What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

FBI Moneypak [Solved]

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
It sounds like you can boot into normal mode now. Please run these tools there. How is your computer behaving at the moment?

  • ListParts

    • Run the tool
    • check the "list BCD" box
    • click "Scan" and post the log (Result.txt) it makes.
  • Malwarebytes' Anti-Malware

    I see you already have MBAM on your computer. Please do the following:

    • Once the program has loaded, click the Update tab and Check for Updates.
    • Click the Scanner tab, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. This log is saved by MBAM and can be viewed by clicking the Logs tab.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. Please paste the results in your next reply.
    • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
  • ESET Online Scanner

    Please disable any real-time security programs such as your anti-virus before proceeding with this scan.

    • Open Internet Explorer.
    • Download ESET Online Scanner.
    • Put a checkmark in the checkbox next to YES, I accept the Terms of Use.
    • Click Start.
    • When prompted by your web browser, click Install.
    • Uncheck Remove found threats.
    • Check Scan archives.
    • Click Start and let the scanner finish downloading virus signatures. The scan will begin afterward.
    • When the scan completes, click List of found threats.
    • Click Export to text file… and save the file to your desktop. Post it in your next reply.
    • Click Back.
    • Click Finish.
Post #47
So far the computer seems to be running well with the exception of the missing desktop and taskbar icons. I can finally post my replies without having to use another computer. Here is the ListParts log. I will run Malwarebytes now. ListParts by Farbar Version: 10-08-2012 Ran by [removed] (administrator) on 16-08-2012 at 20:47:36 Windows 7 (X86) Running From: C:\Users\[removed]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S154OGV1 Language: 0409 ************************************************************ ========================= Memory info ====================== Percentage of memory in use: 67% Total physical RAM: 1014.44 MB Available physical RAM: 332.8 MB Total Pagefile: 2038.44 MB Available Pagefile: 986.66 MB Total Virtual: 2047.88 MB Available Virtual: 1953.32 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:55.82 GB) (Free:21.65 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 55 GB 4096 KB Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 54 MB 31 KB Partition 2 Primary 55 GB 54 MB Partition 3 Primary 10 MB 55 GB ================================================================================ ====================== Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No There is no volume associated with this partition. ================================================================================ ====================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 C NTFS Partition 55 GB Healthy System (partition with boot components) ================================================================================ ====================== Disk: 0 Partition 3 Type : 17 (Suspicious Type) Hidden: Yes Active: No There is no volume associated with this partition. ================================================================================ ====================== Windows Boot Manager ——————– identifier {9dea862c-5cdd-4e70-acc1-f32b344d4795} device partition=C: description Windows Boot Manager locale en-US inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} default {07b26152-12a6-11df-ab8d-e6e714c9e925} resumeobject {07b26151-12a6-11df-ab8d-e6e714c9e925} displayorder {466f5a88-0af2-4f76-9038-095b170dc21c} {07b26152-12a6-11df-ab8d-e6e714c9e925} toolsdisplayorder {b2721d73-1db4-4c62-bf78-c548a880142d} timeout 30 Windows Boot Loader ——————- identifier {07b26152-12a6-11df-ab8d-e6e714c9e925} device partition=C: path \Windows\system32\winload.exe description Windows 7 locale en-US inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7} recoverysequence {07b26153-12a6-11df-ab8d-e6e714c9e925} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {07b26151-12a6-11df-ab8d-e6e714c9e925} nx OptIn Windows Boot Loader ——————- identifier {07b26153-12a6-11df-ab8d-e6e714c9e925} device ramdisk=[C:]\Recovery\07b26153-12a6-11df-ab8d-e6e714c9e925\Winre.wim,{07b26154-12a6-11df-ab8d-e6e714c9e925} path \windows\system32\winload.exe description Windows Recovery Environment inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7} osdevice ramdisk=[C:]\Recovery\07b26153-12a6-11df-ab8d-e6e714c9e925\Winre.wim,{07b26154-12a6-11df-ab8d-e6e714c9e925} systemroot \windows nx OptIn winpe Yes custom:46000010 Yes Resume from Hibernate ——————— identifier {07b26151-12a6-11df-ab8d-e6e714c9e925} device partition=C: path \Windows\system32\winresume.exe description Windows Resume Application locale en-US inherit {1afa9c49-16ab-4a5c-901b-212802da9460} filedevice partition=C: filepath \hiberfil.sys pae Yes debugoptionenabled No Windows Memory Tester ——————— identifier {b2721d73-1db4-4c62-bf78-c548a880142d} device partition=C: path \boot\memtest.exe description Windows Memory Diagnostic locale en-US inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} badmemoryaccess Yes Windows Legacy OS Loader ———————— identifier {466f5a88-0af2-4f76-9038-095b170dc21c} device partition=C: path \ntldr description Earlier Version of Windows EMS Settings ———— identifier {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9} bootems Yes Debugger Settings —————– identifier {4636856e-540f-4170-a130-a84776f4c654} debugtype Serial debugport 1 baudrate 115200 RAM Defects ———– identifier {5189b25c-5558-4bf2-bca4-289b11bd29e2} Global Settings ————— identifier {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} inherit {4636856e-540f-4170-a130-a84776f4c654} {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9} {5189b25c-5558-4bf2-bca4-289b11bd29e2} Boot Loader Settings ——————– identifier {6efb52bf-1766-41db-a6b3-0ee5eff72bd7} inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} {7ff607e0-4395-11db-b0de-0800200c9a66} Hypervisor Settings ——————- identifier {7ff607e0-4395-11db-b0de-0800200c9a66} hypervisordebugtype Serial hypervisordebugport 1 hypervisorbaudrate 115200 Resume Loader Settings ———————- identifier {1afa9c49-16ab-4a5c-901b-212802da9460} inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} Device options ————– identifier {07b26154-12a6-11df-ab8d-e6e714c9e925} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\07b26153-12a6-11df-ab8d-e6e714c9e925\boot.sdi ****** End Of Log ******
Post #48
Malwarebytes log Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.17.01 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 Scherer Electric 3 :: SCHERERELECT3 [administrator] 8/16/2012 8:52:56 PM mbam-log-2012-08-16 (20-52-56).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 205617 Time elapsed: 9 minute(s), 46 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\Scherer Electric 3\Downloads\7zip_installer_1650.exe (PUP.BundleOffers.IIQ) -> Quarantined and deleted successfully. (end)
Post #49
eset C:\FRST\Quarantine\goveuqc.exe a variant of Win32/Kryptik.AJOS trojan C:\FRST\Quarantine\services.exe Win32/Sirefef.FC trojan C:\FRST\Quarantine\twain.dll Win32/LockScreen.AMB trojan C:\FRST\Quarantine\9CEEE090CE59B7\9CEEE090CE59B7.exe a variant of Win32/Kryptik.AKCT trojan C:\FRST\Quarantine\{1785dc02-490c-8308-3df3-61a04aa5d931}\n Win32/Sirefef.EV trojan C:\FRST\Quarantine\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\00000004.@ Win32/Conedex.D trojan C:\FRST\Quarantine\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\000000cb.@ Win32/Conedex.E trojan C:\FRST\Quarantine\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\80000000.@ a variant of Win32/Sirefef.FA trojan C:\FRST\Quarantine\{1785dc02-490c-8308-3df3-61a04aa5d931}\U\80000032.@ a variant of Win32/Sirefef.FD trojan C:\FRST\Quarantine\{1785dc02-490c-8308-3df3-61a04aa5d931}\{1785dc02-490c-8308-3df3-61a04aa5d931}\n Win32/Sirefef.EV trojan C:\FRST\Quarantine\{AAF44BF1-6044-FE61-76CF-178F568329F9}\syshost.exe a variant of Win32/Kryptik.AJUO trojan C:\Qoobox\Quarantine\C\Users\Scherer Electric 3\AppData\Roaming\Twain.dll.vir Win32/LockScreen.AMB trojan C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application
Post #50
I see you ran ListParts from a temporary location. Please download it again and save it to a non-temporary location.

  • Click Start and in the Search Programs and files box type Notepad.exe then hit Enter.
  • An empty Notepad file will open.
  • Copy and paste the contents of the quote box below into Notepad.

Disk=0 Partition=3 delete


  • Click Format and ensure Wordwrap is unchecked.
  • Save as Fix.txt in the exact same location as ListParts.exe.

Next

  • Double click ListParts.exe to launch the program.
  • Press the Fix button.
  • ListParts will process the script in Fix.txt
  • When finished please press the Scan button.
  • A log Result.txt will open in the location of ListParts.
  • Please post me the contents of the log.

Let's get another scan with OTL as well.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    %systemroot%\*. /rp /s
    DRIVES
    CREATERESTOREPOINT
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  • When the scan completes, it will open a notepad window of OTL.Txt This is saved in the same location as OTL.
  • Post the log
Post #52
Just save it in the same location (folder) as ListParts.exe. Same idea as the CFScript.txt being saved in the same location as ComboFx.
Post #53
When I drag the txt file into ListParts it opens the program so I just followed the rest of your directions. Hopefully it worked correctly. ListParts by Farbar Version: 10-08-2012 Ran by [removed] (administrator) on 19-08-2012 at 09:23:55 Windows 7 (X86) Running From: C:\Users\[removed]\Desktop Language: 0409 ************************************************************ ========================= Memory info ====================== Percentage of memory in use: 55% Total physical RAM: 1014.44 MB Available physical RAM: 447 MB Total Pagefile: 2038.44 MB Available Pagefile: 1124.83 MB Total Virtual: 2047.88 MB Available Virtual: 1958.42 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:55.82 GB) (Free:21.49 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 55 GB 14 MB Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 54 MB 31 KB Partition 2 Primary 55 GB 54 MB ================================================================================ ====================== Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No There is no volume associated with this partition. ================================================================================ ====================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 C NTFS Partition 55 GB Healthy System (partition with boot components) ================================================================================ ====================== ****** End Of Log ******
Post #54
OTL

OTL logfile created on: 8/19/2012 12:50:04 PM - Run 2
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Scherer Electric 3\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.44 Mb Total Physical Memory | 410.42 Mb Available Physical Memory | 40.46% Memory free
1.99 Gb Paging File | 1.16 Gb Available in Paging File | 58.03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 55.82 Gb Total Space | 21.08 Gb Free Space | 37.77% Space Free | Partition Type: NTFS

Computer Name: SCHERERELECT3 | User Name: Scherer Electric 3 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/06 09:05:24 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Scherer Electric 3\Desktop\OTL.exe
PRC - [2012/04/25 19:53:38 | 000,202,296 | —- | M] (Kaspersky Lab ZAO) – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2010/09/27 17:42:18 | 004,180,576 | —- | M] (SafeNet Inc.) – C:\Windows\System32\hasplms.exe
PRC - [2007/04/03 17:58:56 | 000,020,572 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/25 19:52:28 | 001,270,160 | —- | M] () – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\qtscript4.dll
MOD - [2012/04/25 19:52:26 | 007,422,352 | —- | M] () – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\qtgui4.dll
MOD - [2012/04/25 19:52:24 | 000,795,024 | —- | M] () – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\qtnetwork4.dll
MOD - [2012/04/25 19:52:24 | 000,192,912 | —- | M] () – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\qtsql4.dll
MOD - [2012/04/25 19:52:22 | 002,453,904 | —- | M] () – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\qtdeclarative4.dll
MOD - [2012/04/25 19:52:22 | 002,126,224 | —- | M] () – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\qtcore4.dll
MOD - [2007/04/03 17:58:58 | 000,053,349 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\zip.dll
MOD - [2007/04/03 17:58:58 | 000,053,342 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\verify.dll
MOD - [2007/04/03 17:58:58 | 000,032,864 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\net.dll
MOD - [2007/04/03 17:58:56 | 000,802,901 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\hotspot\jvm.dll
MOD - [2007/04/03 17:58:56 | 000,094,308 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\java.dll
MOD - [2007/04/03 17:58:56 | 000,028,776 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\hpi.dll
MOD - [2007/04/03 17:58:56 | 000,020,572 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
MOD - [2004/08/20 08:02:52 | 000,102,400 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\PMLJNI.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/08/16 21:28:52 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/25 19:53:38 | 000,202,296 | —- | M] (Kaspersky Lab ZAO) [Auto | Running] – C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe – (KSS)
SRV - [2012/03/26 17:03:40 | 000,214,952 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV - [2010/09/27 17:42:18 | 004,180,576 | —- | M] (SafeNet Inc.) [Auto | Running] – C:\Windows\System32\hasplms.exe – (hasplms)
SRV - [2010/05/18 03:01:30 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/05/29 21:13:10 | 001,082,368 | —- | M] (Accubid Systems) [Auto | Stopped] – C:\Program Files\Accubid\Accubid Security\SecurityService2.exe – (AccubidSecurityServer2)
SRV - [2005/10/22 21:47:00 | 000,069,632 | —- | M] (HP) [Auto | Stopped] – C:\Windows\System32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\SCHERE~1\AppData\Local\Temp\catchme.sys – (catchme)
DRV - [2012/03/20 20:44:12 | 000,074,112 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2010/11/20 06:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/09/27 17:42:24 | 000,356,864 | —- | M] (SafeNet Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\aksfridge.sys – (aksfridge)
DRV - [2009/12/22 13:56:46 | 000,097,488 | —- | M] (Quatech, Incorporated) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\qtserial.sys – (QTSerial)
DRV - [2009/12/22 13:56:46 | 000,048,976 | —- | M] (Quatech, Incorporated) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\qserbus.sys – (QSerBus)
DRV - [2009/12/17 08:10:48 | 000,046,336 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\akshhl.sys – (akshhl)
DRV - [2009/12/17 07:10:54 | 000,238,208 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\akshasp.sys – (akshasp)
DRV - [2009/12/17 07:10:52 | 000,588,800 | —- | M] (SafeNet Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\hardlock.sys – (hardlock)
DRV - [2009/12/17 07:10:50 | 000,016,384 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\aksusb.sys – (aksusb)
DRV - [2009/07/13 18:02:49 | 000,046,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2005/09/28 21:57:18 | 000,113,847 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070531
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070531
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3B FF 65 25 9D A6 CA 01 [binary data]
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\..\SearchScopes,DefaultScope = {B5ECE786-A51D-46E5-8337-AEB3BC43AF25}
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\..\SearchScopes\{B5ECE786-A51D-46E5-8337-AEB3BC43AF25}: "URL" = http://www.google.com/search?q={searchTerm…age={startPage}
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2012/08/15 21:34:21 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard)
O4 - HKU\S-1-5-21-2239707657-612507658-2920094788-1000..\Run: [KSS] C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Kaspersky Lab ZAO)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://accubid.webex.com/client/T27L/webex/ieatgpc1.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: vzTCPConfig http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EE720880-D405-4E99-8546-99B2823AFA87}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/18 22:40:43 | 000,307,009 | —- | C] (Farbar) – C:\Users\Scherer Electric 3\Desktop\ListParts.exe
[2012/08/16 21:15:25 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/08/15 21:34:42 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/08/15 21:24:12 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/08/15 21:24:12 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\AppData\Local\temp
[2012/08/15 21:13:08 | 000,000,000 | —D | C] – C:\ComboFix
[2012/08/13 20:46:40 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\AppData\Local\ElevatedDiagnostics
[2012/08/12 23:09:19 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/08/12 23:09:19 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/08/12 23:09:19 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/08/12 23:09:12 | 000,000,000 | —D | C] – C:\Qoobox
[2012/08/12 23:09:01 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/08/12 23:07:51 | 004,729,547 | R— | C] (Swearware) – C:\Users\Scherer Electric 3\Desktop\ComboFix.exe
[2012/08/08 14:07:22 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%
[2012/08/08 08:22:30 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
[2012/08/08 08:20:08 | 000,000,000 | —D | C] – C:\Program Files\Kaspersky Lab
[2012/08/08 08:20:05 | 000,000,000 | —D | C] – C:\ProgramData\Kaspersky Lab
[2012/08/07 11:16:13 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\New folder
[2012/08/06 09:05:34 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Scherer Electric 3\Desktop\OTL.exe
[2012/08/05 22:55:46 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\AppData\Local\Diagnostics
[2012/08/05 20:05:29 | 000,000,000 | —D | C] – C:\FRST

