Spyware / Malware / Virus Removal

Smart Fortress 2012

278 min read

Looking for the outcome? Ask AI

webster10 Topic Starter

Post #1April 11, 2012, 3:42 PM UTC

Hi

I got hit with SmartFortress 2012. Thought it was killed off with Malwarebytes. But today I still have issues - browser redirects and slowness, etc.

Here is HJT

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:17:57 AM, on 4/11/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (file missing)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [InstallIQUpdater] "C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe" /silent /autorun
O4 - HKCU\..\Run: [Qybyqa] "C:\Documents and Settings\Administrator\Application Data\Zokupa\kuve.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.westlaw.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} (PCPitstop AntiVirus) - http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (file missing)
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: intelUsb3Sevices - usbniw32.dll (file missing)
O20 - Winlogon Notify: usbniw32 - usbniw32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: OneStep Service - Unknown owner - C:\Program Files\OneStep\onestep.exe (file missing)
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
O24 - Desktop Component 0: (no name) - http://mail.charter.net/images/portal/msgt…S&v=charter

–
End of file - 7077 bytes

Thanks for taking a look.

oldman960

Post #2April 11, 2012, 3:57 PM UTC

Hi webster10, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Any particular reason you are in Safe Mode?

Open hijackthis, do a system scan only and checkmark these lines, if present

O4 - HKCU\..\Run: [Qybyqa] "C:\Documents and Settings\Administrator\Application Data\Zokupa\kuve.exe"

Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT. Reboot to normal windows.

Next

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it. If asked to download Avast's database please do so.

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Next

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

aswMBR log
MBR.zip
both OTL logs

No need for a HJT log.

webster10

Post #3April 11, 2012, 5:11 PM UTC

Hi I ran HTJ and clicked to fix the line with Zopuk stuff in it. I also ran both aswMBR and OLT. awMBR ran ok and results are below. OLT ran and then right before generating logs froze up. Tried twice to restart it, but it would lapse into "not responding". So I am unable to get OLT results, at least for now. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-04-11 11:22:14 —————————– 11:22:14.031 OS Version: Windows 5.1.2600 Service Pack 3 11:22:14.031 Number of processors: 1 586 0x401 11:22:14.031 ComputerName: PEGGY UserName: 11:22:30.890 Initialize success 11:23:04.437 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 11:23:04.437 Disk 0 Vendor: ST340015A 3.15 Size: 38166MB BusType: 3 11:23:04.625 Disk 0 MBR read successfully 11:23:04.625 Disk 0 MBR scan 11:23:04.625 Disk 0 Windows XP default MBR code 11:23:04.687 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38162 MB offset 63 11:23:04.828 Disk 0 scanning sectors +78156225 11:23:05.265 Disk 0 scanning C:\WINDOWS\system32\drivers 11:24:09.453 Service scanning 11:26:10.718 Modules scanning 11:26:29.625 Module: C:\WINDOWS\system32\DRIVERS\redbook.sys **SUSPICIOUS** 11:27:10.484 Disk 0 trace - called modules: 11:27:10.593 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82d49fd0]<< 11:27:10.593 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82f415e0] 11:27:11.328 3 CLASSPNP.SYS[f8782fd7] -> nt!IofCallDriver -> [0x82e34030] 11:27:11.328 \Driver\00001122[0x82be3f38] -> IRP_MJ_CREATE -> 0x82d49fd0 11:27:11.328 Scan finished successfully 11:28:10.296 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 11:28:10.359 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt" THANK YOU

Attachments:

📎MBR.zip

webster10

Post #4April 11, 2012, 9:12 PM UTC

After numerous trys, re-downloading OTL, and waiting, I have the scan results.

Thanks for your patients.

OLT.TXT

OTL logfile created on: 4/11/2012 3:30:58 PM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 279.90 Mb Available Physical Memory | 55.67% Memory free
843.57 Mb Paging File | 545.19 Mb Available in Paging File | 64.63% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 9.60 Gb Free Space | 25.76% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\system32\6to4v32.dll ()
MOD - C:\WINDOWS\system32\usbniw32.dll ()
MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - \\.\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\libexpat.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\sqlite3.dll ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()

========== Win32 Services (SafeList) ==========

SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (OneStep Service) – C:\Program Files\OneStep\onestep.exe C:\Program Files\OneStep\onestep.dll Service File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (6to4) – C:\WINDOWS\system32\6to4v32.dll ()
SRV - (NEC Usb3) – C:\WINDOWS\system32\usbnaw32.dll (Intel Corporation )
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
SRV - (qfcoresvc) – C:\WINDOWS\system32\co_mon.dll (Oak Technology Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (iAimFP4) – C:\WINDOWS\system32\drivers\wVchNTxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\system32\drivers\wSiINTxx.sys (Intel® Corporation)
DRV - (iAimTV5) – C:\WINDOWS\system32\drivers\wATV10nt.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\system32\drivers\wCh7xxNT.sys (Intel® Corporation)
DRV - (iAimTV6) – C:\WINDOWS\system32\drivers\wATV06nt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\system32\drivers\wATV04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\system32\drivers\wATV02NT.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\system32\drivers\wATV01nt.sys (Intel® Corporation)
DRV - (iAimFP7) – C:\WINDOWS\system32\drivers\wADV09NT.sys (Intel® Corporation)
DRV - (iAimFP5) – C:\WINDOWS\system32\drivers\wADV07nt.sys (Intel® Corporation)
DRV - (iAimFP6) – C:\WINDOWS\system32\drivers\wADV08NT.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\system32\drivers\i81xnt5.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\system32\drivers\wADV01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\system32\drivers\wADV02NT.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\system32\drivers\wADV05NT.sys (Intel® Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..network.proxy.type: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/11 14:53:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/16 12:43:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/01 14:45:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\ [2012/04/10 12:21:40 | 000,000,000 | —D | M]

[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/12 10:47:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/10 12:21:40 | 000,000,000 | —D | M] (Translate This!) – C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
[2012/03/16 12:43:08 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/10/03 13:37:57 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/12 10:47:18 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}

Hosts file not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [Qybyqa] C:\Documents and Settings\Administrator\Application Data\Zokupa\kuve.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O20 - Winlogon\Notify\intelUsb3Sevices: DllName - (usbniw32.dll) - C:\WINDOWS\System32\usbniw32.dll ()
O20 - Winlogon\Notify\usbniw32: DllName - (usbniw32.dll) - C:\WINDOWS\System32\usbniw32.dll ()
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v;=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{edb1d78f-adb0-11dd-bab8-000ffeae5164}\Shell - "" = AutoRun
O33 - MountPoints2\{edb1d78f-adb0-11dd-bab8-000ffeae5164}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{edb1d78f-adb0-11dd-bab8-000ffeae5164}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - C:\WINDOWS\system32\6to4v32.dll ()
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: z800obex - %systemroot%\system32\rollbackclientservice.dll File not found
NetSvcs: DC21x4 - File not found
NetSvcs: IntuitUpdateService - %systemroot%\system32\imaservice.dll File not found
NetSvcs: dpfusmgr - File not found
NetSvcs: LMIRfsDriver - File not found
NetSvcs: pelmouse - File not found
NetSvcs: stylexpservice - File not found
NetSvcs: qfcoresvc - C:\WINDOWS\system32\co_mon.dll (Oak Technology Inc.)
NetSvcs: nimdbgk - File not found
NetSvcs: dladresm - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/11 08:53:02 | 000,156,672 | —- | C] (Intel Corporation ) – C:\WINDOWS\System32\usbnaw32.dll
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/04/10 12:21:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
[2012/04/10 11:44:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E
[2012/04/10 11:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Zokupa
[2012/04/10 11:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Ucpi
[2012/04/10 11:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Qogoon
[2012/03/19 16:11:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Amelunke
[2012/03/14 10:08:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Jansen
[3 C:\Documents and Settings\Administrator\My Documents\*.tmp files -> C:\Documents and Settings\Administrator\My Documents\*.tmp -> ]
[10 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/11 15:34:24 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 14:53:54 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/11 14:51:45 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/11 14:50:19 | 000,000,000 | -HS- | M] () – C:\WINDOWS\System32\dds_trash_log.cmd
[2012/04/11 14:50:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/11 14:50:00 | 527,290,368 | -HS- | M] () – C:\hiberfil.sys
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 12:01:03 | 000,000,499 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2012/04/11 12:00:00 | 000,000,378 | —- | M] () – C:\WINDOWS\tasks\PerfectOptimizer_home.job
[2012/04/11 11:28:10 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/11 09:05:05 | 000,038,964 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\meds411.png
[2012/04/11 08:59:46 | 000,000,198 | —- | M] () – C:\WINDOWS\System32\itlsvc.dat
[2012/04/11 08:53:31 | 000,057,344 | —- | M] () – C:\WINDOWS\System32\6to4v32.dll
[2012/04/11 08:53:02 | 000,156,672 | —- | M] (Intel Corporation ) – C:\WINDOWS\System32\usbnaw32.dll
[2012/04/11 08:53:01 | 000,038,400 | —- | M] () – C:\WINDOWS\System32\usbniw32.dll
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk
[2012/03/29 09:46:19 | 000,007,044 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/03/29 09:46:08 | 000,051,024 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\BELLIS General Warranty Deed 2012-1.pdf
[2012/03/19 14:39:57 | 000,051,464 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf
[2012/03/14 03:46:22 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/03/14 03:46:22 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/03/14 03:41:30 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/03/14 03:12:48 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[3 C:\Documents and Settings\Administrator\My Documents\*.tmp files -> C:\Documents and Settings\Administrator\My Documents\*.tmp -> ]
[10 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/11 14:50:00 | 527,290,368 | -HS- | C] () – C:\hiberfil.sys
[2012/04/11 14:04:47 | 000,038,964 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\meds411.png
[2012/04/11 12:01:03 | 000,000,499 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2012/04/11 11:28:10 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/04/11 08:59:46 | 000,000,198 | —- | C] () – C:\WINDOWS\System32\itlsvc.dat
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/11 08:53:31 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\6to4v32.dll
[2012/04/11 08:53:01 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\usbniw32.dll
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/10 11:45:13 | 000,000,000 | -HS- | C] () – C:\WINDOWS\System32\dds_trash_log.cmd
[2012/03/29 09:46:07 | 000,051,024 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\BELLIS General Warranty Deed 2012-1.pdf
[2012/03/19 14:41:22 | 000,051,464 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2011/08/19 16:14:29 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll

========== LOP Check ==========

[2011/07/22 15:13:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\.oit
[2010/11/21 22:59:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Amazon
[2011/04/27 13:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FileZilla
[2012/02/06 00:28:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Gaia Family Tree
[2012/04/10 18:52:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\gtk-2.0
[2007/01/11 16:17:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2012/04/11 14:28:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Qogoon
[2011/08/19 14:49:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Riyxo
[2010/09/18 11:12:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\RootsMagic
[2010/03/13 02:00:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SecondLife
[2007/07/20 21:54:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Snapfish
[2008/11/25 12:38:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Thunderbird
[2012/04/10 11:44:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Ucpi
[2011/08/20 10:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Vuam
[2012/04/10 11:44:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Zokupa
[2012/04/10 11:44:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E
[2011/08/20 10:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\lB06700CkPbP06700
[2007/06/27 13:35:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2008/11/12 10:40:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/09/18 11:10:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RootsMagic
[2007/06/27 13:36:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2006/12/04 11:36:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Softdisk LLC
[2009/10/31 11:01:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/07/26 17:39:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\W3i
[2012/04/11 12:00:00 | 000,000,378 | —- | M] () – C:\WINDOWS\Tasks\PerfectOptimizer_home.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/08/27 11:09:57 | 000,000,211 | -H– | M] () – C:\boot.ini
[2012/04/11 15:24:16 | 000,000,733 | —- | M] () – C:\err.log
[2007/01/03 10:08:29 | 000,001,208 | —- | M] () – C:\Games0.bmp
[2012/04/11 14:50:00 | 527,290,368 | -HS- | M] () – C:\hiberfil.sys
[2006/12/05 12:33:52 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/11/06 15:42:31 | 000,000,243 | —- | M] () – C:\log.html
[2007/01/03 10:08:29 | 000,001,654 | —- | M] () – C:\Movies0.bmp
[2006/12/05 12:33:52 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 03:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/06/24 17:29:30 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/04/11 14:49:58 | 390,070,272 | -HS- | M] () – C:\pagefile.sys
[2012/04/11 14:47:53 | 000,000,310 | —- | M] () – C:\rkill.log
[2006/11/15 14:14:35 | 000,003,584 | -HS- | M] () – C:\Thumbs.db

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/09 08:32:58 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2006/11/15 16:06:41 | 000,038,330 | —- | M] () – C:\Program Files\184-AI.pdf
[2006/11/15 16:21:11 | 021,290,704 | —- | M] ( ) – C:\Program Files\AdbeRdr708_en_US.exe
[2006/11/16 08:59:23 | 004,264,077 | —- | M] (Stardust Software) – C:\Program Files\Garden.exe
[2006/11/15 16:12:32 | 007,050,552 | —- | M] (Adobe Systems, Inc. ) – C:\Program Files\psa30se_en_us.exe
[2006/11/15 16:12:50 | 000,774,144 | —- | M] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll
[2006/11/15 16:05:45 | 000,762,512 | —- | M] () – C:\Program Files\ytb612_efgsip.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/09 08:20:10 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/08/09 08:20:10 | 000,659,456 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/08/09 08:20:10 | 000,864,256 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2009/06/24 17:46:55 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2005/03/21 17:25:08 | 000,001,522 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Install Altiris Local Recovery.lnk
[2006/04/24 15:11:33 | 000,001,566 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Microsoft Update.lnk
[2009/06/24 17:46:55 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2004/08/09 13:34:14 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2006/03/21 08:00:55 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/08/19 16:17:06 | 001,008,092 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\iExplore.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdat >

< e\Auto Update\Results\Install|LastSuccessTime /rs >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EX_ >
[2004/08/04 07:00:00 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\i386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 02:56:50 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2012/04/11 08:43:38 | 000,018,474 | —- | M] () MD5=7D50A2B52D1B4D9139755A3D8837F342 – C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.LNK >
[2008/07/10 08:49:43 | 000,000,529 | —- | M] () MD5=5C96CCB3F594CE53FFD1474D6EC4CA16 – C:\Documents and Settings\Administrator\Start Menu\explorer.lnk

< MD5 for: EXPLORER.SC_ >
[2004/08/04 07:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\i386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2004/08/04 08:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CH_ >
[2004/08/04 07:00:00 | 000,199,077 | —- | M] () MD5=5F64795662F162CCD8B30969B6682029 – C:\i386\IEXPLORE.CH_

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2004/07/17 13:40:18 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2006/09/01 08:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.CHW >
[2007/03/15 16:53:19 | 000,157,092 | —- | M] () MD5=4D3EF07FA93B4836904339F37BEC3D4E – C:\WINDOWS\Help\iexplore.chw

< MD5 for: IEXPLORE.EX_ >
[2004/08/04 07:00:00 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\i386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2008/12/19 00:25:25 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=030D78FE84A086ED376EFCBD2D72C522 – C:\WINDOWS\ie8\iexplore.exe
[2008/12/19 00:25:25 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=030D78FE84A086ED376EFCBD2D72C522 – C:\WINDOWS\SD_OLD\Download\21b9c2f7b1db683e3d83bfb825d32092\SP2GDR\iexplore.exe
[2008/10/15 01:34:58 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=056C927CF7207857E8B34F7A8FFD9B9E – C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\iexplore.exe
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2007/04/24 09:26:26 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=10BDB55982586A432A3951EB19A26009 – C:\WINDOWS\ie7updates\KB937143-IE7\iexplore.exe
[2008/12/19 00:25:30 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=15E8A89499741D5CF59A9CF6463A4339 – C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[2008/12/19 00:25:30 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=15E8A89499741D5CF59A9CF6463A4339 – C:\WINDOWS\SD_OLD\Download\21b9c2f7b1db683e3d83bfb825d32092\SP2QFE\iexplore.exe
[2008/04/22 03:02:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=197B7E4030CFBD8D2979D375E1787AA2 – C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe
[2008/08/23 00:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB958215-IE7\iexplore.exe
[2008/04/22 02:40:18 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=232B22817B90AE0AFF2D189E3E3735AC – C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
[2007/12/06 06:01:25 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2703D940A62B731AA220529DD7331A78 – C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
[2007/06/27 03:27:30 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=275CEE268B9E5D82474C43D5D249D111 – C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe
[2008/02/29 03:55:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2D0E5592AB5A46C27DAF7CCAFF4F5B59 – C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
[2007/08/17 05:21:21 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=3AC2BC667DA0AF2C968E96E1630F5AB5 – C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe
[2006/10/17 13:04:40 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=5334D4461AA92A7B008755FE6D13C5F2 – C:\WINDOWS\ie7updates\KB928090-IE7\iexplore.exe
[2007/08/17 05:12:49 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=5577D0E3AC2F9F035ACD81B44AF5F511 – C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2007/10/10 03:16:56 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=632BDE0179847234433CA50945442ACB – C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe
[2011/08/19 16:17:06 | 001,008,092 | —- | M] () MD5=645A8F39A10306D50382EB49A6C49AAB – C:\Documents and Settings\Administrator\Desktop\iExplore.exe
[2008/06/23 04:20:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=64E376A47763DAEABCDA14BD5B6EA286 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
[2007/02/21 03:00:58 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=683DDE71BCF03B501B912D20CB93B549 – C:\WINDOWS\ie7updates\KB933566-IE7\iexplore.exe
[2008/02/22 04:40:22 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=6E0888626E0CAC79F57149814E22DB4D – C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iexplore.exe
[2007/12/06 03:34:45 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=809D17D8FA0FDAEE07778CD821CAFFDE – C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe
[2007/01/08 19:08:42 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=93A6A4F5293AE19E3B37021AABCF0902 – C:\WINDOWS\ie7updates\KB931768-IE7\iexplore.exe
[2007/04/24 09:20:41 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=9B3516C1F30DA17ADD3818573047D63C – C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe
[2008/10/15 02:06:26 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=9D3DB9ADFABD2F0BC778EC03250A3ABB – C:\WINDOWS\ie7updates\KB961260-IE7\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2007/06/27 04:16:52 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=BD8502DFD53FC24FB8D6929DC46B8C2C – C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
[2008/06/23 03:23:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=C52A9EF571E91535EB78DB4B8B95EA07 – C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
[2007/02/28 01:51:34 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=D321092F8529CDAE843D6E24E3CAC6CB – C:\WINDOWS\$hf_mig$\KB931768-IE7\SP2QFE\iexplore.exe
[2004/08/04 02:56:52 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ie7\iexplore.exe
[2008/08/23 00:56:16 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=E8305C30D35E85D6657ED3E9934CB302 – C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe
[2007/10/10 05:59:52 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=E854D02E4231F704D9BE782A424E6D8B – C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe

< MD5 for: IEXPLORE.EXE.HDMP >
[2011/01/03 13:02:22 | 002,667,730 | —- | M] () MD5=3DC4CD34CB6CD342AA3C09ACCD12A090 – C:\Documents and Settings\Administrator\Local Settings\Temp\WERbc9b.dir00\iexplore.exe.hdmp
[2011/01/03 13:02:25 | 004,998,636 | —- | M] () MD5=EC03D7EAE5DFE9D115C63D8956FFA354 – C:\Documents and Settings\Administrator\Local Settings\Temp\WERbfbf.dir00\iexplore.exe.hdmp

< MD5 for: IEXPLORE.EXE.MDMP >
[2011/01/03 13:02:12 | 000,068,166 | —- | M] () MD5=1D4AC0EAC06F577742E5A28A060B093B – C:\Documents and Settings\Administrator\Local Settings\Temp\WERbfbf.dir00\iexplore.exe.mdmp
[2011/01/03 13:02:12 | 000,068,166 | —- | M] () MD5=6EE617B15FD7AD832504CB2EB3C49D8A – C:\Documents and Settings\Administrator\Local Settings\Temp\WERbc9b.dir00\iexplore.exe.mdmp

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui
[2006/10/17 13:04:26 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=E83C9C1F9DD9D47BB44871BFC7E69DDD – C:\WINDOWS\ie8\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-27122324.PF >
[2012/04/11 15:23:56 | 000,090,206 | —- | M] () MD5=8EDB038D353A749E45741F47B5B940A2 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf

< MD5 for: IEXPLORE.HL_ >
[2004/08/04 07:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\i386\IEXPLORE.HL_

< MD5 for: IEXPLORE.HLP >
[2001/07/21 20:35:08 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EX_ >
[2004/08/04 07:00:00 | 000,261,115 | —- | M] () MD5=F41C4F5745589D0BB8268C02B71594CA – C:\i386\WINLOGON.EX_

< MD5 for: WINLOGON.EXE >
[2004/08/04 02:56:58 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB7345$] -> Error: Cannot create file handle -> Unknown point type

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CF5C4195
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0A8E2C33

< End of report >

EXTRAS

OTL Extras logfile created on: 4/11/2012 3:30:58 PM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 279.90 Mb Available Physical Memory | 55.67% Memory free
843.57 Mb Paging File | 545.19 Mb Available in Paging File | 64.63% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 9.60 Gb Free Space | 25.76% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox – (Mozilla Corporation)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer – (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03286181-DB93-4998-9B4D-7BE32DCF5E33}" = E-Transcript Bundle Viewer
"{049D96D7-E082-4FB5-BF64-CD3460E6877C}_is1" = RootsMagic [removed]
"{12650598-D7B9-4FB5-91B2-2CAA641AC589}" = Trend Micro RUBotted
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{294A2E0E-3A0B-4D1F-8282-11DEF2040227}" = InstallIQ Updater
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{5EC9AD36-5167-470E-B0F9-CB3EA12F442E}" = Avery Wizard 3.1
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6CC93102-135E-49E2-99A4-C431E671C12A}" = HP Photo and Imaging 2.0 - Scanners
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142010}" = Java 2 Runtime Environment, SE v1.4.2_01
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8B611C23-ADB6-4F5E-A04A-959EB0D349F6}" = Winkflash Transporter
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro Titanium Internet Security
"{ABBD4BA9-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro™ Titanium™ Internet Security
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DAB561FF-4B4B-404E-A501-01DB882F57EE}" = Medical Litigator Images
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"Amazon Kindle For PC" = Amazon Kindle For PC
"AnswerWorks" = AnswerWorks Runtime
"AVS Media Player_is1" = AVS Media Player 3.1
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"CCleaner" = CCleaner
"Codec_264" = GeoVision H264
"Codec_amp4" = GeoVision MPEG4 ASP
"Codec_AVC" = GeoVision MPEG4 AVC
"Codec_jpeg" = GeoVision JPEG
"Codec_mp2" = GeoVision MPEG2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"COP Call Document_is1" = COP Call Document 3.0
"Corel Applications" = Corel Applications
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"FileZilla Client" = FileZilla Client [removed]
"Flash Slideshow Maker Pro" = Flash Slideshow Maker Pro 4.90
"GeoADPCM" = GeoVision ADPCM
"GEOXCodec" = GeoVision MPEG4
"halloweenmoon.exe" = halloweenmoon.exe
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{5EC9AD36-5167-470E-B0F9-CB3EA12F442E}" = Avery Wizard 3.1
"Learn_to_Play_Bridge" = Learn to Play Bridge
"Learn_to_Play_Bridge_2" = Learn to Play Bridge 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"Mozilla Thunderbird (2.0.0.18)" = Mozilla Thunderbird (2.0.0.18)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PC Pitstop Exterminate2_is1" = PC Pitstop Exterminate2 2.0
"PrimoPDF4.1.0.9" = PrimoPDF
"PROSet" = Intel® PRO Network Adapters and Drivers
"Software Setup" = Software Setup
"ST6UNST #1" = Limited Liability Companies
"ST6UNST #2" = Bridge Bidding Trainer V2.0 Basic Edition
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = Gimp 2.6.2 Debug
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 5.0.0.799
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/25/2012 4:11:08 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8328.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2012 5:46:22 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8328.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2012 5:46:59 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1001
Description = Fault bucket 2058867196.

Error - 4/2/2012 10:55:22 AM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 11.0.0.4454, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/2/2012 10:55:38 AM | Computer Name = PEGGY | Source = Application Hang | ID = 1001
Description = Fault bucket -1413921487.

Error - 4/11/2012 12:57:29 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.39.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/11/2012 12:59:37 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.39.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/11/2012 1:00:33 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.39.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/11/2012 1:24:15 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8328.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/11/2012 3:40:06 PM | Computer Name = PEGGY | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.39.2, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 4/11/2012 4:40:57 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:41:25 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:41:39 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:48:00 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:50:28 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:50:32 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:51:10 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:54:17 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:58:27 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 4/11/2012 4:58:34 PM | Computer Name = PEGGY | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

< End of report >

THANK YOU

oldman960

Post #5April 11, 2012, 9:46 PM UTC

Hi webster10,

There are several infections on this machine including a couple of rootkits with backdoor capailities. You may also wish to consider formatting and reinstalling.

I strongly suggest you do the following immediately:

From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
DO NOT change passwords or do any transactions while using the infected computer as the new passwords could become compromised.

Please read through the instructions to familarize youself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it is even started to download

Please download ComboFix from Link 1or Link 2 to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
-Tools->Options->Main tab
-Set to "Always ask me where to Save the files".
During the download, before you save it to your desktop, rename Combofix to jgh.exe

It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

———————————————————–

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

———————————————————–

Double click on ComboFix.exe (jgh.exe in your case) & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

combofix log

How is the computer?

Thanks

webster10

Post #6April 11, 2012, 11:42 PM UTC

Hi

Run ComboFix. 45 minutes and a couple of reboots.

Here is the log

ComboFix 12-04-11.03 - Administrator 04/11/2012 17:54:34.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.312 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\jgh.exe
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Zokupa
c:\documents and settings\Administrator\Application Data\Zokupa\kuve.exe
c:\documents and settings\Administrator\g2mdlhlpx.exe
c:\documents and settings\Administrator\My Documents\~WRL0344.tmp
c:\documents and settings\Administrator\My Documents\~WRL2123.tmp
c:\documents and settings\Administrator\My Documents\~WRL2988.tmp
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\tmp1B1A.tmp
c:\documents and settings\All Users\Application Data\tmp1E.tmp
c:\documents and settings\All Users\Application Data\tmp23.tmp
c:\documents and settings\All Users\Application Data\tmp29.tmp
c:\documents and settings\All Users\Application Data\tmp5B.tmp
c:\documents and settings\All Users\Application Data\tmp5C3.tmp
c:\documents and settings\All Users\Application Data\tmp68.tmp
c:\documents and settings\All Users\Application Data\tmp7B4.tmp
c:\documents and settings\All Users\Application Data\tmp8EB.tmp
c:\documents and settings\All Users\Application Data\tmp968.tmp
c:\program files\filesubmit
c:\program files\filesubmit\halloweenmoon.exe\UNWISE.EXE
C:\Thumbs.db
c:\windows\$NtUninstallKB7345$\1068901127\@
c:\windows\$NtUninstallKB7345$\1068901127\cfg.ini
c:\windows\$NtUninstallKB7345$\1068901127\Desktop.ini
c:\windows\$NtUninstallKB7345$\1068901127\L\nnznorar
c:\windows\$NtUninstallKB7345$\1068901127\oemid
c:\windows\$NtUninstallKB7345$\1068901127\U\00000001.@
c:\windows\$NtUninstallKB7345$\1068901127\U\00000002.@
c:\windows\$NtUninstallKB7345$\1068901127\U\00000004.@
c:\windows\$NtUninstallKB7345$\1068901127\U\80000000.@
c:\windows\$NtUninstallKB7345$\1068901127\U\80000004.@
c:\windows\$NtUninstallKB7345$\1068901127\U\80000032.@
c:\windows\$NtUninstallKB7345$\1068901127\version
c:\windows\$NtUninstallKB7345$\279185341
c:\windows\Downloaded Program Files\f3initialsetup1.0.0.15-3.inf
c:\windows\system32\6to4v32.dll
c:\windows\system32\certstore.dat
c:\windows\system32\co_mon.dll
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\flashpnt.dll
c:\windows\system32\LHidFilt.dll
c:\windows\system32\s616mdm.dll
c:\windows\system32\TNaviSrv.dll
c:\windows\system32\uninstall.exe
c:\windows\$NtUninstallKB7345$ . . . . Failed to delete
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_6TO4
——-\Legacy_ONESTEP_SERVICE
——-\Service_6to4
——-\Service_OneStep Service
——-\Legacy_qfcoresvc
——-\Service_qfcoresvc
.
.
((((((((((((((((((((((((( Files Created from 2012-03-11 to 2012-04-11 )))))))))))))))))))))))))))))))
.
.
2012-04-11 15:09 . 2012-04-11 15:09 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-04-11 13:53 . 2012-04-11 13:53 156672 —-a-w- c:\windows\system32\usbnaw32.dll
2012-04-11 13:53 . 2012-04-11 13:53 38400 —-a-w- c:\windows\system32\usbniw32.dll
2012-04-10 17:21 . 2012-04-10 17:21 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
2012-04-10 16:44 . 2012-04-10 16:44 ——– d—–w- c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E
2012-04-10 16:44 . 2012-04-11 19:28 ——– d—–w- c:\documents and settings\Administrator\Application Data\Qogoon
2012-04-10 16:44 . 2012-04-10 16:44 ——– d—–w- c:\documents and settings\Administrator\Application Data\Ucpi
2012-03-16 17:43 . 2012-03-16 17:43 592824 —-a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-16 17:43 . 2012-03-16 17:43 44472 —-a-w- c:\program files\Mozilla Firefox\mozglue.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-04 20:56 . 2011-08-19 21:29 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-03 09:22 . 2004-08-04 06:17 1860096 —-a-w- c:\windows\system32\win32k.sys
2006-11-16 13:59 . 2006-11-16 13:58 4264077 —-a-w- c:\program files\Garden.exe
2006-11-15 21:21 . 2006-11-15 21:12 21290704 —-a-w- c:\program files\AdbeRdr708_en_US.exe
2006-11-15 21:12 . 2006-11-15 21:12 774144 —-a-w- c:\program files\RngInterstitial.dll
2006-11-15 21:12 . 2006-11-15 21:06 7050552 —-a-w- c:\program files\psa30se_en_us.exe
2006-11-15 21:05 . 2006-11-15 21:05 762512 —-a-w- c:\program files\ytb612_efgsip.exe
2010-02-03 23:28 . 2010-02-03 23:28 28472 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2010-02-03 23:28 . 2010-02-03 23:28 185224 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2012-03-16 17:43 . 2011-09-01 19:45 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-08-09 1176064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-06 524800]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]
"TMRUBottedTray"="c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2008-11-06 288088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-10-08 1111568]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\intelUsb3Sevices]
2012-04-11 13:53 38400 —-a-w- c:\windows\system32\usbniw32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\usbniw32]
2012-04-11 13:53 38400 —-a-w- c:\windows\system32\usbniw32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 05:46 57344 —-a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 11:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 15:42 69632 —-a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMRUBottedTray]
2008-11-06 16:33 288088 —-a-w- c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-19 01:05 204288 ——w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [5/4/2011 9:19 AM 196320]
R2 NEC Usb3;NEC USB3 Service;c:\windows\System32\svchost.exe -k NECUsb3s [8/4/2004 2:56 AM 14336]
R2 RUBotted;Trend Micro RUBotted Service;c:\program files\Trend Micro\RUBotted\TMRUBotted.exe [8/15/2010 1:10 PM 582992]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\TMPassthru.sys [8/15/2010 1:10 PM 206608]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\drivers\TMPassthru.sys [8/15/2010 1:10 PM 206608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
NECUsb3s REG_MULTI_SZ NEC Usb3
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
z800obex
DC21x4
IntuitUpdateService
dpfusmgr
LMIRfsDriver
pelmouse
stylexpservice
qfcoresvc
nimdbgk
dladresm
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://go.compaq.com/1Q00CDT/0409/bl8.asp
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: westlaw.com
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: network.proxy.type - 1
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Qybyqa - c:\documents and settings\Administrator\Application Data\Zokupa\kuve.exe
SafeBoot-WinDefend
MSConfigStartUp-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
MSConfigStartUp-YSearchProtection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
AddRemove-halloweenmoon.exe - c:\progra~1\FILESU~1\HALLOW~1.EXE\UNWISE.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-11 18:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3979313402-542773266-82610348-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,19,a2,13,31,88,ff,21,4b,b6,f7,d8,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,19,a2,13,31,88,ff,21,4b,b6,f7,d8,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(908)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\usbniw32.dll
.
- - - - - - - > 'explorer.exe'(3936)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Trend Micro\AMSP\coreFrameworkHost.exe
c:\program files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\AGRSMMSG.exe
.
**************************************************************************
.
Completion time: 2012-04-11 18:37:26 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-11 23:37
.
Pre-Run: 10,849,824,768 bytes free
Post-Run: 20,193,124,352 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 705000F68EEA0FA3D855719C5B188B64

Several times it said such and such is corrupt and unreadable.
Please run Chkdsk. I would click ok.

Do I still need to run Chkdsk?

Thank you.

webster10

Post #7April 12, 2012, 12:05 AM UTC

Hi It has changed the screen display. When the browser is fully open, it does not occupy the full screen. It leaves a 1/2 inch black strip on the top, and an inch black strip on the side. Thanks.

oldman960

Post #8April 12, 2012, 8:39 AM UTC last edited April 12, 2012, 8:42 AM UTC

Hi webster10

You can change the display by clicking Start, click Control Panel, click Appearance and Themes, and then click Display.

1. On the Settings tab, under Screen resolution, drag the slider, and then click Apply.

2. When prompted to apply the settings, click OK. Your screen will turn black for a moment.

Once your screen resolution changes, you have 15 seconds to confirm the change. Click Yes to confirm the change; click No or do nothing to revert to your previous setting.

If it's just your browser you can use the mouse to dag the edges of the browser to fit the screen.

I need some information on some files. Please go to Virustotal Please submit these files for analysis

copy and paste (or use the choose file button to browse to the fles)the following into the choose file box (one at a time if more than one file is listed)

c:\windows\system32\usbniw32.dll
c:\windows\system32\usbnaw32.dll

click the Scan it button. Wait for the results and post them in your next reply.

If it says the file has all ready been analysed click reanalys.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the script starts with the :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NEC Usb3 /s
c:\documents and settings\Administrator\Application Data\Ucpi\*.* /s
c:\documents and settings\Administrator\Application Data\Qogoon\*.* /s
c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E\*.* /s
c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\*.* /s
/md5start
usbniw32.*
usbnaw32.*
/md5stop

Then click the Run Scan button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post back with

VirusTotal results
OTL log

webster10

Post #9April 12, 2012, 4:09 PM UTC

First Log Community Statistics Documentation FAQ About Join our community Sign in VirusTotal SHA256: fd91599ede418237294c7c7dbeaf0d437aaa35792bd2b6ab29ba8ddf38d243b4 File name: usbniw32.dll Detection ratio: 16 / 42 Analysis date: 2012-04-12 16:05:48 UTC ( 0 minutes ago ) 0 0 More details Antivirus Result Update AhnLab-V3 Trojan/Win32.Sasfis 20120411 AntiVir - 20120412 Antiy-AVL Trojan/Win32.Sasfis.gen 20120412 Avast Win32:Malware-gen 20120412 AVG - 20120412 BitDefender Gen:Variant.Zusy.3171 20120412 ByteHero - 20120412 CAT-QuickHeal - 20120412 ClamAV - 20120412 Commtouch - 20120412 Comodo TrojWare.Win32.TrojanDownloader.Murlo.~JH2 20120412 DrWeb Trojan.Siggen3.58595 20120412 Emsisoft Trojan.Win32.Sasfis!IK 20120412 eSafe - 20120412 eTrust-Vet - 20120412 F-Prot - 20120412 F-Secure Gen:Variant.Zusy.3171 20120412 Fortinet W32/Sasfis.DELU!tr 20120412 GData Gen:Variant.Zusy.3171 20120412 Ikarus Trojan.Win32.Sasfis 20120412 Jiangmin - 20120412 K7AntiVirus - 20120412 Kaspersky Trojan.Win32.Sasfis.delu 20120412 McAfee Generic.dx!bdxz 20120412 McAfee-GW-Edition Artemis!10B63B262FC9 20120412 Microsoft - 20120412 NOD32 - 20120412 Norman - 20120412 nProtect - 20120412 Panda Generic Trojan 20120412 PCTools - 20120412 Rising - 20120412 Sophos - 20120412 SUPERAntiSpyware - 20120402 Symantec Trojan.Gen 20120412 TheHacker - 20120412 TrendMicro - 20120412 TrendMicro-HouseCall - 20120412 VBA32 - 20120412 VIPRE - 20120412 ViRobot - 20120412 VirusBuster - 20120412

webster10

Post #10April 12, 2012, 4:11 PM UTC

Second Log Community Statistics Documentation FAQ About Join our community Sign in VirusTotal SHA256: e7110a2ba959915fca75a5c5bf02366f6e079f7e0748d71e6d7805422f75dfdf File name: usbnaw32.dll Detection ratio: 18 / 42 Analysis date: 2012-04-12 16:09:45 UTC ( 0 minutes ago ) 0 0 More details Antivirus Result Update AhnLab-V3 Trojan/Win32.Agent 20120411 AntiVir - 20120412 Antiy-AVL Trojan/Win32.Agent.gen 20120412 Avast Win32:Malware-gen 20120412 AVG BackDoor.Generic15.AHJU 20120412 BitDefender Gen:Variant.Refpron.1 20120412 ByteHero - 20120411 CAT-QuickHeal - 20120412 ClamAV - 20120412 Commtouch - 20120412 Comodo - 20120412 DrWeb BackDoor.Pigeon1.106 20120412 Emsisoft Trojan.Win32.Agent!IK 20120412 eSafe - 20120412 eTrust-Vet - 20120412 F-Prot - 20120412 F-Secure Gen:Variant.Refpron.1 20120412 Fortinet W32/Agent.HPEQ!tr 20120412 GData Gen:Variant.Refpron.1 20120412 Ikarus Trojan.Win32.Agent 20120412 Jiangmin Trojan/Agent.gdxu 20120412 K7AntiVirus - 20120412 Kaspersky Trojan.Win32.Agent.rwvl 20120412 McAfee Generic BackDoor.ut 20120412 McAfee-GW-Edition Generic BackDoor.ut 20120412 Microsoft - 20120412 NOD32 - 20120412 Norman - 20120412 nProtect - 20120412 Panda Trj/CI.A 20120412 PCTools - 20120412 Prevx - 20120412 Rising - 20120412 Sophos - 20120412 SUPERAntiSpyware - 20120402 Symantec Backdoor.Trojan 20120412 TheHacker - 20120412 TrendMicro - 20120412 TrendMicro-HouseCall - 20120412 VBA32 MalwareScope.Trojan-PSW.Game.16 20120412 VIPRE - 20120412 ViRobot - 20120412

webster10

Post #11April 12, 2012, 4:27 PM UTC

OTL seems to be locked up Manual File Scan - Getting Folder Structure. Also received several messages that system32/itlsvc.dat and $Mft are corrupt.

webster10

Post #12April 12, 2012, 4:29 PM UTC

OTL logfile created on: 4/12/2012 11:13:33 AM - Run 2
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 109.79 Mb Available Physical Memory | 21.84% Memory free
843.57 Mb Paging File | 473.50 Mb Available in Paging File | 56.13% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.68 Gb Free Space | 50.13% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\system32\usbniw32.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\libexpat.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\sqlite3.dll ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()

========== Win32 Services (SafeList) ==========

SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (NEC Usb3) – C:\WINDOWS\system32\usbnaw32.dll (Intel Corporation )
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (ialm) – system32\DRIVERS\ialmnt5.sys File not found
DRV - (iAimTV6) – system32\DRIVERS\wATV06nt.sys File not found
DRV - (iAimTV5) – system32\DRIVERS\wATV10nt.sys File not found
DRV - (iAimTV4) – system32\DRIVERS\wCh7xxNT.sys File not found
DRV - (iAimTV3) – system32\DRIVERS\wATV04nt.sys File not found
DRV - (iAimTV1) – system32\DRIVERS\wATV02NT.sys File not found
DRV - (iAimTV0) – system32\DRIVERS\wATV01nt.sys File not found
DRV - (iAimFP7) – system32\DRIVERS\wADV09nt.sys File not found
DRV - (iAimFP6) – system32\DRIVERS\wADV08nt.sys File not found
DRV - (iAimFP5) – system32\DRIVERS\wADV07nt.sys File not found
DRV - (iAimFP4) – system32\DRIVERS\wVchNTxx.sys File not found
DRV - (iAimFP3) – system32\DRIVERS\wSiINTxx.sys File not found
DRV - (iAimFP2) – system32\DRIVERS\wADV05NT.sys File not found
DRV - (iAimFP1) – system32\DRIVERS\wADV02NT.sys File not found
DRV - (iAimFP0) – system32\DRIVERS\wADV01nt.sys File not found
DRV - (i81x) – system32\DRIVERS\i81xnt5.sys File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (AgereSoftModem) – system32\DRIVERS\AGRSM.sys File not found
DRV - (aeaudio) – system32\drivers\aeaudio.sys File not found
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91}) Intel® Graphics Chipset (KCH) – system32\drivers\ialmkchw.sys File not found
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E}) Intel® Graphics Platform (SoftBIOS) – system32\drivers\ialmsbw.sys File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (redbook) – C:\WINDOWS\system32\drivers\redbook.sys ()
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..network.proxy.type: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/11 14:53:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/16 12:43:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/01 14:45:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\ [2012/04/10 12:21:40 | 000,000,000 | —D | M]

[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/12 10:47:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/10 12:21:40 | 000,000,000 | —D | M] (Translate This!) – C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
[2012/03/16 12:43:08 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/10/03 13:37:57 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/12 10:47:18 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2012/04/11 18:23:52 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10v_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O20 - Winlogon\Notify\intelUsb3Sevices: DllName - (usbniw32.dll) - C:\WINDOWS\System32\usbniw32.dll ()
O20 - Winlogon\Notify\usbniw32: DllName - (usbniw32.dll) - C:\WINDOWS\System32\usbniw32.dll ()
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v;=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xsxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1snxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1ttxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1raxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1pdxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1btxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1mdxx.sys
[2012/04/11 17:35:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/04/11 17:32:03 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/04/11 17:32:03 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/04/11 17:32:03 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/04/11 17:32:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/04/11 17:31:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/11 17:27:36 | 004,458,963 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/11 08:53:02 | 000,156,672 | —- | C] (Intel Corporation ) – C:\WINDOWS\System32\usbnaw32.dll
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/04/10 12:21:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
[2012/04/10 11:44:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E
[2012/04/10 11:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Ucpi
[2012/04/10 11:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Qogoon
[2012/03/19 16:11:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Amelunke
[2012/03/14 10:08:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Jansen

========== Files - Modified Within 30 Days ==========

[2012/04/12 10:56:22 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/12 03:41:39 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/12 03:38:35 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/12 03:37:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/12 03:15:02 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/04/12 03:15:02 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/04/12 03:04:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/04/11 18:23:52 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/11 17:35:31 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/04/11 17:26:00 | 004,458,963 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 12:01:03 | 000,000,499 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2012/04/11 11:28:10 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/11 09:05:05 | 000,038,964 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\meds411.png
[2012/04/11 08:59:46 | 000,000,198 | —- | M] () – C:\WINDOWS\System32\itlsvc.dat
[2012/04/11 08:53:02 | 000,156,672 | —- | M] (Intel Corporation ) – C:\WINDOWS\System32\usbnaw32.dll
[2012/04/11 08:53:01 | 000,038,400 | —- | M] () – C:\WINDOWS\System32\usbniw32.dll
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk
[2012/03/29 09:46:19 | 000,007,044 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/03/29 09:46:08 | 000,051,024 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\BELLIS General Warranty Deed 2012-1.pdf
[2012/03/19 14:39:57 | 000,051,464 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf
[2012/03/14 03:41:30 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012/04/11 17:35:30 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/04/11 17:35:14 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/04/11 17:32:03 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/04/11 17:32:03 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/04/11 17:32:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/04/11 17:32:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/04/11 17:32:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/04/11 14:04:47 | 000,038,964 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\meds411.png
[2012/04/11 12:01:03 | 000,000,499 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2012/04/11 11:28:10 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/04/11 08:59:46 | 000,000,198 | —- | C] () – C:\WINDOWS\System32\itlsvc.dat
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/11 08:53:01 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\usbniw32.dll
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/29 09:46:07 | 000,051,024 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\BELLIS General Warranty Deed 2012-1.pdf
[2012/03/19 14:41:22 | 000,051,464 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2011/08/19 16:14:29 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll

========== Custom Scans ==========

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NEC Usb3 /s >
"Type" = 288
"Start" = 2
"ErrorControl" = 1
"ImagePath" = %SystemRoot%\System32\svchost.exe -k NECUsb3s – [2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation)
"DisplayName" = NEC USB3 Service
"ObjectName" = LocalSystem
"Description" = Support USB3 Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NEC Usb3\Parameters]
"ServiceDll" = C:\WINDOWS\system32\usbnaw32.dll – [2012/04/11 08:53:02 | 000,156,672 | —- | M] (Intel Corporation )
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NEC Usb3\Security]
"Security" = [Binary data over 100 bytes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NEC Usb3\Enum]
"0" = Root\LEGACY_NEC_USB3\0000
"Count" = 1
"NextInstance" = 1

< c:\documents and settings\Administrator\Application Data\Ucpi\*.* /s >
[2012/04/10 11:49:33 | 000,415,853 | —- | M] () – c:\documents and settings\Administrator\Application Data\Ucpi\dufi.yks

< c:\documents and settings\Administrator\Application Data\Qogoon\*.* /s >

< c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E\*.* /s >
[2012/04/10 15:11:22 | 000,000,328 | —- | M] () – c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E\529C5327212C2CDD00006CCCD151FC4E

< c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\*.* /s >
[2012/04/10 12:21:40 | 000,000,131 | —- | M] () – c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\chrome.manifest
[2012/04/10 12:21:40 | 000,000,939 | —- | M] () – c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\install.rdf
[2012/04/10 12:21:40 | 000,006,239 | —- | M] () – c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\chrome\content\browser.xul

< MD5 for: USBNAW32.DLL >
[2012/04/11 08:53:02 | 000,156,672 | —- | M] (Intel Corporation ) MD5=20D7FDA5A2C473B0CF4A1EBD5153B41F – C:\WINDOWS\system32\usbnaw32.dll

< MD5 for: USBNIW32.DLL >
[2012/04/11 08:53:01 | 000,038,400 | —- | M] () MD5=10B63B262FC9D64535E4585514C0B130 – C:\WINDOWS\system32\usbniw32.dll

< End of report >

webster10

Post #13April 12, 2012, 4:31 PM UTC

I have TrendMicro Platinum, but it is always turning off.

oldman960

Post #14April 12, 2012, 10:32 PM UTC last edited April 12, 2012, 10:33 PM UTC

Hi webster10,

There's quite a few infections left which will cause various problems such as turning off your antivirus program. We'll work through them.

We will be using Combofix again but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/index.php?showtopic=122891&pid=780967&st=0&#entry780967

Collect::
C:\WINDOWS\system32\usbnaw32.dll
C:\WINDOWS\system32\usbniw32.dll

Folder::
c:\documents and settings\Administrator\Application Data\Ucpi
c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E
c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
c:\documents and settings\Administrator\Application Data\Qogoon

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
"NECUsb3s"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\intelUsb3Sevices]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\usbniw32]

Driver::
NEC Usb3

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

Next

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

🖼Click to load external image (Posted Image)
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

🖼Click to load external image (Posted Image)
Click the Start Scan button.

🖼Click to load external image (Posted Image)
If a suspicious object is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

🖼Click to load external image (Posted Image)
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Please post back with

combofix log
TDSSKiller log

Any better?

webster10

Post #15April 13, 2012, 1:45 AM UTC

ComboFix 12-04-11.03 - Administrator 04/12/2012 19:17:56.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.311 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\jgh.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
.
file zipped: c:\windows\system32\usbnaw32.dll
file zipped: c:\windows\system32\usbniw32.dll
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Qogoon
c:\documents and settings\Administrator\Application Data\Ucpi
c:\documents and settings\Administrator\Application Data\Ucpi\dufi.yks
c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}
c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\chrome\content\browser.xul
c:\documents and settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\install.rdf
c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E
c:\documents and settings\All Users\Application Data\529C5327212C2CDD00006CCCD151FC4E\529C5327212C2CDD00006CCCD151FC4E
c:\windows\system32\usbnaw32.dll
c:\windows\system32\usbniw32.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_NEC_USB3
——-\Service_NEC Usb3
.
.
((((((((((((((((((((((((( Files Created from 2012-03-13 to 2012-04-13 )))))))))))))))))))))))))))))))
.
.
2012-04-11 15:09 . 2012-04-11 15:09 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-03-16 17:43 . 2012-03-16 17:43 592824 —-a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-16 17:43 . 2012-03-16 17:43 44472 —-a-w- c:\program files\Mozilla Firefox\mozglue.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-04 20:56 . 2011-08-19 21:29 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-01 11:01 . 2004-08-04 07:56 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-03-01 11:01 . 2004-08-04 07:56 916992 —-a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-04 07:56 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-02-29 14:10 . 2005-03-21 21:57 148480 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 14:10 . 2004-08-04 07:56 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 12:17 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2012-02-03 09:22 . 2004-08-04 06:17 1860096 —-a-w- c:\windows\system32\win32k.sys
2006-11-16 13:59 . 2006-11-16 13:58 4264077 —-a-w- c:\program files\Garden.exe
2006-11-15 21:21 . 2006-11-15 21:12 21290704 —-a-w- c:\program files\AdbeRdr708_en_US.exe
2006-11-15 21:12 . 2006-11-15 21:12 774144 —-a-w- c:\program files\RngInterstitial.dll
2006-11-15 21:12 . 2006-11-15 21:06 7050552 —-a-w- c:\program files\psa30se_en_us.exe
2006-11-15 21:05 . 2006-11-15 21:05 762512 —-a-w- c:\program files\ytb612_efgsip.exe
2010-02-03 23:28 . 2010-02-03 23:28 28472 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2010-02-03 23:28 . 2010-02-03 23:28 185224 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2012-03-16 17:43 . 2011-09-01 19:45 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-08-09 1176064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-06 524800]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]
"TMRUBottedTray"="c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2008-11-06 288088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-10-08 1111568]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 05:46 57344 —-a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 11:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 15:42 69632 —-a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMRUBottedTray]
2008-11-06 16:33 288088 —-a-w- c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-19 01:05 204288 ——w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [5/4/2011 9:19 AM 196320]
R2 RUBotted;Trend Micro RUBotted Service;c:\program files\Trend Micro\RUBotted\TMRUBotted.exe [8/15/2010 1:10 PM 582992]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\TMPassthru.sys [8/15/2010 1:10 PM 206608]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\drivers\TMPassthru.sys [8/15/2010 1:10 PM 206608]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
z800obex
DC21x4
IntuitUpdateService
dpfusmgr
LMIRfsDriver
pelmouse
stylexpservice
qfcoresvc
nimdbgk
dladresm
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://go.compaq.com/1Q00CDT/0409/bl8.asp
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: westlaw.com
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: network.proxy.type - 1
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-12 19:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3979313402-542773266-82610348-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,19,a2,13,31,88,ff,21,4b,b6,f7,d8,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,19,a2,13,31,88,ff,21,4b,b6,f7,d8,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(908)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2192)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Trend Micro\AMSP\coreFrameworkHost.exe
c:\program files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\AGRSMMSG.exe
c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe
.
**************************************************************************
.
Completion time: 2012-04-12 19:54:14 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-13 00:54
ComboFix2.txt 2012-04-11 23:37
.
Pre-Run: 19,967,107,072 bytes free
Post-Run: 19,961,655,296 bytes free
.
- - End Of File - - 7675BC7C5CDF2DD0CC4926F03E16F84E
Upload was successful

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Smart Fortress 2012

✨ Ask AI

Ask AI