Satchfan
Apologies but the website had problems today.
Will look as soon as I can and reply tomorrow - late here now and a very early start tomorrow.
Spyware / Malware / Virus Removal
Heavily Infected [Solved]
17 min read
Satchfan
Hi
when i click new tab I get a page laid out with boxes of previously visited pages
Still not a lot showing. We’ll clear up a couple of bits that I found and do an online scan to be sure all is OK,
Run OTL
Run ESET Online Scan
Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.
NOTE. If Eset doesn't find any threats, it won't produce a log.
Logs to include in the next post:
OTL fix log
New OTL log
when i click new tab I get a page laid out with boxes of previously visited pages
Still not a lot showing. We’ll clear up a couple of bits that I found and do an online scan to be sure all is OK,
Run OTL
- double click on the icon to run it.
- copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL
:Services :OTL IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…0006cf0492d34df [2012/07/26 10:37:46 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool (1) [2012/07/25 19:58:06 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool Commands [purity] [emptytemp] [Reboot]
- click the Run Fix button at the top
- let the program run unhindered, reboot when it is done
- post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
Run ESET Online Scan
Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.
NOTE. If Eset doesn't find any threats, it won't produce a log.
Logs to include in the next post:
OTL fix log
New OTL log
Brigow
Hi Satchfan,
As requested, here are the three logs.
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
C:\Program Files\Adjugglercookie Removal Tool (1)\Results folder moved successfully.
C:\Program Files\Adjugglercookie Removal Tool (1) folder moved successfully.
C:\Program Files\Adjugglercookie Removal Tool\Results folder moved successfully.
C:\Program Files\Adjugglercookie Removal Tool folder moved successfully.
File rity] not found.
File ptytemp] not found.
File boot] not found.
OTL by OldTimer - Version 3.2.55.0 log created on 08022012_211001
Files\Folders moved on Reboot…
PendingFileRenameOperations files…
Registry entries deleted on Reboot…
________________________________________________________________________________
___________________
OTL logfile created on: 3/08/2012 8:36:03 AM - Run 6
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy
1.97 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 56.18% Memory free
3.81 Gb Paging File | 2.94 Gb Available in Paging File | 77.02% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.57 Gb Total Space | 41.15 Gb Free Space | 59.15% Space Free | Partition Type: NTFS
Drive D: | 396.19 Gb Total Space | 283.39 Gb Free Space | 71.53% Space Free | Partition Type: NTFS
Computer Name: USER-84F12D431F | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2012/07/28 17:36:35 | 000,161,776 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/07/14 10:17:11 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/05/25 04:39:22 | 027,112,840 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2012/01/24 16:24:26 | 002,416,480 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/11/28 00:19:04 | 001,229,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgfws.exe
PRC - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/09/08 19:53:26 | 000,743,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/08/15 05:21:40 | 000,337,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/01/04 20:25:02 | 000,094,208 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
PRC - [2010/01/04 20:24:24 | 000,077,824 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
PRC - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009/08/04 17:29:52 | 000,346,320 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2012/07/27 12:50:16 | 009,465,032 | —- | M] () – C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
MOD - [2012/07/14 10:17:14 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/07/10 13:21:10 | 000,132,704 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
MOD - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/02/20 21:29:04 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/07/05 07:32:38 | 000,010,752 | —- | M] () – C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2009/08/16 17:06:02 | 000,141,312 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/07/30 18:15:32 | 000,503,202 | —- | M] () – C:\Program Files\DeviceVM\Browser Configuration Utility\sqlite3.dll
MOD - [2009/03/13 11:30:44 | 000,109,096 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009/03/11 12:41:42 | 000,049,152 | —- | M] () – C:\Program Files\OxelonMedia\menuext.dll
MOD - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
MOD - [2007/05/22 14:53:10 | 000,006,656 | —- | M] () – C:\Program Files\WinAVI Video Converter\SimpleExt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - [2012/07/28 17:36:35 | 000,161,776 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/07/27 12:50:19 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/14 10:17:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/11 10:45:52 | 004,419,392 | —- | M] () [Auto | Running] – c:\program files\common files\akamai/netsession_win_4f7fccd.dll – (Akamai)
SRV - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgfws.exe – (avgfws)
SRV - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE – (!SASCORE)
SRV - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) [Auto | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe – (TuneUp.UtilitiesSvc)
SRV - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) [Auto | Running] – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe – (BCUService)
SRV - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () [Auto | Running] – C:\Program Files\Gigabyte\EasySaver\essvr.exe – (ES lite Service)
SRV - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\Drivers\SYMEVENT.SYS – (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys – (SiwvidStart)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\ComboFix\catchme.sys – (catchme)
DRV - [2012/08/02 21:11:19 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\gdrv.sys – (gdrv)
DRV - [2012/04/28 18:32:29 | 000,023,456 | —- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DrvAgent32.sys – (DrvAgent32)
DRV - [2011/10/07 05:23:48 | 000,230,608 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2011/10/04 05:21:42 | 000,016,720 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2011/09/13 05:30:10 | 000,032,592 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/08/08 21:15:34 | 000,067,664 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2011/08/08 21:15:33 | 000,012,880 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2011/08/08 05:08:58 | 000,040,016 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/07/13 17:09:26 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2011/07/11 00:14:38 | 000,295,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2011/07/11 00:14:28 | 000,024,272 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2011/07/11 00:14:28 | 000,023,120 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AVGIDSEH.sys – (AVGIDSEH)