========== Files - Modified Within 30 Days ==========

[2012/08/19 12:28:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/19 10:04:12 | 000,013,760 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/19 10:04:12 | 000,013,760 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/19 09:16:41 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/18 22:40:28 | 000,307,009 | —- | M] (Farbar) – C:\Users\Scherer Electric 3\Desktop\ListParts.exe
[2012/08/18 22:34:47 | 797,786,112 | -HS- | M] () – C:\hiberfil.sys
[2012/08/15 21:34:21 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/08/14 22:20:41 | 000,000,124 | —- | M] () – C:\Users\Scherer Electric 3\Desktop\fix.reg
[2012/08/12 23:08:13 | 004,729,547 | R— | M] (Swearware) – C:\Users\Scherer Electric 3\Desktop\ComboFix.exe
[2012/08/08 09:28:07 | 000,635,046 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/08 09:28:07 | 000,111,548 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/08 08:21:50 | 000,001,047 | —- | M] () – C:\Users\Scherer Electric 3\Desktop\Kaspersky Security Scan.lnk
[2012/08/06 09:05:24 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Scherer Electric 3\Desktop\OTL.exe
[2012/08/02 13:24:04 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

========== Files Created - No Company Name ==========

[2012/08/14 22:17:07 | 000,000,124 | —- | C] () – C:\Users\Scherer Electric 3\Desktop\fix.reg
[2012/08/12 23:09:19 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/08/12 23:09:19 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/08/12 23:09:19 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/08/12 23:09:19 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/08/12 23:09:19 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/08/08 08:22:30 | 000,001,047 | —- | C] () – C:\Users\Scherer Electric 3\Desktop\Kaspersky Security Scan.lnk
[2012/08/03 10:59:35 | 000,000,957 | —- | C] () – C:\Users\Public\Desktop\Bidwinner 9.lnk
[2012/08/03 10:59:35 | 000,000,950 | —- | C] () – C:\Users\Public\Desktop\Time & Material Billing 9.lnk
[2012/08/03 10:59:34 | 000,002,069 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/08/03 10:59:34 | 000,002,001 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerDVD.lnk
[2012/08/03 10:59:34 | 000,001,515 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/08/03 10:59:34 | 000,001,352 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/08/03 10:59:34 | 000,001,330 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/08/03 10:59:34 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/08/03 10:59:34 | 000,001,246 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/08/03 10:59:34 | 000,001,210 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/08/03 10:59:33 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/08/03 10:59:33 | 000,001,024 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR Registration.lnk
[2012/08/03 10:59:32 | 000,000,977 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat_com.lnk
[2012/08/03 08:43:20 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/08/02 13:24:04 | 000,001,067 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/02 13:21:42 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2011/07/05 13:20:00 | 000,000,036 | —- | C] () – C:\Users\Scherer Electric 3\AppData\Local\housecall.guid.cache

========== LOP Check ==========

[2011/10/18 09:02:49 | 000,000,000 | —D | M] – C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF
[2010/02/08 12:13:04 | 000,000,000 | —D | M] – C:\Users\Awrcs 2\AppData\Roaming\Accubid
[2010/02/08 11:40:49 | 000,000,000 | —D | M] – C:\Users\Scherer Electric 3\AppData\Roaming\webex
[2009/07/14 00:53:46 | 000,025,348 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\erdnt\cache\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\erdnt\cache\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\System32\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2004/08/04 06:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\i386\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 06:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\i386\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\erdnt\cache\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\i386\winlogon.exe
[2009/10/28 02:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 01:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\erdnt\cache\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST960813AS ATA Device
Partitions: 2
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 56.00GB
Starting Offset: 57576960
Hidden sectors: 0


< End of report >
Post #55
  • OTL

    Run OTL.exe.

    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

      :OTL
[2011/10/18 09:02:49 | 000,000,000 | —D | M] – C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF

:Commands
[createrestorepoint]
[purity]
[resethosts]
[emptytemp]
    • Click the Run Fix button.
    • OTL will now process the instructions.
    • When finished a box will open asking you to open the fix log, click OK.
    • The fix log will open.
    • Copy/Paste the log in your next reply please.

    Note: If necessary, OTL may reboot your computer, or request that you do so. If it does, please go ahead and reboot your machine. After rebooting, open up Windows Explorer (Windows Key +E) and navigate to C:\_OTL\MovedFiles. Within, you should find a .log file with the format mmddyyyy_hhmmss, which represents the date and time the fix was run. Please copy and paste the contents of that file, making sure Word Wrap is off beforehand, if necessary.

    —-

    Now let's update a few programs that are known for their security vulnerabilities. It is important these programs be kept up-to-date for your safety.

  • Java is out of date

    Open up your Start menu and start typing programs and features until the applet appears so you can open it. Find and remove any instances of Java.

    Now go to here to download the latest Java installer. Go through the installation process.

    Clear Java cache

    Go into the Control Panel and double-click the Java icon (looks like a coffee cup). If you do not see the icon, switch to Classic View.

    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • Leave the default boxes checked
    • Click OK on Delete Files and Applications window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • You may now close the Java control panel.
  • Adobe Reader is out of date

    The latest version of Adobe Reader can be downloaded here (skip McAfee).

Are your icons still missing? How about anything from your start menu?
Post #56
Here is the OTL log. I cannot locte the OTL\Moved Files you refer to after restart. And yes, the desktop and taskbar icons are still missing. The start menu has been viewable. All processes killed ========== OTL ========== C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF folder moved successfully. ========== COMMANDS ========== Restore point Set: OTL Restore Point C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Awrcs 2 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 30690825 bytes ->Java cache emptied: 19371 bytes ->Flash cache emptied: 2440 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 41620 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: Scherer Electric 3 ->Temp folder emptied: 290411 bytes ->Temporary Internet Files folder emptied: 45160181 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 49700 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 8420800 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 81.00 mb OTL by OldTimer - Version 3.2.56.0 log created on 08202012_130817 Files\Folders moved on Reboot… File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF0FB316F80233C155.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF2630D1929C3879BA.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF35B335F5A0FFC10D.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF5DDAD6F43F8ECED4.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF7FD1286C9115F432.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF9A0E6CEB6F9ACBED.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DFA717369007537B59.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DFB1BCDB55041D30D8.TMP not found! File\Folder C:\Users\Scherer Electric 3\AppData\Local\Temp\~DFFFFCCE404D05EDC3.TMP not found! File move failed. C:\Windows\temp\hlktmp scheduled to be moved on reboot. PendingFileRenameOperations files… File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF0FB316F80233C155.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF2630D1929C3879BA.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF35B335F5A0FFC10D.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF5DDAD6F43F8ECED4.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF7FD1286C9115F432.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DF9A0E6CEB6F9ACBED.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DFA717369007537B59.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DFB1BCDB55041D30D8.TMP not found! File C:\Users\Scherer Electric 3\AppData\Local\Temp\~DFFFFCCE404D05EDC3.TMP not found! [2012/08/20 13:12:40 | 008,405,015 | —- | M] () C:\Windows\temp\hlktmp : Unable to obtain MD5 Registry entries deleted on Reboot…
Post #57
  • SystemLook

    Please download SystemLook from one of the links below and save it to your Desktop.

    Download Mirror #1
    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:

      :dir
C:\Windows\temp\hlktmp /s
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

  • Reg fix

    Copy the contents of the following code box and paste it in notepad.

    Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=-
"NoDesktop"=-
"NoActiveDesktopChanges"=-
"NoSetActiveDesktop"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"HideIcons"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoRun"=-
"NoDesktop"=-
"NoActiveDesktopChanges"=-
"NoSetActiveDesktop"=-

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop]

    Save the file as fix.reg and as type "All Files (*.*)" to your desktop. Double click the icon and merge it into the registry. You may need to reboot. Let me know if any of your icons are restored.
Post #58 last edited
Here is the SystemLook log, and no, none of the desktop or taskbar icons are restored. SystemLook SystemLook 30.07.11 by jpshortstuff Log created at 06:35 on 21/08/2012 by Scherer Electric 3 Administrator - Elevation successful ========== dir ========== C:\Windows\temp\hlktmp - Unable to find folder. -= EOF =-
Post #60
OMG! It was just that simple. My icons are back on my desktop and I just un-pinned all of the blank squares for the programs on my taskbar and when I re-pinned them, the icons came back. Pam

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI