Spyware / Malware / Virus Removal

Infected by Virus? [Solved]

16 min read

Looking for the outcome? Ask AI

I_Need_Help555 Topic Starter

Post #1April 12, 2012, 5:58 AM UTC

I'm using a Dell Inspiron 530 with 3 GB RAM, Intel Core2 Quad CPU Q6600 @ 2.4 GHz. My OS is Vista Home Ultimate SP2.

Several days ago I discovered that all of my printer drivers had "disappeared". My first reaction was to go to the Backup and Restore Center, and restore the system from an earlier restore point. I picked one from several days before, and this seemed to do the trick (i.e. my printer drivers reappeared). I would have gone on about my business, but something was nagging at my memory. I went back to the Backup and Restore Center, and it was then I realized that several of the most recent restore points (dated after the one I used for the system restore - probably just a stroke of luck) were labeled:

"System: TITANUIMRES[0x01001101]"

My primary (paid-for) anti-malware software is "Trend Micro Titanium Maximum Security" and I guess the similarity in the names had nearly fooled me. I tried to open up the Trend Micro package (which requires entry of a password to access anything more than the intro console, e.g. I have to enter a password to see the details of system scans, etc.). When I entered the password, it immediately popped up a message saying it had emailed my password to one of my several email addresses, exactly the way it normally DOESN'T do. Uh oh. Something's definitely not right.

I've just run OTL. The contents of "OTL.txt":

OTL logfile created on: 4/12/2012 1:07:58 AM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\LeeAd\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.58 Gb Available Physical Memory | 52.70% Memory free
6.20 Gb Paging File | 4.07 Gb Available in Paging File | 65.67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 688.60 Gb Total Space | 409.21 Gb Free Space | 59.43% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 1.38 Gb Free Space | 13.80% Space Free | Partition Type: NTFS

Computer Name: HOMESYS | User Name: LeeAd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\LeeAd\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files\PKWARE\PKZIPM\12.10.0012\PKTray.exe (PKWARE, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Maxtor\OneTouch Status\MaxMenuMgr.exe (Maxtor Corporation)
PRC - C:\Program Files\Maxtor\Sync\SyncServices.exe (Seagate Technology LLC)
PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe (Sunbelt Software)
PRC - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (Sunbelt Software)
PRC - C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe (Gteko Ltd.)
PRC - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Windows\System32\pmxmiced.exe (Primax Electronics Ltd.)
PRC - C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Windows\System32\ico.exe (Primax Electronics Ltd.)
PRC - C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe (ScanSoft, Inc.)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
PRC - C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Google\Google Desktop Search\gzlib.dll ()
MOD - C:\Windows\CTXFIRES.DLL ()
MOD - C:\Windows\System32\APOMngr.DLL ()
MOD - C:\Windows\System32\CmdRtr.DLL ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
MOD - C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe ()

========== Win32 Services (SafeList) ==========

SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter File not found
SRV - (SBSDWSCService) – C:\Program Files\Spybot File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (Maxtor Sync Service) – C:\Program Files\Maxtor\Sync\SyncServices.exe (Seagate Technology LLC)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (BcmSqlStartupSvc) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
SRV - (SBCSSvc) – C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe (Sunbelt Software)
SRV - (RoxLiveShare10) – C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (Sonic Solutions)
SRV - (RoxWatch10) – C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe (Sonic Solutions)
SRV - (RoxMediaDB10) – C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions)
SRV - (DellAMBrokerService) – C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe ()
SRV - (AdobeActiveFileMonitor6.0) – C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()

========== Driver Services (SafeList) ==========

DRV - (sptd) – System32\Drivers\sptd.sys File not found
DRV - (SBAPIFS) – C:\Windows\system32\drivers\sbapifs.sys File not found
DRV - (rootrepeal) – C:\Windows\system32\drivers\rootrepeal.sys File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (CTHWIUT.DLL) – system32\CTHWIUT.DLL File not found
DRV - (CTEXFIFX.DLL) – system32\CTEXFIFX.DLL File not found
DRV - (CT20XUT.DLL) – system32\CT20XUT.DLL File not found
DRV - (blbdrive) – C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - ({1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}) – C:\Program Files\CyberLink\PowerDVD DX\000.fcl File not found
DRV - (tmwfp) – C:\Windows\System32\drivers\tmwfp.sys (Trend Micro Inc.)
DRV - (tmcomm) – C:\Windows\System32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (tmlwf) – C:\Windows\System32\drivers\tmlwf.sys (Trend Micro Inc.)
DRV - (tmtdi) – C:\Windows\System32\drivers\tmtdi.sys (Trend Micro Inc.)
DRV - (tmactmon) – C:\Windows\System32\drivers\tmactmon.sys (Trend Micro Inc.)
DRV - (tmevtmgr) – C:\Windows\System32\drivers\tmevtmgr.sys (Trend Micro Inc.)
DRV - (PCDSRVC{E9D79540-57D5953E-06020101}_0) – c:\Program Files\Dell Support Center\pcdsrvc.pkms (PC-Doctor, Inc.)
DRV - (AtiHdmiService) – C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (Revoflt) – C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (PCTCore) – C:\Windows\System32\drivers\PCTCore.sys (PC Tools)
DRV - (ha20x22k) – C:\Windows\System32\drivers\ha20x22k.sys (Creative Technology Ltd)
DRV - (ha20x2k) – C:\Windows\System32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTEXFIFX.SYS) – C:\Windows\System32\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV - (CTEXFIFX) – C:\Windows\System32\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV - (CTHWIUT.SYS) – C:\Windows\System32\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV - (CTHWIUT) – C:\Windows\System32\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV - (CT20XUT.SYS) – C:\Windows\System32\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV - (CT20XUT) – C:\Windows\System32\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (datunidr) – C:\Windows\System32\drivers\datunidr.sys (Gteko Ltd.)
DRV - (pmxmouse) – C:\Windows\System32\drivers\pmxmouse.sys (Primax Electronics Ltd.)
DRV - (pmxusblf) – C:\Windows\System32\drivers\pmxusblf.sys (Primax Electronics Ltd.)
DRV - (MXOPSWD) – C:\Windows\System32\drivers\mxopswd.sys (Maxtor Corp.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (HSXHWCD2) – C:\Windows\System32\drivers\HSXHWCD2.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (PTproct) – C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys (Gteko Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=_11eC9w…q={searchTerms}
IE - HKCU\..\SearchScopes\{AB79D3B4-AEDB-428a-B504-BAC00521A1C7}: "URL" = http://www.skywebsearch.com/search.php?sai…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.1808.5272\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\LeeAd\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\LeeAd\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2011/06/10 00:07:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/05 10:02:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/20 08:08:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/14 13:05:23 | 000,000,000 | —D | M]

[2010/03/09 23:13:11 | 000,000,000 | —D | M] (No name found) – C:\Users\LeeAd\AppData\Roaming\Mozilla\Extensions
[2010/10/07 23:11:20 | 000,000,000 | —D | M] (No name found) – C:\Users\LeeAd\AppData\Roaming\Mozilla\Firefox\Profiles\bybdu241.default\extensions
[2010/03/09 23:28:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\LeeAd\AppData\Roaming\Mozilla\Firefox\Profiles\bybdu241.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/09 23:28:05 | 000,000,000 | —D | M] (WOT) – C:\Users\LeeAd\AppData\Roaming\Mozilla\Firefox\Profiles\bybdu241.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/02/18 13:50:49 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/05/14 13:05:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/08 18:37:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/05 00:16:46 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/12 10:07:04 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/04/18 21:33:43 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2012/02/18 13:50:49 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012/02/18 13:50:15 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\LeeAd\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\LeeAd\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\LeeAd\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1808.5272\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: WOT = C:\Users\LeeAd\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.10_0\
CHR - Extension: YouTube = C:\Users\LeeAd\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google Search = C:\Users\LeeAd\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: AT_TomSachsV7 = C:\Users\LeeAd\AppData\Local\Google\Chrome\User Data\Default\Extensions\lppegiodmddaaljhkfjokkepamifbekj\3\
CHR - Extension: Gmail = C:\Users\LeeAd\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\

O1 HOSTS File: ([2010/03/04 00:53:13 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter File not found
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Updater] C:\Program Files\Google\Google Updater\GoogleUpdater.exe (Google)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [mxomssmenu] C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PKWARE Certificate Proxy Client] C:\Program Files\PKWARE\PKZIPW\pkpcsr.exe (PKWARE, Inc.)
O4 - HKLM..\Run: [PMX Daemon] C:\Windows\System32\ico.exe (Primax Electronics Ltd.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe (Sonic Solutions)
O4 - HKLM..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe (Sunbelt Software)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKCU..\Run: [DellAutomatedPCTuneUp] C:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E48E3E6-4D02-43D7-8C43-DB655581DDB1}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2008/06/16 19:39:03 | 000,000,042 | —- | M] () - C:\autorunsc.bat – [ NTFS ]
O32 - AutoRun File - [2008/06/16 19:45:16 | 000,100,412 | —- | M] () - C:\autorunsc.csv – [ NTFS ]
O32 - AutoRun File - [2008/06/16 19:39:03 | 000,249,856 | —- | M] (Sysinternals - www.sysinternals.com) - C:\autorunsc.exe – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/12 01:02:41 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Users\LeeAd\Desktop\OTL.exe
[2012/04/12 00:59:59 | 000,000,000 | —D | C] – C:\Users\LeeAd\Documents\Whatthetech
[2012/04/07 19:47:39 | 000,000,000 | —D | C] – C:\Users\LeeAd\AppData\Local\Adobe
[2012/03/14 22:20:06 | 000,613,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll
[2012/03/14 22:20:04 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2012/03/14 22:20:04 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2012/03/14 22:20:03 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2012/03/14 22:20:03 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2012/03/14 22:20:03 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2012/03/14 22:20:02 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[38 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/12 01:05:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1499513834-3245736753-3590406765-1003UA.job
[2012/04/12 01:02:42 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\LeeAd\Desktop\OTL.exe
[2012/04/12 00:57:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/12 00:37:20 | 000,003,568 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/12 00:37:20 | 000,003,568 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/11 15:01:59 | 000,000,422 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2012/04/11 10:05:00 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1499513834-3245736753-3590406765-1003Core.job
[2012/04/11 09:57:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/09 17:16:46 | 001,270,786 | —- | M] () – C:\Users\LeeAd\Documents\NEWSOFT
[2012/04/07 19:49:30 | 000,665,634 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/04/07 19:49:30 | 000,126,428 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/04/07 19:42:10 | 000,065,536 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2012/04/07 19:41:09 | 000,417,176 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/04/07 19:41:00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/07 19:40:52 | 3219,312,640 | -HS- | M] () – C:\hiberfil.sys
[2012/04/06 18:02:32 | 000,057,252 | —- | M] () – C:\Windows\System32\BMXStateBkp-{00000002-00000000-00000001-00001102-00000005-60021102}.rfx
[2012/04/06 18:02:32 | 000,057,252 | —- | M] () – C:\Windows\System32\BMXState-{00000002-00000000-00000001-00001102-00000005-60021102}.rfx
[2012/04/06 18:02:32 | 000,000,820 | —- | M] () – C:\Windows\System32\DVCState-{00000002-00000000-00000001-00001102-00000005-60021102}.rfx
[2012/04/06 17:58:08 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2012/04/05 11:16:06 | 000,008,160 | —- | M] () – C:\Users\LeeAd\AppData\Local\d3d9caps.dat
[2012/04/04 02:18:25 | 000,014,158 | —- | M] () – C:\Users\LeeAd\Documents\KP.kdbx
[2012/04/03 21:26:13 | 000,706,580 | —- | M] () – C:\Users\Public\Documents\Backup of VIDLISTS .xlk
[2012/04/02 14:25:14 | 035,983,536 | —- | M] () – C:\Users\LeeAd\AppData\Local\rx_image32.Cache
[2012/04/02 14:23:40 | 001,827,636 | —- | M] () – C:\Users\LeeAd\AppData\Local\rx_audio.Cache
[38 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/07 19:40:52 | 3219,312,640 | -HS- | C] () – C:\hiberfil.sys
[2012/01/15 23:21:24 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2011/12/17 18:12:30 | 000,000,146 | —- | C] () – C:\Windows\WININIT.INI

========== LOP Check ==========

[2008/07/17 02:17:41 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\Canon
[2010/01/15 04:26:05 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\ColorCop
[2008/06/06 01:06:21 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\DataSafeOnline
[2008/06/30 01:29:44 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\Genie-Soft
[2008/06/29 23:57:05 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\JAM Software
[2010/03/09 23:00:39 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\Javacool Software
[2012/03/12 23:59:58 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\KeePass
[2008/06/24 03:35:04 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\Maximum Output Software
[2010/03/04 23:09:29 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\NewSoft
[2011/06/11 20:58:51 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\OverDrive
[2010/10/29 19:44:08 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\PCDr
[2009/02/05 17:13:16 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\PKWARE
[2008/07/12 16:59:26 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\ScanSoft
[2011/09/11 01:48:48 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\Smart Recorder
[2009/05/19 23:42:25 | 000,000,000 | —D | M] – C:\Users\LeeAd\AppData\Roaming\StarBurn
[2012/04/06 17:58:08 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2012/04/06 18:02:19 | 000,032,606 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2012/04/11 15:01:59 | 000,000,422 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 17:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2008/06/16 19:39:03 | 000,000,042 | —- | M] () – C:\autorunsc.bat
[2008/06/16 19:45:16 | 000,100,412 | —- | M] () – C:\autorunsc.csv
[2008/06/16 19:39:03 | 000,249,856 | —- | M] (Sysinternals - www.sysinternals.com) – C:\autorunsc.exe
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/05/06 22:29:16 | 000,005,817 | RH– | M] () – C:\dell.sdr
[2012/04/07 19:40:52 | 3219,312,640 | -HS- | M] () – C:\hiberfil.sys
[2008/07/12 17:04:18 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/05/14 12:20:37 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2008/07/12 17:04:18 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/04/07 19:40:51 | 3533,127,680 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 08:35:26 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:35:26 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:35:26 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/28 20:32:23 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 08:34:09 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/03/04 14:00:16 | 000,811,776 | —- | M] (Space Sciences Laboratory) – C:\Windows\boinc.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/07/18 23:08:15 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 06:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 06:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 06:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/01/07 23:14:57 | 000,000,444 | -HS- | M] () – C:\Users\LeeAd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/03/29 17:58:50 | 055,330,872 | —- | M] (Advanced Micro Devices, Inc.) – C:\Users\LeeAd\Desktop\10-3_vista32_win7_32_dd_ccc_wdm_enu.exe
[2010/03/01 21:09:34 | 000,050,688 | —- | M] (Atribune.org) – C:\Users\LeeAd\Desktop\ATF_Cleaner.exe
[2008/06/19 00:27:23 | 077,896,616 | —- | M] (Sunbelt Software ) – C:\Users\LeeAd\Desktop\counterspy.exe
[2010/03/01 21:29:10 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\LeeAd\Desktop\erunt_setup.exe
[2010/03/03 22:05:08 | 016,258,848 | —- | M] (Sun Microsystems, Inc.) – C:\Users\LeeAd\Desktop\jre-6u18-windows-i586.exe
[2010/03/01 21:42:21 | 005,115,840 | —- | M] (Malwarebytes Corporation ) – C:\Users\LeeAd\Desktop\mbam-setup.exe
[2008/07/17 16:49:29 | 014,906,880 | —- | M] () – C:\Users\LeeAd\Desktop\MF4100_PrtDriver_V200Win_EN.exe
[2012/04/12 01:02:42 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\LeeAd\Desktop\OTL.exe
[2012/01/08 22:33:00 | 000,569,352 | —- | M] () – C:\Users\LeeAd\Desktop\PDFCreatorSetup.exe
[2010/03/04 20:46:05 | 006,595,320 | —- | M] (VS Revo Group ) – C:\Users\LeeAd\Desktop\RevoUninProSetup.exe
[2011/06/26 15:26:10 | 016,409,960 | —- | M] (Safer Networking Limited ) – C:\Users\LeeAd\Desktop\spybotsd162.exe
[2011/06/02 23:14:40 | 138,901,960 | —- | M] (Trend Micro Inc.) – C:\Users\LeeAd\Desktop\TIS17.5pro_dell_en_setup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-03-15 02:25:52

========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:84098FD3

< End of report >

And, the contents of "Extras.txt":

OTL Extras logfile created on: 4/12/2012 1:07:58 AM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\LeeAd\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.58 Gb Available Physical Memory | 52.70% Memory free
6.20 Gb Paging File | 4.07 Gb Available in Paging File | 65.67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 688.60 Gb Total Space | 409.21 Gb Free Space | 59.43% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 1.38 Gb Free Space | 13.80% Space Free | Partition Type: NTFS

Computer Name: HOMESYS | User Name: LeeAd | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 1
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{87EBC1BB-635F-417D-A9A7-90C6BB98E236}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5027134B-1998-44D1-9701-E9F5EF8F7F23}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{86D697F5-6D46-4630-8455-AD0FD28D5CD6}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}" = Sound Blaster X-Fi
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{239A8D60-270B-42e8-82D3-60D70A2942E0}" = Canon MF4100 Series
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{28996689-E20A-E63B-2BDA-B662AB807C87}" = ATI Catalyst Install Manager
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E2C691B-B7E6-4053-B5C3-94B8BC407E7A}" = Adobe Premiere Elements 4.0
"{448E2D77-E504-4221-B2C2-93646B344729}" = Mouse Suite for Desktop Computers
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6446BBD0-CB83-40E1-BEA1-0C147065E2A6}" = Maxtor Manager
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.1.1
"{6767DFEE-8909-453A-B553-C7693912B2EB}" = Canon MF Toolbox 4.9.1.1.mf09
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7136FE70-D1A9-42A5-9BBD-87C440701D9F}" = Sunbelt CounterSpy
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Roxio CinePlayer Decoder Pack
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro Titanium Maximum Security
"{ABBD4BA9-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro™ Titanium™ Maximum Security
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADF69C76-13FF-49F0-A078-922725A8B1B6}" = BOINC
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{BB2CB14A-F3A3-4BBF-9111-EBC82049ABA6}" = Roxio Creator Premier
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B6}" = WinZip 11.2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF5C7154-98F4-4D44-A58C-8BC19751CCCC}" = Roxio Creator Premier 10
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.14
"{D4AFC7AD-F637-4EDD-BC76-767E4AF78CE1}" = OverDrive Media Console
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{DB0BB9FA-1B60-4036-8E29-3D56D8085256}" = WOT for Internet Explorer
"{E24C2613-6453-4EFE-BDF5-5EA1CA22529E}" = SecureZIP for Windows 12.10.0012
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E8C06CB3-5DB2-4689-B1DC-4A0220DEA96C}" = Consumer Complete Care Services Agreement
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator Premier
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F85C7118-F3DC-4ED9-AB27-3E7931EA3D88}" = Adobe Premiere Elements 4.0 Templates
"{FE34691C-4298-4667-9758-D7F534DD0B94}" = Dell Automated PC TuneUp
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CD Wave Editor_is1" = CD Wave Editor 1.98
"CNXT_MODEM_USB_VID_0803&PID_1300" = Zoom V92 USB Faxmodem
"CobBackup9" = Cobian Backup 9
"Dell Support Center" = Dell Support Center
"eMusic Promotion" = 50 FREE MP3s +1 Free Audiobook!
"ERUNT_is1" = ERUNT 1.1j
"EULAlyzer_is1" = EULAlyzer 2.0
"Exact Audio Copy" = Exact Audio Copy 0.99pb5
"FileBack PC" = FileBack PC
"FLAC" = FLAC 1.2.1b (remove only)
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"GoToAssist" = GoToAssist 8.0.0.514
"InstallShield_{6446BBD0-CB83-40E1-BEA1-0C147065E2A6}" = Maxtor Manager
"IrfanView" = IrfanView (remove only)
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"OpenAL" = OpenAL
"PremElem40" = Adobe Premiere Elements 4.0
"PremElem40Templates" = Adobe Premiere Elements 4.0 Templates
"PROHYBRIDR" = 2007 Microsoft Office system
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"Spyware Doctor" = Spyware Doctor 7.0
"UltSounds" = Windows Sound Schemes
"UltSounds2" = Ultimate Extras sounds from Microsoft® Tinker™
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.11

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FoxTab PDF Creator" = FoxTab PDF Creator
"Google Chrome" = Google Chrome
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

What do I need to do next? Thank you in advance for any and all help…

Tomk

Post #2April 16, 2012, 6:01 AM UTC

Hi I_Need_Help555,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

I'm not seeing any obvious signs of infection.

As we work through your logs. Please remember to run any tools by Right-clicking on the icon and selecting Run As Administrator….

Let's give this a try:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

I_Need_Help555

Post #3April 17, 2012, 2:54 AM UTC

Tomk - thank you very much for offering to help me! (As the user name I selected suggests, I've come to suspect I need all the "help" I can get, probably in more ways than one).

BTW - I thought this topic would give me email notification of new posts; this doesn't seem to be working.

I'm not seeing any obvious signs of infection.

The OTL log I already posted may not be showing any obvious signs, but after all my printer drivers unexpectedly disappeared, and my Trend Micro "Titanium Maximum Security" anti-malware package unexpectedly (and inappropriately) popped up a message informing me that it was emailing the password I use for it to one of my email addresses, I have to believe that something's not working the way it ought to be.

As per your instructions, I downloaded Combofix to my desktop. I thought I'd disabled my anti-malware software (by right clicking and selecting from the menus as had always seemed to work in the past); however, when I started Combofix (by right-clicking and "running as administrator"), it informed me that one of the anti-malware programs, PC Tools Spyware Doctor, was still active. I again right-clicked on Spyware Doctor's icon in the menu tray, this time selecting "ShutDown" as opposed to "Disable Intelliguard" (which was the option I usually use to appropriate effect). In response, Spyware Doctor seemed to do as expected, indicating that it was shutting down its various "services" etc. However, Combofix next flashed a message that reported Spyware Doctor as still working, and said that it (Combofix) would still run, but at "my own risk", with no clear means to stop it at that point. My system seems to be working (at least no better or worse than before) so hopefully I didn't do any serious damage…

When Combofix started, it also stated that it would be saving the text file of its completed log to a specific location, C:\Combofix, which it did NOT appear to do - I went ahead and just saved that text file to my desktop for now. Combofix also did not reboot my system - however, as it seemed to delete all the icons from my system tray, including the anti-malware programs I wanted to re-start (perhaps in preparation for a reboot that didn't complete? maybe this was related to something about the interaction with Spyware Doctor?), I went ahead and rebooted the system on my own, and then restarted the anti-malware.

The log report produced by Combofix:

ComboFix 12-04-16.02 - LeeAd 04/16/2012 21:30:50.3.4 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.3069.1855 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Spyware Doctor with AntiVirus *Enabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
AV: Trend Micro Titanium Maximum Security *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
FW: Trend Micro Firewall Booster *Enabled* {49A8346C-6900-54B6-B1B3-5F678736DDE9}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Trend Micro Titanium Maximum Security *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\LeeAd\GoToAssistDownloadHelper.exe
c:\windows\system32\~GLH0025.TMP
c:\windows\system32\SET2D3D.tmp
c:\windows\system32\SET6932.tmp
c:\windows\system32\SETE69B.tmp
c:\windows\system32\SETED1F.tmp
c:\windows\system32\SETF9CE.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-03-17 to 2012-04-17 )))))))))))))))))))))))))))))))
.
.
2012-04-14 18:29 . 2012-04-14 18:29 ——– d—–w- c:\users\LeeAd\AppData\Local\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-18 17:50 . 2010-05-14 17:05 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-02-14 15:45 . 2012-03-15 02:20 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-15 02:20 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-02-13 14:12 . 2012-03-15 02:20 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-15 02:20 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-15 02:20 1068544 —-a-w- c:\windows\system32\DWrite.dll
2012-02-02 15:16 . 2012-03-15 02:20 2044416 —-a-w- c:\windows\system32\win32k.sys
2010-09-09 20:50 . 2010-09-09 20:51 119808 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-06 68856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DellAutomatedPCTuneUp"="c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe" [2007-10-11 465136]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SBCSTray"="c:\program files\Sunbelt Software\CounterSpy\SBCSTray.exe" [2007-12-21 698864]
"PMX Daemon"="ICO.EXE" [2006-11-08 49152]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-09 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-10-28 128296]
"PKWARE Certificate Proxy Client"="c:\progra~1\PKWARE\PKZIPW\pkpcsr.exe" [2008-03-28 226640]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-02-19 24576]
"Google Updater"="c:\program files\Google\Google Updater\GoogleUpdater.exe" [2009-12-29 160752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-10-08 1111568]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2007-12-14 244208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CtxfiReg"="CTXFIREG.exe" [2009-02-19 47104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2008-3-4 4150016]
SecureZIP Attachments Status.lnk - c:\program files\PKWARE\PKZIPM\12.10.0012\PKTray.exe [2009-2-5 197968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-06 19:27 10536 ——w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBCSSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001
.
— Other Services/Drivers In Memory —
.
*Deregistered* - PCTSDInjDriver32
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 21:23 38400 ——w- c:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 14:50 30720 ——w- c:\windows\System32\soundschemes2.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 00:25]
.
2012-04-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 00:25]
.
2012-04-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1499513834-3245736753-3590406765-1003Core.job
- c:\users\LeeAd\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-01 07:57]
.
2012-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1499513834-3245736753-3590406765-1003UA.job
- c:\users\LeeAd\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-01 07:57]
.
2012-04-06 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2010-10-27 16:39]
.
2012-04-16 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\pcdrcui.exe [2010-10-27 16:40]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\LeeAd\AppData\Roaming\Mozilla\Firefox\Profiles\bybdu241.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-16 21:47
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCDSRVC{E9D79540-57D5953E-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD DX\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,29,d2,55,4a,a8,94,4d,a8,31,8c,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,29,d2,55,4a,a8,94,4d,a8,31,8c,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2012-04-16 21:51:09
ComboFix-quarantined-files.txt 2012-04-17 01:51
.
Pre-Run: 436,509,196,288 bytes free
Post-Run: 436,529,934,336 bytes free
.
- - End Of File - - B0C77FE08A20E69C02C80F0A55C5E3F2

So… what next?

Thanks again!

Tomk

Post #4April 17, 2012, 4:34 AM UTC

Let's get an online scan:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

I_Need_Help555

Post #5April 17, 2012, 7:39 AM UTC

Weird. The email notification function seems to be working, now…

I followed your instructions to run the Eset scan. Unfortunately, although I thought I'd disabled my anti-virus software, a scheduled scan by the Trend Micro software that I'd forgotten about began to run (in "Quick-Scan" mode; it scanned about 179 files before I managed to stop it). The Eset scan still seemed to manage to make it through to completion… as far as I could tell, anyway.

Here's the scan log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f5eb3e415b8acc4e880f1790a1b5194b
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-04-17 07:25:17
# local_time=2012-04-17 03:25:17 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=256 16777215 100 0 119870519 119870519 0 0
# compatibility_mode=512 16777215 100 0 26041832 26041832 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776574 100 95 82213019 171249725 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=198805
# found=4
# cleaned=0
# scan_time=5446
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.F application (unable to clean) 00000000000000000000000000000000 I
C:\Users\LeeAd\Desktop\PDFCreatorSetup.exe a variant of Win32/InstallCore.F application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Public\Downloads\Program Downloads\Gimp\Gimp_Setup.exe Win32/Adware.iBryte application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Public\Downloads\Program Downloads\PDF Creator\PDFCreatorSetup.exe a variant of Win32/InstallCore.F application (unable to clean) 00000000000000000000000000000000 I

Thanks again…

Now what do I do?

Tomk

Post #6April 17, 2012, 2:17 PM UTC

No infection there either. The foxtabs detections are "Possibly unwanted programs". Those are programs that sometimes get bundled with other software. Part of our definition of malware is anything that is installed on your system without your permission. Those programs that got flagged should not be on your computer unless your purposefully put them there. I'm guessing that you installed foxtabpdfconverter on purpose. Either way… they do not represent any infection and could not cause the symptoms that you described.

The gimp detection is also suspect. The only antivirus scanner that is picking up potential adware attached is ESET. I think it's a false positive… but you've probably already installed the program so you don't need the installer routine anyway. We'll remove it just to be safe.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File::
C:\Users\Public\Downloads\Program Downloads\Gimp\Gimp_Setup.exe
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

I_Need_Help555

Post #7April 18, 2012, 4:40 AM UTC

Hmmm… more weirdness. The email notification feature worked the last time you posted, but not this morning (when it seems you posted again). No worries, I guess - until this is all resolved, I expect I'll be checking the forum frequently for updates regardless of the email notifications. It would be nice if they could work more consistently, though…

The only antivirus scanner that is picking up potential adware attached is ESET. I think it's a false positive… but you've probably already installed the program so you don't need the installer routine anyway. We'll remove it just to be safe.

Before I go any further, I need to say this. There's no denying that I don't have a great deal of tech expertise of my own (after all, entire books on this subject have been written about what I don't know, right?). And I have no doubt that your own expertise greatly outstrips my own, and probably that of most, if not all, of the people I know in my personal life. I certainly agree that I should generally defer to such expertise. That said, I feel that the following three points need to be restated and emphasized:

1) Something, I know not what, caused all of my printer drivers to suddenly "disappear" one morning. I certainly am not aware of having done anything so far out of the ordinary that I believe I might have caused that phenomenon myself.

2) Something, I know not what, set at least 3 or 4 "restore points" on my computer, each labeled "System: TITANUIMRES[0x01001101]"
(please note the odd spelling of the word "TITANUIMRES") - I know I did not do this and it had not ever happened before. And

3) Something, I know not what, caused my Trend Micro antivirus software to pop up a message stating that it was emailing the password I use to access its most "secure" features to one of my email addresses. Note, this obviously inappropriate behavior is NOT a function this software is even supposed to be able to do and certainly not one I was expecting it to do. Furthermore, I can confirm that something claiming to be from Trend Micro was, in fact, emailed to the address it indicated at exactly the time it said it was emailing my password. I can't confirm that it actually was my password because I deleted both of the emails (there were two of them) without opening them.

Now, I may be no expert. I may not know what caused these odd phenomena. But I think I'm on reasonably firm ground in concluding that… something… at least mischievous if not downright malicious, and absolutely uninvited and unwelcome, is still lurking somewhere in my computer, even if the scans we've run so far haven't managed to detect it. If, at the end of this process, we haven't been able to at least plausibly, and hopefully specifically, identify the causative agent of these unsettling phenomena and apply some appropriate remedial measure, I would be very frustrated and disappointed with that result. From the scans we've run, It may not yet look like anything serious is going on, but I'm still far from reassured by that. I'm trusting you and your colleagues to be able to help me figure this out.

All that said, I followed your latest instructions and ran Combofix with the script you provided. Deleting the Gimp installer was just fine with me. Once again, while Combofix generated a text file after running, it didn't store the text file in the location it indicated as it began to generate the file (C:\Combofix\…) Once again, it didn't reboot at the end of the process (although I rebooted manually, as this was necessary to restart my antivirus software).

The contents of the Combofix log file:

ComboFix 12-04-16.02 - LeeAd 04/17/2012 23:31:56.4.4 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.3069.1906 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\LeeAd\Desktop\CFScript.txt
AV: Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
AV: Trend Micro Titanium Maximum Security *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
FW: Trend Micro Firewall Booster *Enabled* {49A8346C-6900-54B6-B1B3-5F678736DDE9}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Trend Micro Titanium Maximum Security *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Public\Downloads\Program Downloads\Gimp\Gimp_Setup.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\Downloads\Program Downloads\Gimp\Gimp_Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-03-18 to 2012-04-18 )))))))))))))))))))))))))))))))
.
.
2012-04-18 03:45 . 2012-04-18 03:45 ——– d—–w- c:\users\Public\AppData\Local\temp
2012-04-18 03:45 . 2012-04-18 03:45 ——– d—–w- c:\users\no_one\AppData\Local\temp
2012-04-18 03:45 . 2012-04-18 03:45 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-04-18 03:45 . 2012-04-18 03:45 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2012-04-14 18:29 . 2012-04-14 18:29 ——– d—–w- c:\users\LeeAd\AppData\Local\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-18 17:50 . 2010-05-14 17:05 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-02-14 15:45 . 2012-03-15 02:20 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-15 02:20 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-02-13 14:12 . 2012-03-15 02:20 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-15 02:20 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-15 02:20 1068544 —-a-w- c:\windows\system32\DWrite.dll
2012-02-02 15:16 . 2012-03-15 02:20 2044416 —-a-w- c:\windows\system32\win32k.sys
2010-09-09 20:50 . 2010-09-09 20:51 119808 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-06 68856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DellAutomatedPCTuneUp"="c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe" [2007-10-11 465136]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SBCSTray"="c:\program files\Sunbelt Software\CounterSpy\SBCSTray.exe" [2007-12-21 698864]
"PMX Daemon"="ICO.EXE" [2006-11-08 49152]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-09 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-10-28 128296]
"PKWARE Certificate Proxy Client"="c:\progra~1\PKWARE\PKZIPW\pkpcsr.exe" [2008-03-28 226640]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-02-19 24576]
"Google Updater"="c:\program files\Google\Google Updater\GoogleUpdater.exe" [2009-12-29 160752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-10-08 1111568]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2007-12-14 244208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CtxfiReg"="CTXFIREG.exe" [2009-02-19 47104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BOINC Manager.lnk - c:\program files\BOINC\boincmgr.exe [2008-3-4 4150016]
SecureZIP Attachments Status.lnk - c:\program files\PKWARE\PKZIPM\12.10.0012\PKTray.exe [2009-2-5 197968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-06 19:27 10536 ——w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBCSSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 21:23 38400 ——w- c:\windows\System32\SoundSchemes.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 14:50 30720 ——w- c:\windows\System32\soundschemes2.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 00:25]
.
2012-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 00:25]
.
2012-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1499513834-3245736753-3590406765-1003Core.job
- c:\users\LeeAd\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-01 07:57]
.
2012-04-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1499513834-3245736753-3590406765-1003UA.job
- c:\users\LeeAd\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-01 07:57]
.
2012-04-06 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2010-10-27 16:39]
.
2012-04-17 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\pcdrcui.exe [2010-10-27 16:40]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\LeeAd\AppData\Roaming\Mozilla\Firefox\Profiles\bybdu241.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-17 23:45
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCDSRVC{E9D79540-57D5953E-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD DX\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,29,d2,55,4a,a8,94,4d,a8,31,8c,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,31,29,d2,55,4a,a8,94,4d,a8,31,8c,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2012-04-17 23:48:18
ComboFix-quarantined-files.txt 2012-04-18 03:48
ComboFix2.txt 2012-04-17 01:51
.
Pre-Run: 439,676,952,576 bytes free
Post-Run: 439,573,471,232 bytes free
.
- - End Of File - - 5E2F3623057E25977A169ED20A92D5E1

I hope that in my frustration I haven't sounded too cranky - believe me, I do appreciate all your effort and know you're trying to help. Thanks!

Tomk

Post #8April 18, 2012, 5:17 PM UTC

It is fine to question me. You don't know me from Adam and it's your computer we are dealing with. The bottom line is that what you do with your computer is your decision and basically all I can do is give advice, opinions and "steer" you in what I believe to be the right direction.
I have no doubt that everything you have said is true. In no way do a disbelieve you.
I can only "fix" what I can see. If I can't find and malware… I can't remove it. That doesn't mean that there wasn't something there at some time…. perhaps your onboard security already dealt with it - that is why you have it after all.
The "funny" restore points I believe are put there by your anti-virus program. I know very little about that particular program and have never had it on any computer I've owned… however, a restore point with that exact name appears in the logs of every computer with that antivirus installed I've ever read the logs of. It may be only anecdotal… but it sure appears to have been created by your program.
I'm not saying that you did… but when you enter your password in your antivirus program, there is a line directly below the box that you put the password in… that if clicked will email you your password. I'm not saying that you did that, but I can tell you that I have accidentally clicked the link beside or under the one I really wanted … maybe severl thousand times. It does happen.

All of that being said… none of those possibilities, nor anything I've been able to find on your computer, will explain the disappearance of your printer drivers. The only time I've seen that happen before - it wasn't caused by malware actually… it was caused by the user running one of those "snake oil" registry cleaners that borked the print spooler and somehow deleted the print drivers. I've also seen, first hand, computers for some unknown reason - "forget" that it has printer drivers. Forget is my only explanation because they are just gone and neither I nor the computer can find them… yet when the computer is rebooter… they magically appear. Weird… but I can't explain.

Anyhow… I understand your frustration… and even your potential disappointment… but I cannot, nor will I guarantee that I will find the root cause us the problem! I also don't believe in BSing you and I try to explain what is going on with your computer to the best of my ability. For example - ComboFix deleted some temp files that appear to be simply dross that is sometimes left as remnants from adware. I could have told you "There you go! That was your problem right there!" and you probably would have believed me. In fact, it is possible that remnants of some trojan caused those temp files… but… I don't believe that to be the case so I told you what I believed to be true. I'd like to qualify that statement though…. If we don't find anything in the next scan I'm going to ask you to do, and if you don't notice any more weirdness with your computer, then I'm going to believe that whatever caused your problem was contained in those temp files or your onboard antivirus already took care of it. Malware removal is a mixture of an art and science. Some infections leave a signature that we can see. We then kill it and get on with our life. Some infections leave no signature but are identifiable by the symptoms it causes. Same results. Some infections are partially removed by onboard security, and then perhaps partially removed by tools we use. There just might not be enough symptoms by the time someone posts on the forums to identify what happened… but no one loses to much sleep over it because the computer is behaving. And then there are lots of cases where someone posts that "things just don't seem the same as they used to be". Sometimes we find spyware, etc., but often the computer is just tired and bogged down with a myriad of downloaded garbage. Every problem with a computer is not caused by malware.

OK… that was rather long winded by I suspect you get the gist of what I'm trying to say.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

I_Need_Help555

Post #9April 19, 2012, 3:34 AM UTC

Tomk -

Please accept my apology. I reread my previous post and realize it sounded much harsher than I can assure you I'd really intended. I've had a lot of stress from other sources as well lately, and shouldn't have posted when I was tired. I also feel bad that I may, in effect, have been wasting time you could have spent helping others more in need of your capable assistance

given that it now seems likely my suspicion and alarm about the condition of my computer were merely the result of an unfortunate coincidence of odd but ultimately innocent quirks. In particular, I suppose I'm reassured by your observation about those restore points. I'd never noticed them before seeing that odd behavior with the printer drivers (and I still think it's darned odd that the name of the program would be mis-spelled in creating the restore points, but I suppose far stranger things have happened).

As for the antivirus program emailing the password: I must confess to being HUGELY embarrassed. Having never (yet) "forgotten" the password(s) I've used for that program, I never had occasion to click (at least, not deliberately) on the link labeled "Forgot your password?". I can honestly say that I'd reached the point of being at most barely even aware that link was there. The fact is, given the weird (and incredibly annoying) tendency I've long noticed in my OS for the focus of the mouse to shift at odd and unpredictable intervals (i.e. what the cursor is pointing to, and what the mouse is actually "pointing" to are occasionally two different things) I'm more amazed that this accident hadn't already happened long ago.

Well, now feeling suitably foolish and appropriately chastened, here are the contents of the aswMBR log file:

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-04-18 21:50:16
—————————–
21:50:16.903 OS Version: Windows 6.0.6002 Service Pack 2
21:50:16.903 Number of processors: 4 586 0xF0B
21:50:16.903 ComputerName: HOMESYS UserName: LeeAd
21:50:48.587 Initialize success
21:53:35.576 AVAST engine defs: 12041802
21:55:09.972 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
21:55:09.972 Disk 0 Vendor: ST3750640AS 3.ADG Size: 715404MB BusType: 3
21:55:09.987 Disk 0 MBR read successfully
21:55:09.987 Disk 0 MBR scan
21:55:10.003 Disk 0 Windows VISTA default MBR code
21:55:10.003 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
21:55:10.019 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 81920
21:55:10.034 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 705123 MB offset 21053440
21:55:10.050 Disk 0 scanning sectors +1465145344
21:55:10.190 Disk 0 scanning C:\Windows\system32\drivers
21:55:24.511 Service scanning
21:55:51.015 Modules scanning
21:56:10.422 Disk 0 trace - called modules:
21:56:10.765 ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys acpi.sys hal.dll ataport.SYS pciide.sys
21:56:10.765 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89cee500]
21:56:10.781 3 CLASSPNP.SYS[8e5cd8b3] -> nt!IofCallDriver -> [0x89ceed00]
21:56:10.781 5 PCTCore.sys[8e010891] -> nt!IofCallDriver -> [0x891a7268]
21:56:10.796 7 acpi.sys[8de976bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x891b8528]
21:56:13.417 AVAST engine scan C:\Windows
21:56:22.668 AVAST engine scan C:\Windows\system32
22:00:46.947 AVAST engine scan C:\Windows\system32\drivers
22:01:15.698 AVAST engine scan C:\Users\LeeAd
22:12:12.567 AVAST engine scan C:\ProgramData
22:19:10.881 Scan finished successfully
22:19:46.215 Disk 0 MBR has been saved successfully to "C:\Users\LeeAd\Desktop\MBR.dat"
22:19:46.231 The log file has been saved successfully to "C:\Users\LeeAd\Desktop\aswMBR.txt"

I suspect we're pretty close to the "finish line" at this point… what should I do next (perhaps a brave question given what you probably would like to suggest after reading my previous post)?

Tomk

Post #10April 19, 2012, 4:40 AM UTC

I_Need_Help555,

I accept your apology… but as far as I'm concerned, it's not really necessary. You were not rude, I was not offended. I did not intend to chasten you. You expressed what you were feeling - frustrated with a heavy dose of concern and maybe just a tinge of fear. Those are normal emotions and there is absolutely nothing wrong with expressing your feelings. Trust me… I get frustrated when someone comes here for help because their system is acting weird… and I cannot identify the problem - or worse… I can see the infection (or at least obvious results) and am unable to to find the "key" to removing it. A little about me. In "real-life" I'm a contractor and a farmer. By training, I'm an engineer. If you happen to know any contractors, farmers, or engineers in your personal life… you will understand that what we are at the core of our very being… problem solvers. We don't tend to be very creative "artistically", but we get fairly creative at "thinking outside the box" and solving problems. It's what drives us. When we fail to solve a problem, we take it personally. The vast majority of helpers at forums like WTT volunteer their time strictly because they enjoy helping others. For me, that's a bonus… but I do it because I enjoy the "hunt" of malware, and the challenge of "solving the problem". I'm a little selfish that way. My brother plays chess… I do this. For the most part… doing this relaxes me and gives my mind something to focus on. It's my therapy to escape from real life.

You are correct. We are going to wind this down. I am not finding anything currently active on your computer. That doesn't mean there never was a problem… it just indicates that whatever the problem was… it has been resolved. That's a good thing. Keep in mind that even when this thread has been closed - we are still here. If you think your system is acting "strange" again, come back and have things looked at. In fact, it something comes up in the next few days, PM me and I'll reopen the thread.

Let's do some housekeeping:

Click START then RUN
Now type ComboFix /Uninstall in the runbox and click OK.
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Double click on OTL to run it.
Click on CleanUp!
When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.

That should take care of most of the tools we put on your system. If something stays on your desktop… just go ahead and delete it.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

I_Need_Help555

Post #11April 20, 2012, 3:50 AM UTC

Tomk -

Thanks again for everything. I followed your latest instructions; ComboFix and OTL appear to have been uninstalled successfully. Are there any special procedures I should follow to uninstall the aswMBR, or should I just use the Windows uninstall process? Or, is there any particular advantage I should expect by leaving it on my system?

Tomk

Post #12April 20, 2012, 4:57 AM UTC

It really won't hurt anything to leave it on your system… but like most of the tools we use it is updated frequently as malware that it targets changes. Therefore it is unlikely there will be any benefit to keeping it. It also can be a little "dangerous" to just keep it as running one of it's fix routines when not needed… can have detrimental results. It is not "installed". We just ran it. Therefore you just need to drag it to the recycle bin to get rid of it.

I_Need_Help555

Post #13April 22, 2012, 11:28 PM UTC

Tomk - From your signature, I suspect you may not see this post until tomorrow. No matter - I just wanted to thank you once more for all your assistance, and let you know that you may now consider this thread closed.

Tomk

Post #14April 23, 2012, 4:04 AM UTC

I_Need_Help555, Yeah. I'm a little bit flaky when real life interferes. The summer range for our cattle is 4 hours away from home and several hours away from internet access. I spend quite a few weekends there. I hauled about half the cows and calves up there on Saturday so that time of year is at hand. You are very welcome. Remember that if something weird manifests itself again… to be shy in coming back and having us take a look. Good luck and be well.

Tomk

Post #15April 24, 2012, 1:34 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected by Virus? [Solved]

✨ Ask AI

Ask AI