DRV - [2011/07/11 00:14:26 | 000,134,608 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2011/06/02 11:08:34 | 000,011,336 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\SystemRequirementsLab\cpudrv.sys – (cpudrv)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwfd)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwdx)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCapMP)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCap)
DRV - [2010/10/07 13:34:32 | 000,010,064 | —- | M] (TuneUp Software) [Kernel | On_Demand | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys – (TuneUpUtilitiesDrv)
DRV - [2010/07/20 23:56:52 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2010/07/20 23:45:12 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2010/07/20 23:37:38 | 006,086,760 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/03/17 16:42:46 | 000,016,512 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2010/03/10 07:18:20 | 000,024,216 | —- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ivusb.sys – (ivusb)
DRV - [2009/04/08 02:32:48 | 000,116,224 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntcHdmi.sys – (IntcHdmiAddService)
DRV - [2009/03/25 16:29:52 | 000,130,432 | R— | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2007/12/26 01:47:30 | 000,272,128 | —- | M] (NETGEAR Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wg111v2.sys – (RTLWUSB)
DRV - [2006/12/14 09:41:48 | 000,011,984 | —- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ElbyDelay.sys – (ElbyDelay)
DRV - [2006/07/19 11:29:08 | 000,027,136 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidKE.Sys – (LHidKe)
DRV - [2006/07/19 11:28:56 | 000,071,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2006/07/19 11:28:04 | 000,036,736 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidUsbK.sys – (LHidUsbK)
DRV - [2006/07/19 11:27:46 | 000,055,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042MOU.SYS – (L8042mou)
DRV - [2006/07/19 11:27:26 | 000,013,568 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.SYS – (L8042Kbd)
DRV - [2005/04/07 09:46:50 | 000,034,240 | R— | M] (ADS) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\adsexpb.sys – (ADSEXPB)
DRV - [2001/11/07 04:40:00 | 000,018,240 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\DbgMsg.sys – (DbgMsg)
DRV - [2001/11/07 01:09:10 | 001,347,462 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\ntice.sys – (NTice)
DRV - [2001/11/07 01:09:10 | 000,119,658 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\siwvid.sys – (Siwvid)
DRV - [2001/11/07 01:09:10 | 000,022,900 | —- | M] () [Kernel | Disabled | Stopped] – C:\WINDOWS\System32\drivers\siwsym.sys – (Siwsym)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={ADE1B36…mp;d=2012-02-16 10:43:32&v;=10.0.0.7&sap;=dsp&q;={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npdeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/02/17 07:12:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/01 10:04:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/31 08:36:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\User\Application Data\NetAssistant\ [2011/04/21 09:37:29 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension
[2010/04/01 16:33:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2012/07/27 15:02:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions
[2012/07/12 14:52:59 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/23 18:26:01 | 000,000,000 | —D | M] (Flash and Video Download) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2012/06/27 18:13:17 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2012/05/12 09:52:17 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/06/28 16:33:44 | 000,000,000 | —D | M] (DoNotTrackPlus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/09 16:20:27 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2011/08/06 13:58:30 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/27 15:02:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\staged
[2012/08/01 13:26:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\extensions
[2012/08/01 10:04:02 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/14 10:17:47 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/08/03 15:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2012/07/10 13:20:58 | 000,003,767 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/14 10:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/14 10:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2010/12/09 07:21:24 | 000,002,224 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\webblog.xml
O1 HOSTS File: ([2012/07/30 18:08:07 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCU] C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [KHALMNPR.EXE] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8EA6C079-3333-4797-9BAC-AF0FD534706A}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C85F8EC6-C08E-404C-9D39-C29A7821E0FD}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/01 11:50:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2020/12/01 12:20:44 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\iolo
[2012/08/02 21:18:50 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/08/02 21:17:48 | 002,322,184 | —- | C] (ESET) – C:\Documents and Settings\User\Desktop\esetsmartinstaller_enu.exe
[2012/08/02 14:21:13 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2012/08/01 21:14:52 | 000,751,391 | —- | C] (Farbar) – C:\Documents and Settings\User\Desktop\MiniToolBox.exe
[2012/08/01 13:57:05 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\Spybot Report
[2012/08/01 10:30:02 | 000,000,000 | —D | C] – C:\Program Files\ACW
[2012/08/01 10:29:39 | 000,139,112 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\322756.exe
[2012/08/01 10:04:06 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/08/01 08:33:14 | 016,814,136 | —- | C] (Mozilla) – C:\Documents and Settings\User\Desktop\Firefox Setup 14.0.1.exe
[2012/07/31 08:36:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2012/07/31 08:36:25 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2012/07/30 18:28:17 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/07/30 18:09:53 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/07/30 12:14:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/07/30 12:14:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/07/30 12:14:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/07/30 12:14:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/07/30 12:14:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2012/07/30 11:53:42 | 004,722,436 | R— | C] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 09:19:23 | 000,000,000 | —D | C] – C:\_OTL
[2012/07/29 09:05:02 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:04 | 000,597,504 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 17:38:10 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/07/28 17:37:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Oracle
[2012/07/28 17:37:36 | 000,227,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.techniclauncher
[2012/07/28 16:29:44 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums_files
[2012/07/28 11:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\RK_Quarantine
[2012/07/27 17:16:37 | 000,000,000 | —D | C] – C:\Program Files\SpeedyPC Software
[2012/07/27 17:06:16 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SpeedyPC Software
[2012/07/27 17:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[2012/07/27 08:04:52 | 000,000,000 | —D | C] – C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2012/07/26 11:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Curiolab
[2012/07/25 20:33:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2012/07/25 20:29:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Ad-Aware Antivirus
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Samsung
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Program Files\Clarus
[2012/07/17 08:32:09 | 000,772,544 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/17 08:32:09 | 000,143,872 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/17 08:30:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2012/07/15 16:22:24 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\HiJackThis
[2012/07/15 16:22:23 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/11 12:57:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/07/10 17:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IBUpdaterService
[2012/07/10 17:25:00 | 000,000,000 | —D | C] – C:\WINDOWS\System32\searchplugins
[2012/07/10 17:23:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Savings Sidekick
[2012/07/10 17:22:41 | 000,000,000 | —D | C] – C:\Program Files\Uninstall Information
[2012/07/09 16:20:25 | 000,000,000 | —D | C] – C:\Program Files\TorrentSearch
[2012/07/09 16:20:04 | 000,000,000 | —D | C] – C:\Program Files\intellidownload
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/08/03 08:31:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/03 08:30:10 | 102,845,173 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/08/03 07:50:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/03 07:31:00 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/03 06:38:34 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/08/03 01:43:00 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 095a1f21-5d51-4f54-a43f-d360e4c3272e.job
[2012/08/02 21:18:06 | 002,322,184 | —- | M] (ESET) – C:\Documents and Settings\User\Desktop\esetsmartinstaller_enu.exe
[2012/08/02 21:12:47 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/08/02 21:11:19 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\gdrv.sys
[2012/08/02 21:11:11 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/08/02 14:18:59 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2012/08/02 14:15:50 | 000,455,420 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/08/02 09:16:53 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
[2012/08/02 08:25:25 | 000,751,391 | —- | M] (Farbar) – C:\Documents and Settings\User\Desktop\MiniToolBox.exe
[2012/08/01 14:56:45 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task b5db9f87-9988-4bbf-aa8f-9751deca6fe3.job
[2012/08/01 10:52:22 | 000,001,826 | —- | M] () – C:\FixitRegBackup.reg
[2012/08/01 10:29:39 | 000,139,112 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\322756.exe
[2012/08/01 10:25:41 | 000,899,584 | —- | M] () – C:\Documents and Settings\User\Desktop\MicrosoftFixit50535.msi
[2012/08/01 10:04:10 | 000,000,742 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/01 10:04:10 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/01 08:33:19 | 016,814,136 | —- | M] (Mozilla) – C:\Documents and Settings\User\Desktop\Firefox Setup 14.0.1.exe
[2012/07/31 08:36:53 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/07/30 18:11:45 | 000,881,494 | —- | M] () – C:\Documents and Settings\User\Desktop\SecurityCheck.exe
[2012/07/30 18:08:07 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/30 17:34:49 | 004,722,436 | R— | M] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 12:01:36 | 000,001,397 | —- | M] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/30 09:05:02 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2012/07/29 10:33:13 | 000,000,512 | —- | M] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/29 09:05:47 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 18:23:17 | 000,000,578 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:05:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/07/28 16:29:45 | 000,254,426 | —- | M] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:28 | 001,552,384 | —- | M] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/28 08:38:09 | 000,000,394 | —- | M] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/27 12:50:17 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/27 12:50:17 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/26 17:03:28 | 000,001,881 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/26 17:03:27 | 000,000,963 | —- | M] () – C:\Documents and Settings\User\Desktop\Spybot - Search & Destroy.lnk
[2012/07/26 10:44:01 | 000,002,451 | —- | M] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/26 10:38:34 | 000,000,721 | —- | M] () – C:\user.js
[2012/07/25 18:26:00 | 000,001,469 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | M] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/20 10:45:45 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120726-165429.backup
[2012/07/16 16:57:06 | 004,661,166 | —- | M] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 17:26:23 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120720-104545.backup
[2012/07/15 12:23:49 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | M] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 14:14:10 | 000,001,373 | —- | M] () – C:\WINDOWS\wininit.ini
[2012/07/14 13:18:39 | 000,442,053 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120715-172623.backup
[2012/07/13 17:23:02 | 000,001,151 | —- | M] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/12 10:53:44 | 000,304,416 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/05 22:07:08 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/05 22:06:48 | 000,227,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/05 22:06:30 | 000,772,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/05 22:06:20 | 000,687,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/08/01 14:56:47 | 000,000,508 | —- | C] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 095a1f21-5d51-4f54-a43f-d360e4c3272e.job
[2012/08/01 14:56:45 | 000,000,508 | —- | C] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task b5db9f87-9988-4bbf-aa8f-9751deca6fe3.job
[2012/08/01 10:25:58 | 000,001,826 | —- | C] () – C:\FixitRegBackup.reg
[2012/08/01 10:25:39 | 000,899,584 | —- | C] () – C:\Documents and Settings\User\Desktop\MicrosoftFixit50535.msi
[2012/08/01 10:04:10 | 000,000,742 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/01 10:04:10 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/01 10:04:09 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/07/31 08:36:53 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/07/31 08:36:52 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2012/07/30 18:11:43 | 000,881,494 | —- | C] () – C:\Documents and Settings\User\Desktop\SecurityCheck.exe
[2012/07/30 12:14:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/07/30 12:14:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/07/30 12:14:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/07/30 12:14:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/07/30 12:14:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/07/30 12:00:24 | 000,001,397 | —- | C] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/29 10:33:13 | 000,000,512 | —- | C] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/28 16:29:43 | 000,254,426 | —- | C] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:12 | 001,552,384 | —- | C] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/27 17:16:41 | 000,000,394 | —- | C] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/26 17:03:27 | 000,001,881 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | C] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/16 16:57:06 | 004,661,166 | —- | C] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 16:22:24 | 000,002,451 | —- | C] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/15 12:23:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | C] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 16:21:01 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/14 14:13:58 | 000,001,373 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/07/13 17:23:02 | 000,001,151 | —- | C] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/13 17:21:23 | 000,645,632 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/07/13 17:21:23 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/07/13 17:21:23 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\xvid.ax
[2012/04/19 22:08:24 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1409082233-117609710-839522115-1003-0.dat
[2012/04/16 22:58:49 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/03/04 13:29:22 | 000,002,396 | —- | C] () – C:\WINDOWS\System32\ASOROSet.bin
[2012/02/15 16:00:14 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/27 12:31:10 | 000,000,520 | —- | C] () – C:\WINDOWS\Viewer.INI
[2011/12/17 14:20:38 | 000,000,000 | —- | C] () – C:\WINDOWS\muveeapp.INI
[2011/12/08 18:40:31 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\KRSBridgeControls.dll
[2011/12/08 18:40:31 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\JeanieInterface.dll
[2011/12/08 18:40:31 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\KRSSockets.dll
[2011/12/08 18:40:31 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\FuzzBox.dll
[2011/12/08 18:40:31 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\BrowseForDirectory.dll
[2011/11/29 22:12:25 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2011/11/29 22:09:35 | 000,000,578 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/11/29 22:07:18 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/11/22 19:21:10 | 000,002,816 | —- | C] () – C:\Documents and Settings\All Users\Application Data\un.png
[2011/11/22 19:15:59 | 000,000,316 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/11/22 19:15:59 | 000,000,022 | —- | C] () – C:\Documents and Settings\User\Application Data\UserFlag.ini
[2011/09/07 17:03:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/01 15:37:35 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2011/09/01 15:37:34 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQT.dll
[2011/06/28 12:29:04 | 002,097,152 | —- | C] () – C:\Documents and Settings\User\My Volume N
[2011/04/21 19:28:31 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\User\Application Data\Sys2662.Config.Repository.bin
[2011/04/15 12:55:52 | 000,069,432 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/14 10:21:38 | 000,304,416 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/08 13:36:49 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2011/03/06 15:55:42 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[2011/03/06 15:55:41 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2011/02/18 19:11:28 | 000,000,593 | —- | C] () – C:\Documents and Settings\User\Application Data\AutoGK.ini
[2011/02/10 07:29:06 | 000,000,043 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/01/10 17:01:08 | 000,000,805 | —- | C] () – C:\WINDOWS\ScanSpyware.INI
[2010/12/30 20:17:43 | 000,000,107 | —- | C] () – C:\WINDOWS\IfoEdit.INI
[2010/12/19 12:09:23 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2010/12/19 12:09:23 | 000,048,984 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2010/04/05 12:20:52 | 000,000,084 | —- | C] () – C:\Documents and Settings\User\default.pls
[2010/04/02 14:04:29 | 000,166,400 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/02 12:18:12 | 000,007,887 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.cat
[2010/04/02 12:18:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.inf
========== Alternate Data Streams ==========
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\User\Desktop\MiniToolBox.exe:SummaryInformation
< End of report >
________________________________________________________________________________
____________________
ESET
_
C:\torrent.exe Win32/BundleInstaller application cleaned by deleting - quarantined
C:\Backup\Documents and Settings\All Users\Application Data\Nero\Auto Update\Nero PhotoShow Express 5\update_files\nero_photoshow_express_5_setup_0144.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\Backup\Program Files\Nero\PhotoShow 5\data\Xtras\nero_photoshow_express_5_setup.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\Documents and Settings\All Users\Application Data\YouTube Downloader\ytd_installer.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Documents and Settings\User\Application Data\OpenCandy\OpenCandy_93FBC314E0154A81A1E83E2C916756D2\RegRevive_Installer_new.exe probably a variant of Win32/Adware.RegRevive application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\SoftonicDownloader48882.exe a variant of Win32/SoftonicDownloader.A application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\soundcrank_398.exe a variant of Win32/InstallIQ application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\speedupmypc.exe Win32/SpeedUpMyPC application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\Spydig_Setup.exe multiple threats cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\Unlocker1.9.1.exe Win32/Adware.ADON application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\YouTubeDownloaderSetup35.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Program Files\PC Speed Maximizer\PCSpeedMaximizer.exe a variant of Win32/SpeedingUpMyPC application cleaned by deleting - quarantined
C:\Program Files\YouTube Downloader Toolbar\IE\5.1\youtubedownloaderToolbarIE.dll a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390782.exe Win32/BundleInstaller application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390783.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390785.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390786.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390787.exe probably a variant of Win32/Adware.RegRevive application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390810.exe a variant of Win32/SpeedingUpMyPC application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390811.dll a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
As requested, here are the three logs.
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
C:\Program Files\Adjugglercookie Removal Tool (1)\Results folder moved successfully.
C:\Program Files\Adjugglercookie Removal Tool (1) folder moved successfully.
C:\Program Files\Adjugglercookie Removal Tool\Results folder moved successfully.
C:\Program Files\Adjugglercookie Removal Tool folder moved successfully.
File rity] not found.
File ptytemp] not found.
File boot] not found.
OTL by OldTimer - Version 3.2.55.0 log created on 08022012_211001
Files\Folders moved on Reboot…
PendingFileRenameOperations files…
Registry entries deleted on Reboot…
________________________________________________________________________________
___________________
OTL logfile created on: 3/08/2012 8:36:03 AM - Run 6
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy
1.97 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 56.18% Memory free
3.81 Gb Paging File | 2.94 Gb Available in Paging File | 77.02% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.57 Gb Total Space | 41.15 Gb Free Space | 59.15% Space Free | Partition Type: NTFS
Drive D: | 396.19 Gb Total Space | 283.39 Gb Free Space | 71.53% Space Free | Partition Type: NTFS
Computer Name: USER-84F12D431F | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2012/07/28 17:36:35 | 000,161,776 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/07/14 10:17:11 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/05/25 04:39:22 | 027,112,840 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2012/01/24 16:24:26 | 002,416,480 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/11/28 00:19:04 | 001,229,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgfws.exe
PRC - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/09/08 19:53:26 | 000,743,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/08/15 05:21:40 | 000,337,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/01/04 20:25:02 | 000,094,208 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
PRC - [2010/01/04 20:24:24 | 000,077,824 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
PRC - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009/08/04 17:29:52 | 000,346,320 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2012/07/27 12:50:16 | 009,465,032 | —- | M] () – C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
MOD - [2012/07/14 10:17:14 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/07/10 13:21:10 | 000,132,704 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
MOD - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/02/20 21:29:04 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/07/05 07:32:38 | 000,010,752 | —- | M] () – C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2009/08/16 17:06:02 | 000,141,312 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/07/30 18:15:32 | 000,503,202 | —- | M] () – C:\Program Files\DeviceVM\Browser Configuration Utility\sqlite3.dll
MOD - [2009/03/13 11:30:44 | 000,109,096 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009/03/11 12:41:42 | 000,049,152 | —- | M] () – C:\Program Files\OxelonMedia\menuext.dll
MOD - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
MOD - [2007/05/22 14:53:10 | 000,006,656 | —- | M] () – C:\Program Files\WinAVI Video Converter\SimpleExt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - [2012/07/28 17:36:35 | 000,161,776 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/07/27 12:50:19 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/14 10:17:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/11 10:45:52 | 004,419,392 | —- | M] () [Auto | Running] – c:\program files\common files\akamai/netsession_win_4f7fccd.dll – (Akamai)
SRV - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgfws.exe – (avgfws)
SRV - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE – (!SASCORE)
SRV - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) [Auto | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe – (TuneUp.UtilitiesSvc)
SRV - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) [Auto | Running] – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe – (BCUService)
SRV - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () [Auto | Running] – C:\Program Files\Gigabyte\EasySaver\essvr.exe – (ES lite Service)
SRV - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\Drivers\SYMEVENT.SYS – (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys – (SiwvidStart)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\ComboFix\catchme.sys – (catchme)
DRV - [2012/08/02 21:11:19 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\gdrv.sys – (gdrv)
DRV - [2012/04/28 18:32:29 | 000,023,456 | —- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DrvAgent32.sys – (DrvAgent32)
DRV - [2011/10/07 05:23:48 | 000,230,608 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2011/10/04 05:21:42 | 000,016,720 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2011/09/13 05:30:10 | 000,032,592 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/08/08 21:15:34 | 000,067,664 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2011/08/08 21:15:33 | 000,012,880 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2011/08/08 05:08:58 | 000,040,016 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/07/13 17:09:26 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2011/07/11 00:14:38 | 000,295,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2011/07/11 00:14:28 | 000,024,272 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2011/07/11 00:14:28 | 000,023,120 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AVGIDSEH.sys – (AVGIDSEH)
DRV - [2011/07/11 00:14:26 | 000,134,608 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2011/06/02 11:08:34 | 000,011,336 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\SystemRequirementsLab\cpudrv.sys – (cpudrv)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwfd)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwdx)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCapMP)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCap)
DRV - [2010/10/07 13:34:32 | 000,010,064 | —- | M] (TuneUp Software) [Kernel | On_Demand | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys – (TuneUpUtilitiesDrv)
DRV - [2010/07/20 23:56:52 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2010/07/20 23:45:12 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2010/07/20 23:37:38 | 006,086,760 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/03/17 16:42:46 | 000,016,512 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2010/03/10 07:18:20 | 000,024,216 | —- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ivusb.sys – (ivusb)
DRV - [2009/04/08 02:32:48 | 000,116,224 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntcHdmi.sys – (IntcHdmiAddService)
DRV - [2009/03/25 16:29:52 | 000,130,432 | R— | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2007/12/26 01:47:30 | 000,272,128 | —- | M] (NETGEAR Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wg111v2.sys – (RTLWUSB)
DRV - [2006/12/14 09:41:48 | 000,011,984 | —- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ElbyDelay.sys – (ElbyDelay)
DRV - [2006/07/19 11:29:08 | 000,027,136 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidKE.Sys – (LHidKe)
DRV - [2006/07/19 11:28:56 | 000,071,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2006/07/19 11:28:04 | 000,036,736 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidUsbK.sys – (LHidUsbK)
DRV - [2006/07/19 11:27:46 | 000,055,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042MOU.SYS – (L8042mou)
DRV - [2006/07/19 11:27:26 | 000,013,568 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.SYS – (L8042Kbd)
DRV - [2005/04/07 09:46:50 | 000,034,240 | R— | M] (ADS) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\adsexpb.sys – (ADSEXPB)
DRV - [2001/11/07 04:40:00 | 000,018,240 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\DbgMsg.sys – (DbgMsg)
DRV - [2001/11/07 01:09:10 | 001,347,462 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\ntice.sys – (NTice)
DRV - [2001/11/07 01:09:10 | 000,119,658 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\siwvid.sys – (Siwvid)
DRV - [2001/11/07 01:09:10 | 000,022,900 | —- | M] () [Kernel | Disabled | Stopped] – C:\WINDOWS\System32\drivers\siwsym.sys – (Siwsym)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={ADE1B36…mp;d=2012-02-16 10:43:32&v;=10.0.0.7&sap;=dsp&q;={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npdeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/02/17 07:12:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/01 10:04:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/31 08:36:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\User\Application Data\NetAssistant\ [2011/04/21 09:37:29 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension
[2010/04/01 16:33:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2012/07/27 15:02:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions
[2012/07/12 14:52:59 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/23 18:26:01 | 000,000,000 | —D | M] (Flash and Video Download) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2012/06/27 18:13:17 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2012/05/12 09:52:17 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/06/28 16:33:44 | 000,000,000 | —D | M] (DoNotTrackPlus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/09 16:20:27 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2011/08/06 13:58:30 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/27 15:02:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\staged
[2012/08/01 13:26:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\extensions
[2012/08/01 10:04:02 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/14 10:17:47 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/08/03 15:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2012/07/10 13:20:58 | 000,003,767 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/14 10:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/14 10:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2010/12/09 07:21:24 | 000,002,224 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\webblog.xml
O1 HOSTS File: ([2012/07/30 18:08:07 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCU] C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [KHALMNPR.EXE] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8EA6C079-3333-4797-9BAC-AF0FD534706A}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C85F8EC6-C08E-404C-9D39-C29A7821E0FD}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/01 11:50:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2020/12/01 12:20:44 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\iolo
[2012/08/02 21:18:50 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/08/02 21:17:48 | 002,322,184 | —- | C] (ESET) – C:\Documents and Settings\User\Desktop\esetsmartinstaller_enu.exe
[2012/08/02 14:21:13 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2012/08/01 21:14:52 | 000,751,391 | —- | C] (Farbar) – C:\Documents and Settings\User\Desktop\MiniToolBox.exe
[2012/08/01 13:57:05 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\Spybot Report
[2012/08/01 10:30:02 | 000,000,000 | —D | C] – C:\Program Files\ACW
[2012/08/01 10:29:39 | 000,139,112 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\322756.exe
[2012/08/01 10:04:06 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/08/01 08:33:14 | 016,814,136 | —- | C] (Mozilla) – C:\Documents and Settings\User\Desktop\Firefox Setup 14.0.1.exe
[2012/07/31 08:36:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2012/07/31 08:36:25 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2012/07/30 18:28:17 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/07/30 18:09:53 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/07/30 12:14:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/07/30 12:14:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/07/30 12:14:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/07/30 12:14:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/07/30 12:14:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2012/07/30 11:53:42 | 004,722,436 | R— | C] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 09:19:23 | 000,000,000 | —D | C] – C:\_OTL
[2012/07/29 09:05:02 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:04 | 000,597,504 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 17:38:10 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/07/28 17:37:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Oracle
[2012/07/28 17:37:36 | 000,227,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.techniclauncher
[2012/07/28 16:29:44 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums_files
[2012/07/28 11:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\RK_Quarantine
[2012/07/27 17:16:37 | 000,000,000 | —D | C] – C:\Program Files\SpeedyPC Software
[2012/07/27 17:06:16 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SpeedyPC Software
[2012/07/27 17:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[2012/07/27 08:04:52 | 000,000,000 | —D | C] – C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2012/07/26 11:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Curiolab
[2012/07/25 20:33:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2012/07/25 20:29:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Ad-Aware Antivirus
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Samsung
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Program Files\Clarus
[2012/07/17 08:32:09 | 000,772,544 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/17 08:32:09 | 000,143,872 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/17 08:30:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2012/07/15 16:22:24 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\HiJackThis
[2012/07/15 16:22:23 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/11 12:57:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/07/10 17:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IBUpdaterService
[2012/07/10 17:25:00 | 000,000,000 | —D | C] – C:\WINDOWS\System32\searchplugins
[2012/07/10 17:23:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Savings Sidekick
[2012/07/10 17:22:41 | 000,000,000 | —D | C] – C:\Program Files\Uninstall Information
[2012/07/09 16:20:25 | 000,000,000 | —D | C] – C:\Program Files\TorrentSearch
[2012/07/09 16:20:04 | 000,000,000 | —D | C] – C:\Program Files\intellidownload
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/08/03 08:31:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/03 08:30:10 | 102,845,173 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/08/03 07:50:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/03 07:31:00 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/03 06:38:34 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/08/03 01:43:00 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 095a1f21-5d51-4f54-a43f-d360e4c3272e.job
[2012/08/02 21:18:06 | 002,322,184 | —- | M] (ESET) – C:\Documents and Settings\User\Desktop\esetsmartinstaller_enu.exe
[2012/08/02 21:12:47 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/08/02 21:11:19 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\gdrv.sys
[2012/08/02 21:11:11 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/08/02 14:18:59 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2012/08/02 14:15:50 | 000,455,420 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/08/02 09:16:53 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
[2012/08/02 08:25:25 | 000,751,391 | —- | M] (Farbar) – C:\Documents and Settings\User\Desktop\MiniToolBox.exe
[2012/08/01 14:56:45 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task b5db9f87-9988-4bbf-aa8f-9751deca6fe3.job
[2012/08/01 10:52:22 | 000,001,826 | —- | M] () – C:\FixitRegBackup.reg
[2012/08/01 10:29:39 | 000,139,112 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\322756.exe
[2012/08/01 10:25:41 | 000,899,584 | —- | M] () – C:\Documents and Settings\User\Desktop\MicrosoftFixit50535.msi
[2012/08/01 10:04:10 | 000,000,742 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/01 10:04:10 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/01 08:33:19 | 016,814,136 | —- | M] (Mozilla) – C:\Documents and Settings\User\Desktop\Firefox Setup 14.0.1.exe
[2012/07/31 08:36:53 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/07/30 18:11:45 | 000,881,494 | —- | M] () – C:\Documents and Settings\User\Desktop\SecurityCheck.exe
[2012/07/30 18:08:07 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/30 17:34:49 | 004,722,436 | R— | M] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 12:01:36 | 000,001,397 | —- | M] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/30 09:05:02 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2012/07/29 10:33:13 | 000,000,512 | —- | M] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/29 09:05:47 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 18:23:17 | 000,000,578 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:05:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/07/28 16:29:45 | 000,254,426 | —- | M] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:28 | 001,552,384 | —- | M] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/28 08:38:09 | 000,000,394 | —- | M] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/27 12:50:17 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/27 12:50:17 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/26 17:03:28 | 000,001,881 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/26 17:03:27 | 000,000,963 | —- | M] () – C:\Documents and Settings\User\Desktop\Spybot - Search & Destroy.lnk
[2012/07/26 10:44:01 | 000,002,451 | —- | M] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/26 10:38:34 | 000,000,721 | —- | M] () – C:\user.js
[2012/07/25 18:26:00 | 000,001,469 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | M] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/20 10:45:45 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120726-165429.backup
[2012/07/16 16:57:06 | 004,661,166 | —- | M] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 17:26:23 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120720-104545.backup
[2012/07/15 12:23:49 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | M] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 14:14:10 | 000,001,373 | —- | M] () – C:\WINDOWS\wininit.ini
[2012/07/14 13:18:39 | 000,442,053 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120715-172623.backup
[2012/07/13 17:23:02 | 000,001,151 | —- | M] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/12 10:53:44 | 000,304,416 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/05 22:07:08 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/05 22:06:48 | 000,227,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/05 22:06:30 | 000,772,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/05 22:06:20 | 000,687,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/08/01 14:56:47 | 000,000,508 | —- | C] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 095a1f21-5d51-4f54-a43f-d360e4c3272e.job
[2012/08/01 14:56:45 | 000,000,508 | —- | C] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task b5db9f87-9988-4bbf-aa8f-9751deca6fe3.job
[2012/08/01 10:25:58 | 000,001,826 | —- | C] () – C:\FixitRegBackup.reg
[2012/08/01 10:25:39 | 000,899,584 | —- | C] () – C:\Documents and Settings\User\Desktop\MicrosoftFixit50535.msi
[2012/08/01 10:04:10 | 000,000,742 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/01 10:04:10 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/01 10:04:09 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/07/31 08:36:53 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/07/31 08:36:52 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2012/07/30 18:11:43 | 000,881,494 | —- | C] () – C:\Documents and Settings\User\Desktop\SecurityCheck.exe
[2012/07/30 12:14:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/07/30 12:14:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/07/30 12:14:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/07/30 12:14:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/07/30 12:14:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/07/30 12:00:24 | 000,001,397 | —- | C] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/29 10:33:13 | 000,000,512 | —- | C] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/28 16:29:43 | 000,254,426 | —- | C] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:12 | 001,552,384 | —- | C] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/27 17:16:41 | 000,000,394 | —- | C] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/26 17:03:27 | 000,001,881 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | C] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/16 16:57:06 | 004,661,166 | —- | C] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 16:22:24 | 000,002,451 | —- | C] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/15 12:23:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | C] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 16:21:01 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/14 14:13:58 | 000,001,373 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/07/13 17:23:02 | 000,001,151 | —- | C] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/13 17:21:23 | 000,645,632 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/07/13 17:21:23 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/07/13 17:21:23 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\xvid.ax
[2012/04/19 22:08:24 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1409082233-117609710-839522115-1003-0.dat
[2012/04/16 22:58:49 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/03/04 13:29:22 | 000,002,396 | —- | C] () – C:\WINDOWS\System32\ASOROSet.bin
[2012/02/15 16:00:14 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/27 12:31:10 | 000,000,520 | —- | C] () – C:\WINDOWS\Viewer.INI
[2011/12/17 14:20:38 | 000,000,000 | —- | C] () – C:\WINDOWS\muveeapp.INI
[2011/12/08 18:40:31 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\KRSBridgeControls.dll
[2011/12/08 18:40:31 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\JeanieInterface.dll
[2011/12/08 18:40:31 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\KRSSockets.dll
[2011/12/08 18:40:31 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\FuzzBox.dll
[2011/12/08 18:40:31 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\BrowseForDirectory.dll
[2011/11/29 22:12:25 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2011/11/29 22:09:35 | 000,000,578 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/11/29 22:07:18 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/11/22 19:21:10 | 000,002,816 | —- | C] () – C:\Documents and Settings\All Users\Application Data\un.png
[2011/11/22 19:15:59 | 000,000,316 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/11/22 19:15:59 | 000,000,022 | —- | C] () – C:\Documents and Settings\User\Application Data\UserFlag.ini
[2011/09/07 17:03:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/01 15:37:35 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2011/09/01 15:37:34 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQT.dll
[2011/06/28 12:29:04 | 002,097,152 | —- | C] () – C:\Documents and Settings\User\My Volume N
[2011/04/21 19:28:31 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\User\Application Data\Sys2662.Config.Repository.bin
[2011/04/15 12:55:52 | 000,069,432 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/14 10:21:38 | 000,304,416 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/08 13:36:49 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2011/03/06 15:55:42 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[2011/03/06 15:55:41 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2011/02/18 19:11:28 | 000,000,593 | —- | C] () – C:\Documents and Settings\User\Application Data\AutoGK.ini
[2011/02/10 07:29:06 | 000,000,043 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/01/10 17:01:08 | 000,000,805 | —- | C] () – C:\WINDOWS\ScanSpyware.INI
[2010/12/30 20:17:43 | 000,000,107 | —- | C] () – C:\WINDOWS\IfoEdit.INI
[2010/12/19 12:09:23 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2010/12/19 12:09:23 | 000,048,984 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2010/04/05 12:20:52 | 000,000,084 | —- | C] () – C:\Documents and Settings\User\default.pls
[2010/04/02 14:04:29 | 000,166,400 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/02 12:18:12 | 000,007,887 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.cat
[2010/04/02 12:18:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.inf
========== Alternate Data Streams ==========
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\User\Desktop\MiniToolBox.exe:SummaryInformation
< End of report >
________________________________________________________________________________
____________________
ESET
_
C:\torrent.exe Win32/BundleInstaller application cleaned by deleting - quarantined
C:\Backup\Documents and Settings\All Users\Application Data\Nero\Auto Update\Nero PhotoShow Express 5\update_files\nero_photoshow_express_5_setup_0144.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\Backup\Program Files\Nero\PhotoShow 5\data\Xtras\nero_photoshow_express_5_setup.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\Documents and Settings\All Users\Application Data\YouTube Downloader\ytd_installer.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Documents and Settings\User\Application Data\OpenCandy\OpenCandy_93FBC314E0154A81A1E83E2C916756D2\RegRevive_Installer_new.exe probably a variant of Win32/Adware.RegRevive application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\SoftonicDownloader48882.exe a variant of Win32/SoftonicDownloader.A application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\soundcrank_398.exe a variant of Win32/InstallIQ application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\speedupmypc.exe Win32/SpeedUpMyPC application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\Spydig_Setup.exe multiple threats cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\Unlocker1.9.1.exe Win32/Adware.ADON application cleaned by deleting - quarantined
C:\Documents and Settings\User\My Documents\DOWNLOADS\YouTubeDownloaderSetup35.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Program Files\PC Speed Maximizer\PCSpeedMaximizer.exe a variant of Win32/SpeedingUpMyPC application cleaned by deleting - quarantined
C:\Program Files\YouTube Downloader Toolbar\IE\5.1\youtubedownloaderToolbarIE.dll a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390782.exe Win32/BundleInstaller application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390783.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390785.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390786.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390787.exe probably a variant of Win32/Adware.RegRevive application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390810.exe a variant of Win32/SpeedingUpMyPC application cleaned by deleting - quarantined
C:\System Volume Information\_restore{89F1B63E-4D44-40E1-9340-95A6FC5116CF}\RP1800\A0390811.dll a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
Satchfan
Most of the junk that was found by the online scan was undoubtedly thanks to P2P use.
It appears that everything else is OK.
Are there any remaining problems?
Brigow
Everything appears fine.
Thanks for your time & help
Regards
Brigow
Satchfan
Good work, your computer appears to be clean.
Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:
Uninstall Combofix
Follow these steps to uninstall Combofix
Click to load external image (Posted Image)
Uninstall OTL
You can just delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.
===================================================
Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.
===================================================
It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.
FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.
===================================================
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
===================================================
I also recommend that you read the following:
How to prevent malware by miekiemoes
Safe computing
Satchfan
Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:
Uninstall Combofix
Follow these steps to uninstall Combofix
- click START then RUN
- now type Combofix /uninstall in the runbox and click OK.
Click to load external image (Posted Image)
- please follow the prompts to uninstall Combofix.
- once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
Uninstall OTL
- Double-click OTL.exe
- Click the CleanUp! button.
- Select Yes when the Begin cleanup Process? prompt appears.
- If you are prompted to reboot during the cleanup, select Yes.
- The tool will delete itself once it finishes, if not delete it by yourself.
You can just delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.
===================================================
Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.
===================================================
It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.
FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.
===================================================
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
===================================================
I also recommend that you read the following:
How to prevent malware by miekiemoes
Safe computing
Satchfan
Satchfan
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI