark Connect Time Executable – (Lexmark International, Inc.)
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe:*:Enabled:Job Status Window Interface – ()
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser
"C:\Documents and Settings\dad\My Documents\Downloads\cnet2_WLAN_Ralink_T77H028_N-card_zip.exe" = C:\Documents and Settings\dad\My Documents\Downloads\cnet2_WLAN_Ralink_T77H028_N-card_zip.exe:*:Enabled:CNET Download.com Installer – (CNET Download.com)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"888poker" = 888poker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"Betfair Poker JPC_is1" = Betfair Poker JPC 1.0.0
"BGroom" = BGroom
"HDMI" = Intel® Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.7.0 (Full)
"McAfee Security Scan" = McAfee Security Scan Plus
"MonkeyJam_is1" = MonkeyJam 3_050529
"Mozilla Firefox 10.0.2 (x86 en-GB)" = Mozilla Firefox 10.0.2 (x86 en-GB)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 16/03/2012 03:34:15 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:15 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:15 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:17 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:17 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:17 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:19 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:19 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 03:34:19 | Computer Name = MICHAEL-77DA7CF | Source = Bonjour Service | ID = 100
Description =

Error - 16/03/2012 08:29:09 | Computer Name = MICHAEL-77DA7CF | Source = Application Error | ID = 1000
Description = Faulting application skype.exe, version 5.5.59.124, faulting module
skype.exe, version 5.5.59.124, fault address 0x001dae87.

[ System Events ]
Error - 12/03/2012 20:36:10 | Computer Name = MICHAEL-77DA7CF | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.5 for the Network Card with network
address 00030D6C2993 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 13/03/2012 05:35:16 | Computer Name = MICHAEL-77DA7CF | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.2 for the Network Card with network
address 00030D6C2993 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 16/03/2012 03:35:14 | Computer Name = MICHAEL-77DA7CF | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 16/03/2012 03:35:24 | Computer Name = MICHAEL-77DA7CF | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

< End of report >

fingers crossed!

JonTom

Post #6March 16, 2012, 10:19 PM UTC

Hello catofisher

There's something not quite right about that OTL log.

In step 3 of my previous post (when you copied and pasted the fix into OTL) did you click on "Run Scan" rather than "Run fix"?

Lets run that script again to make sure (please make sure you click on run fix):

Please open OTL

Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark)
PRC - C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME)
SRV - (GuffinsService) – C:\Program Files\Guffins\bar\1.bin\u4barsvc.exe (COMPANYVERS_NAME)
IE - HKLM\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\URLSearchHook: {c3d3840c-12ea-4461-a61d-190555fecc82} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9bd172ba-3f40-4303-bca1-0484b5ba2a7b}
IE - HKCU\..\SearchScopes\{9bd172ba-3f40-4303-bca1-0484b5ba2a7b}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - HKLM\Software\MozillaPlugins\@Guffins.com/Plugin: C:\Program Files\Guffins\bar\1.bin\NPu4Stub.dll (MindSpark)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Guffins\bar\1.bin [2012/01/29 10:07:13 | 000,000,000 | —D | M]
O2 - BHO: (Toolbar BHO) - {a916eefe-6a17-4d7d-a131-2738b260bb55} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark)
O2 - BHO: (Search Assistant BHO) - {d6a34acb-76fa-4a14-88ea-5d54797a2028} - C:\Program Files\Guffins\bar\1.bin\u4SrcAs.dll (MindSpark)
O3 - HKLM\..\Toolbar: (Guffins) - {de2fdf7c-2637-4ba3-b427-3fce2d331db5} - C:\Program Files\Guffins\bar\1.bin\u4bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Guffins Browser Plugin Loader] C:\Program Files\Guffins\bar\1.bin\u4brmon.exe (VER_COMPANY_NAME)
O4 - HKLM..\Run: [Guffins Search Scope Monitor] C:\Program Files\Guffins\bar\1.bin\u4SrchMn.exe (MindSpark)
O8 - Extra context menu item: &Search - http://tbedits.guffins.com/one-toolbaredit…mp;n=2012013112 File not found
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

:Services
GuffinsService

:Files
C:\Program Files\Guffins

:Commands
[purity]
[resethosts]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
Allow the program to run unhindered.
Your machine will re-start itself. This is normal.
A log will be created after your machine reboots. Please post the contents of the log in your next reply.

Please perform the following scan:
- Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
- Double click on the mbam-setup.exe icon to install the program.
- Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
- Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
- Click on the "Update" tab and then on "Check for Updates".
- The program will now install the latest Malware definition files.
- Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
- Once the program has scanned your computer, a log file will be created in Notepad.
- Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
- If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
- When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
- The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
- Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
- Come back here to this thread and Paste the log in your next reply.
Please post the OTL log and the MBAM log in your next reply.

catofisher

Post #7March 17, 2012, 12:22 PM UTC

hi jon tom unfortunately i've run out of time i am leaving the country for 1 week and not going online i will ask the wife to pick up your reply to this message… first…..is it possible to put this thread on hold and we can pick up where we left off next sunday? 2nd is it safe for the family to use the computer at the moment? i appreciate the help you have given me so far….thanks……… i understand if i have to start again next week

JonTom

Post #8March 17, 2012, 1:09 PM UTC

Hello catofisher

i am leaving the country for 1 week and not going online

No problem, I will leave your thread open until you return

is it safe for the family to use the computer at the moment?

I would advise against it since there is still malware present.

Once you are back we will continue with the cleaning.

catofisher

Post #9March 26, 2012, 9:22 AM UTC

hi jon tom thanks for waiting well…..i did OTL run fix and mbam on the mbam reboot the otl log seems to have disappeared but i notice we are now going to google and not the evil searchnu! here is mbam log: Malwarebytes Anti-Malware (Trial) 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.26.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 dad :: MICHAEL-77DA7CF [administrator] Protection: Enabled 26/03/2012 09:55:50 mbam-log-2012-03-26 (10-05-28).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 208027 Time elapsed: 8 minute(s), 7 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Documents and Settings\willem\My Documents\Downloads\DownloadSetup.exe (Affiliate.Downloader) -> No action taken. C:\Documents and Settings\willem\My Documents\Downloads\SoftonicDownloader_for_monkeyjam.exe (PUP.BundleOffer.Downloader.S) -> No action taken. (end) i might be fixed on this computer? if so we still have the windows 7 to do ……after that i will avoid torrent for ever!!!

JonTom

Post #10March 26, 2012, 12:58 PM UTC

Hello catofisher

i notice we are now going to google and not the evil searchnu!

Good

we still have the windows 7 to do

Don't worry, I have'nt forgotten. We'll come to that machine in due course.

i might be fixed on this computer?

We still have a little more to do before we can be sure.

C:\Documents and Settings\willem\My Documents\Downloads\DownloadSetup.exe (Affiliate.Downloader) -> No action taken.
C:\Documents and Settings\willem\My Documents\Downloads\SoftonicDownloader_for_monkeyjam.exe (PUP.BundleOffer.Downloader.S) -> No action taken.

Please allow MBAM to remove these detections.

Please run the following scan
Note:Internet Explorer is preferred for this scan, although it will run with other browsers.
Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
Please disable your real time security programs before performing the scan.

Scan your system with Eset Online Scanner
Place a check mark in the box YES, I accept the Terms Of Use.
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
Double click on the [external image: Posted Image] icon on your desktop.

Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option to "Remove Found Threats" is UN checked.
Push the "Start" button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

Please post the ESET log in your next reply along with a new OTL scan log.

catofisher

Post #11March 27, 2012, 9:16 AM UTC

oh dear call me stupid but i have the following before i follow these instructions: i am assuming i can continue in mozilla for this i'm sure i did get mbam to remove the 2 bugs earlier i can turn off my firewall but i haven't discovered how to disable avast unless i remove it completely from the computer????

JonTom

Post #12March 27, 2012, 8:45 PM UTC

Hello catofisher

i am assuming i can continue in mozilla for this

Its worth a try. If it does not run with Firefox it will with IE.

i haven't discovered how to disable avast

Lets try this:

Right-click the "Avast" icon in the system tray on the taskbar.
Choose "Open Avast User Interface."
Choose the "Real-Time Shields" option.
Select each of the shields and click "Stop" for each one.
Click the "Firewall" option and turn it off.

catofisher

Post #13March 28, 2012, 12:43 PM UTC

hi jon tom here is eset log: C:\Documents and Settings\dad\My Documents\Downloads\cnet2_WLAN_Ralink_T77H028_N-card_zip.exe a variant of Win32/InstallCore.D application will now switch back on avast and firewall

JonTom

Post #14March 28, 2012, 8:15 PM UTC

Hello catofisher

Thank you for the ESET log.

Please open OTL

Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Files
C:\Documents and Settings\dad\My Documents\Downloads\cnet2_WLAN_Ralink_T77H028_N-card_zip.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
Allow the program to run unhindered.
Your machine will re-start itself. This is normal.
A log will be created after your machine reboots. Please post the contents of the log in your next reply.

Please post the OTL log that is produced after you run the fix along with a new OTL scan log in your next reply.

How is the machine running now?

catofisher

Post #15March 30, 2012, 8:43 PM UTC last edited March 31, 2012, 4:14 PM UTC

hi jon tom i've tried this twice now ………..once i press run fix it says "killing processes do not interrupt……….but nothing further happens no matter how long i leave it. Eventually i try and come out of the programme but the computer is frozen and i have to switch the machine off manually ???? since then the computer tells me it has recovered from a serious error caused by a device or driver which created a blue screen shut down………don't know if that was me turning the machine off or a driver like the wireless card?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

searchnu.com/406 [Solved]

✨ Ask AI

Ask AI