What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Humbly need Help

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello jockster789

Thank you for the log.

Am I doomed?

Well, the cause of your redirects is doing a good job at avoiding detection, but there are still a few things we can try.

However, it would be wise (if you have not already done so) to back up all of your important data so you have it somewhere safe.


Lets see what the following can tell us:


  • OTL


  • Close all open windows on your computer then Double click on the OTL.exe icon to run the program.
  • Check the boxes beside "LOP Check" and "Purity Check".
  • Under Custom Scan paste this in:

%systemroot%\*. /rp /s
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop


  • Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.
  • Please Copy and Paste the contents of the OTL.Txt log in your next reply.
Post #17
Ok thanks

Here is the OTL log:

OTL logfile created on: 5/16/2012 6:37:14 PM - Run 2
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

484.98 Mb Total Physical Memory | 251.30 Mb Available Physical Memory | 51.82% Memory free
1.13 Gb Paging File | 0.88 Gb Available in Paging File | 77.48% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.83 Gb Total Space | 43.02 Gb Free Space | 29.70% Space Free | Partition Type: NTFS
Drive D: | 4.20 Gb Total Space | 1.68 Gb Free Space | 39.89% Space Free | Partition Type: FAT32
Drive H: | 976.13 Mb Total Space | 3.02 Mb Free Space | 0.31% Space Free | Partition Type: FAT

Computer Name: RYAN | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/15 21:10:16 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2011/01/12 16:41:42 | 000,810,144 | —- | M] (ESET) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2011/01/12 16:41:24 | 002,219,184 | —- | M] (ESET) – C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2009/05/08 10:35:50 | 002,780,432 | —- | M] () – C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009/05/08 10:34:08 | 000,559,888 | —- | M] () – C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/07/11 16:54:34 | 000,643,072 | —- | M] (Apple Inc.) – C:\Program Files\AirPort\APAgent.exe
PRC - [2005/09/21 16:32:56 | 002,807,808 | —- | M] (RealTek Semicoductor Corp.) – C:\WINDOWS\ALCWZRD.EXE
PRC - [2005/09/21 11:24:02 | 000,086,016 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\SOUNDMAN.EXE


========== Modules (No Company Name) ==========

MOD - [2009/05/08 10:35:50 | 002,780,432 | —- | M] () – C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009/05/08 10:34:08 | 000,559,888 | —- | M] () – C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - File not found [On_Demand | Stopped] – C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc – (gupdatem) Google Update Service (gupdatem)
SRV - File not found [Auto | Stopped] – C:\Program Files\Google\Update\GoogleUpdate.exe /svc – (gupdate) Google Update Service (gupdate)
SRV - File not found [On_Demand | Unknown] – C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} – (COMSysApp)
SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2012/04/25 14:06:31 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2011/01/12 16:44:02 | 000,033,584 | —- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe – (EhttpSrv)
SRV - [2011/01/12 16:41:42 | 000,810,144 | —- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe – (ekrn)
SRV - [2010/03/29 08:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/04/30 16:01:10 | 000,154,136 | —- | M] (Logitech Inc.) [Disabled | Stopped] – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcSrv)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Disabled | Stopped] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2007/02/20 21:35:02 | 000,073,728 | —- | M] (HP) [Disabled | Stopped] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\ZDNDIS5.SYS – (ZDNDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\wanatw4.sys – (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20050901.036\symidsco.sys – (SYMIDSCO)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\sunkfiltp.sys – (Sunkfiltp)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LV561AV.SYS – (PID_0928) Logitech QuickCam Express(PID_0928)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LV302AV.SYS – (PID_08A0) Logitech QuickCam IM(PID_08A0)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – C:\WINDOWS\system32\Drivers\nvport.sys – (nvport)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LVMVDrv.sys – (LVMVDrv)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LVcKap.sys – (LVcKap)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys – (catchme)
DRV - [2010/12/21 15:04:06 | 000,141,264 | —- | M] (ESET) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\eamon.sys – (eamon)
DRV - [2010/12/21 15:04:06 | 000,115,008 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\ehdrv.sys – (ehdrv)
DRV - [2010/12/21 13:47:38 | 000,094,872 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\epfwtdir.sys – (epfwtdir)
DRV - [2010/02/11 08:02:15 | 000,226,880 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tcpip6.sys – (Tcpip6)
DRV - [2009/04/30 19:03:30 | 000,023,832 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvuvcflt.sys – (FilterService)
DRV - [2009/04/30 19:03:08 | 006,754,712 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvuvc.sys – (LVUVC) Logitech Webcam 300(UVC)
DRV - [2009/04/30 19:01:36 | 000,265,496 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\lvrs.sys – (LVRS)
DRV - [2009/04/30 19:00:00 | 000,114,712 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvpopflt.sys – (lvpopflt)
DRV - [2009/04/30 18:55:58 | 002,687,512 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LV302V32.SYS – (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2009/04/30 18:55:34 | 000,013,976 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\lv302af.sys – (pepifilter)
DRV - [2009/04/30 16:00:12 | 000,025,624 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVPr2Mon.sys – (LVPr2Mon)
DRV - [2009/03/09 15:06:56 | 000,064,160 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\Lbd.sys – (Lbd)
DRV - [2008/04/13 14:56:06 | 000,088,320 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)
DRV - [2008/04/13 14:53:09 | 000,040,320 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmnt.sys – (nm)
DRV - [2008/02/29 04:13:36 | 000,079,120 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2008/02/29 04:12:56 | 000,063,120 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042mou.Sys – (L8042mou)
DRV - [2008/02/29 04:12:48 | 000,020,240 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.sys – (L8042Kbd)
DRV - [2007/01/23 16:45:00 | 000,034,576 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LHidFilt.Sys – (LHidFilt)
DRV - [2007/01/23 16:45:00 | 000,033,296 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LMouFilt.Sys – (LMouFilt)
DRV - [2007/01/23 16:45:00 | 000,028,176 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LUsbFilt.sys – (LUsbFilt)
DRV - [2006/12/14 22:41:56 | 000,041,248 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2006/02/08 12:55:24 | 000,009,856 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pfc.sys – (pfc)
DRV - [2005/09/23 19:56:28 | 003,966,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/07/28 15:43:41 | 000,008,413 | —- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\mcstrm.sys – (MCSTRM)
DRV - [2004/10/20 15:39:32 | 000,040,724 | —- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Sunkfilt.sys – (SunkFilt)
DRV - [2004/10/18 18:05:12 | 000,042,968 | —- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Sunkfilt39.sys – (SunkFilt39)
DRV - [2004/08/04 15:00:00 | 000,063,232 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)
DRV - [2004/08/04 15:00:00 | 000,055,936 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)
DRV - [2004/08/03 22:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/07/29 14:14:22 | 000,091,577 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\P0620Vid.sys – (PD0620VID)
DRV - [2004/06/17 18:56:22 | 000,220,032 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2004/06/17 18:55:38 | 000,685,056 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2004/06/17 18:55:04 | 001,041,536 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2004/04/15 21:34:52 | 000,385,792 | R— | M] (NETGEAR, Inc ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\netwg311.sys – (netwg311)
DRV - [2004/03/17 19:10:40 | 000,113,664 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Hdaudio.sys – (HdAudAddService)
DRV - [2003/07/18 01:57:34 | 000,007,850 | —- | M] (BTC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Maestro1.sys – (KeyMaestro)
DRV - [2003/05/15 18:29:42 | 000,038,656 | —- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ZD1201U.sys – (ZD1201U) ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB)
DRV - [2002/06/23 17:31:20 | 000,045,568 | R— | M] (D-Link Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DLKRTS.SYS – (DLKRTS)
DRV - [2001/08/17 17:06:20 | 000,100,992 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Icam5USB.sys – (ICAM5USB) Intel®
DRV - [2001/08/17 16:49:32 | 000,019,968 | —- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mxnic.sys – (mxnic)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = MSN
IE - HKCU\..\SearchScopes\Google: "URL" = http://www.google.com/search?sourceid=ie7&…e=utf8&q;=%s
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.10: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/25 14:06:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/04 23:30:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012/04/28 12:48:04 | 000,000,000 | —D | M]

[2011/05/28 16:24:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2012/05/14 04:31:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ihg2zc8p.default\extensions
[2011/05/30 00:26:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ihg2zc8p.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2012/05/14 04:32:09 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ks4k1kin.New\extensions
[2012/05/14 04:32:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ofjvt90x.New2\extensions
[2012/02/18 02:29:01 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/05/14 04:31:57 | 000,004,733 | —- | M] () (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IHG2ZC8P.DEFAULT\EXTENSIONS\[removed]
[2009/08/21 00:41:44 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012/04/25 14:06:30 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 06:42:53 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 06:42:53 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/05/13 16:24:23 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1169705253312 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240972999800 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3927DF1E-CE09-4489-BA32-6E78017C63DC}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/26 14:04:39 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2003/08/08 17:24:26 | 000,000,045 | -HS- | M] () - D:\autorun.inf.aug.8 – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/05/16 13:24:42 | 000,000,000 | —D | C] – C:\_OTL
[2012/05/16 09:18:27 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/05/15 21:09:57 | 000,595,456 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/05/14 13:39:21 | 000,000,000 | —D | C] – C:\Rooter$
[2012/05/14 13:38:16 | 000,173,119 | —- | C] (Eric_71) – C:\Documents and Settings\Owner\Desktop\Rooter.exe
[2012/05/14 03:58:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\images
[2012/05/13 16:29:09 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/05/13 14:04:51 | 002,075,184 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2012/05/11 21:31:14 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/05/11 21:27:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\GooredFix Backups
[2012/05/11 21:26:50 | 000,071,398 | —- | C] (jpshortstuff) – C:\Documents and Settings\Owner\Desktop\GooredFix.exe
[2012/05/11 19:28:46 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/05/11 19:28:46 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/05/11 19:28:46 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/05/11 19:28:46 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/05/11 19:26:04 | 004,490,638 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2012/05/10 23:48:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\Born
[2012/05/09 14:35:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\Uneedit
[2012/04/28 12:48:03 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/04/28 12:48:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ESET
[2012/04/28 12:48:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\ESET
[2012/04/25 14:06:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla
[2012/04/25 14:06:49 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service

========== Files - Modified Within 30 Days ==========

[2012/05/16 13:27:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/05/16 13:27:29 | 508,608,512 | -HS- | M] () – C:\hiberfil.sys
[2012/05/15 21:10:16 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/05/14 13:38:16 | 000,173,119 | —- | M] (Eric_71) – C:\Documents and Settings\Owner\Desktop\Rooter.exe
[2012/05/14 13:31:45 | 000,139,264 | —- | M] () – C:\Documents and Settings\Owner\Desktop\SystemLook.exe
[2012/05/14 01:19:19 | 000,017,408 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/13 16:24:23 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/05/13 14:03:52 | 002,055,783 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2012/05/12 15:43:59 | 000,002,353 | —- | M] () – C:\Picture 73.jpg
[2012/05/12 15:29:57 | 000,375,784 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/05/12 15:29:57 | 000,060,682 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/05/12 15:17:57 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/05/11 21:26:51 | 000,071,398 | —- | M] (jpshortstuff) – C:\Documents and Settings\Owner\Desktop\GooredFix.exe
[2012/05/11 19:26:47 | 004,490,638 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2012/05/10 00:30:46 | 000,410,288 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/08 11:36:57 | 000,483,171 | —- | M] () – C:\Documents and Settings\Owner\Desktop\DSC_0020.jpg
[2012/05/08 11:36:40 | 000,837,535 | —- | M] () – C:\Documents and Settings\Owner\Desktop\DSC_0027.jpg
[2012/05/03 23:58:15 | 000,012,599 | —- | M] () – C:\Picture 72.jpg
[2012/05/02 10:00:04 | 002,075,184 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2012/05/01 22:40:30 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/01 16:26:31 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2012/05/01 14:24:22 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2012/04/27 04:06:02 | 005,454,470 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Video 35.wmv
[2012/04/24 22:18:29 | 000,018,383 | —- | M] () – C:\Documents and Settings\Owner\Desktop\IDdi.jpg

========== Files Created - No Company Name ==========

[2012/05/14 13:31:44 | 000,139,264 | —- | C] () – C:\Documents and Settings\Owner\Desktop\SystemLook.exe
[2012/05/13 21:21:12 | 001,593,741 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 064.jpg
[2012/05/13 21:20:54 | 002,553,847 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 102.jpg
[2012/05/13 21:20:35 | 002,525,665 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 100.jpg
[2012/05/13 21:20:23 | 002,741,360 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 099.jpg
[2012/05/13 21:19:22 | 001,499,378 | —- | C] () – C:\Documents and Settings\Owner\My Documents\DSC_0005.JPG
[2012/05/13 21:19:13 | 002,890,408 | —- | C] () – C:\Documents and Settings\Owner\My Documents\DSC_0002.JPG
[2012/05/13 18:18:21 | 508,608,512 | -HS- | C] () – C:\hiberfil.sys
[2012/05/13 14:03:34 | 002,055,783 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2012/05/12 15:43:59 | 000,002,353 | —- | C] () – C:\Picture 73.jpg
[2012/05/12 15:34:26 | 000,302,592 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.exe
[2012/05/11 19:28:46 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/05/11 19:28:46 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/05/11 19:28:46 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/05/11 19:28:46 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/05/11 19:28:46 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/05/08 11:36:51 | 000,483,171 | —- | C] () – C:\Documents and Settings\Owner\Desktop\DSC_0020.jpg
[2012/05/08 11:36:31 | 000,837,535 | —- | C] () – C:\Documents and Settings\Owner\Desktop\DSC_0027.jpg
[2012/05/03 23:58:15 | 000,012,599 | —- | C] () – C:\Picture 72.jpg
[2012/04/30 17:34:01 | 005,454,470 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Video 35.wmv
[2012/04/24 22:18:29 | 000,018,383 | —- | C] () – C:\Documents and Settings\Owner\Desktop\IDdi.jpg
[2011/12/17 16:28:22 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\LFKODAK.DLL
[2011/12/17 16:28:21 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\LFFPX7.DLL
[2011/12/17 16:27:48 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\gif89.dll
[2011/12/17 16:26:45 | 000,000,065 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2010/07/25 05:01:40 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat

========== LOP Check ==========

[2012/04/12 00:08:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2009/07/15 21:52:43 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2012/03/06 00:24:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Driver Tool
[2012/04/28 12:48:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2005/07/01 00:45:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Aim
[2012/02/06 03:43:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Blackboard
[2012/02/06 03:15:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Collaborate
[2012/02/22 04:10:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ImgBurn
[2005/06/30 02:18:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2005/11/14 03:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Netscape
[2010/05/08 06:11:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2005/06/28 04:16:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template

========== Purity Check ==========



========== Custom Scans ==========

< %systemroot%\*. /rp /s >

< MD5 for: EXPLORER.EXE >
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 07:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 06:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 15:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2008/04/13 20:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 20:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 20:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/04 15:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 15:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 20:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 20:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 20:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 15:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

========== Files - Unicode (All) ==========
[2006/08/11 05:21:31 | 000,000,000 | —D | M](C:\Do????nts and Settings) – C:\Doጓᐔᐔጓnts and Settings
[2006/08/11 05:21:31 | 000,000,000 | —D | C](C:\Do????nts and Settings) – C:\Doጓᐔᐔጓnts and Settings

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
[C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction

< End of report >
Post #18
Hello jockster789

Thank you for the log.

Please see if you can now run Combofix from Normal mode.

Make sure that you disable all security programs before running it, and if you are notified that updates are available please allow them to be installed.
Post #19
Thanks.
I was able to run CF in normal mode. Here is the log:

ComboFix 12-05-17.05 - Owner 05/17/2012 17:36:23.13.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.485.141 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\offitems.log
.
.
((((((((((((((((((((((((( Files Created from 2012-04-17 to 2012-05-17 )))))))))))))))))))))))))))))))
.
.
2012-05-16 17:24 . 2012-05-16 17:24 ——– d—–w- C:\_OTL
2012-05-14 17:39 . 2012-05-14 17:39 ——– d—–w- C:\Rooter$
2012-05-12 01:31 . 2012-05-12 01:31 ——– d—–w- C:\TDSSKiller_Quarantine
2012-04-28 16:48 . 2012-04-28 16:48 ——– d—–w- c:\program files\ESET
2012-04-28 16:48 . 2012-04-28 16:48 ——– d—–w- c:\documents and settings\All Users\Application Data\ESET
2012-04-25 18:06 . 2012-04-25 18:06 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-04-25 18:06 . 2012-04-25 18:06 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-25 18:06 . 2012-04-25 18:06 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-11 13:12 . 2004-08-26 16:12 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 13:10 . 2004-08-26 16:12 2192640 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 12:35 . 2004-08-04 05:59 2069120 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-04 19:56 . 2010-05-09 03:01 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-11 04:03 . 2006-07-30 08:56 81920 -c–a-w- c:\windows\ALCFDRTM.VER
2012-03-11 04:03 . 2006-07-30 08:56 81920 -c–a-w- c:\windows\ALCFDRTM.EXE
2012-02-29 14:10 . 2004-08-26 16:12 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-26 16:11 148480 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-28 18:50 . 2004-08-26 16:12 667136 —-a-w- c:\windows\system32\wininet.dll
2012-02-28 18:50 . 2004-08-26 16:12 61952 —-a-w- c:\windows\system32\tdc.ocx
2012-02-28 18:50 . 2004-08-26 16:11 81920 —-a-w- c:\windows\system32\ieencode.dll
2012-02-28 13:50 . 2004-08-26 16:11 369664 —-a-w- c:\windows\system32\html.iec
2012-04-25 18:06 . 2012-02-18 06:29 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-05-08 2780432]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 61952]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 2807808]
"AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2007-07-11 643072]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2009-05-06 09:42 2356088 —-a-w- c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-05-08 14:35 2780432 —-a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 14:17 5252408 —-a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MDM"=2 (0x2)
"YahooAUService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"LVPrcSrv"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\AirPort\\APAgent.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:UDP"= 5353:UDP:Bonjour
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [3/31/2009 3:40 AM 64160]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [12/21/2010 3:04 PM 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12/21/2010 1:47 PM 94872]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [1/12/2011 4:41 PM 810144]
R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:\windows\system32\drivers\DLKRTS.SYS [9/7/2005 10:37 PM 45568]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe /svc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe /medsvc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/25/2012 2:06 PM 129976]
S3 ZD1201U;ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB);c:\windows\system32\drivers\ZD1201U.sys [6/27/2005 4:56 PM 38656]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;\??\c:\windows\system32\ZDNDIS5.SYS –> c:\windows\system32\ZDNDIS5.SYS [?]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" –> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ihg2zc8p.default\
.
.
——- File Associations ——-
.
.
- - - - ORPHANS REMOVED - - - -
.
HKU-Default-Run-Help - c:\documents and settings\Owner\Local Settings\Application Data\Sun\Help\hlvpvugpx.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-17 17:47
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-05-17 17:51:27
ComboFix-quarantined-files.txt 2012-05-17 21:51
ComboFix2.txt 2012-05-13 20:29
ComboFix3.txt 2012-05-12 00:09
ComboFix4.txt 2012-02-03 22:28
.
Pre-Run: 46,123,012,096 bytes free
Post-Run: 46,108,487,680 bytes free
.
- - End Of File - - 7DEA6FE4B41730B137B29CA811A8DE31
Post #20
Hello jockster789

Since there is nothing obvious jumping out from your Combofix log we will have to look a little deeper.


  • Please work through the following steps

    You will need a USB drive, a CD and access to an uninfected machine.

  • Download GETxPUD.exe to the desktop of the uninfected computer.
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and when finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Do a quick format of the USB stick:


  • Insert your USB drive ino the uninfected machine.
  • Click on Start > My Computer > Right click your USB drive > choose Format > Quick format.


  • Next download driver.sh to the USB stick
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Click on File
  • Expand mnt
  • sda1 or 2…which usually corresponds to your HDD
  • sdb1 is likely your USB
  • Expand your USB (sdb1)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top menu bar
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • If successful, the script will check all your drivers
  • After it has finished a report will be located in the USB drive as report.txt

Post the report.txt in your next reply.
Post #23
Due to lack of response, this topic is now closed. If you are the topic starter and need this topic reopened, please PM a staff member (include the address of this thread in your request). Everyone else please start a new topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI