What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected Sony Laptop [Solved]

26 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
Hi, I'm only posting the security check for now and will report the next one soon.

Security Check
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
AVG2012 successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.65.0.1400
AVG PC Tuneup
Java™ 6 Update 35
Java™ 6 Update 6
Java™ 6 Update 7
Java version out of Date!
Adobe Flash Player 9 Flash Player out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.4.402.287
Adobe Reader 8 Adobe Reader out of Date!
Mozilla Firefox (16.0.1)
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
Post #47
Hi again.
Here is the result of ESETScan.
ESETScan
:\Program Files\FoxTabAudioConverter\AudioConverter.exe a variant of Win32/InstallCore.A application
C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe Win32/Toolbar.Zugo application
C:\ProgramData\ADDICT-THING\506f531d5154f.ocx Win32/Adware.MultiPlug.C application
C:\Users\Emi\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\120606110031864.rsc a variant of Win32/Toolbar.Babylon application
C:\Users\Emi\Downloads\SoftonicDownloader_for_youtube-song-downloader.exe a variant of Win32/SoftonicDownloader.E application
C:\Users\Emi\Downloads\VeohWebPlayerSetup_eng.exe Win32/Toolbar.Zugo application

Oh dear, never ending story, isn't it!
Post #48 last edited
By the way, I'm wondering if I need windows defender as well as AVG Anti-Virus. Sorry for the silly question, but when I scanned my pc with esetscan, it told me to enable windows defender( but I wasn't aware the original setting, so I only enabled AVG.)). So I clicked this defender program, but it said it wasn't active. I tried the scanner anyway after this and scanner started working. Now I don't know what it is supposed to be. I hope you understand what I mean… Thanks!
Post #49
Because Eset is an antivirus, AVG should have been disabled while it ran but whatever the staus, it all ran OK.

By the way, I'm wondering if I need windows defender

nobody needs it – it is a useless waste of resources.

Oh dear, never ending story, isn't it!

No problem - Eset just did the job it was supposed to and picked up a few things that needed to be tidied up. Running this should do it.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services
:Files
C:\Program Files\FoxTabAudioConverter\AudioConverter.exe 
C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe 
C:\ProgramData\ADDICT-THING\
C:\Users\Emi\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\
C:\Users\Emi\Downloads\SoftonicDownloader_for_youtube-song-downloader.
C:\Users\Emi\Downloads\VeohWebPlayerSetup_eng.exe 
:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
Logs to include in the next post:

OTL fix log
New OTL log

Saatchfan
Post #50
Hi there, here is the report.

OTL Fix log
All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
C:\Program Files\FoxTabAudioConverter\AudioConverter.exe moved successfully.
C:\Program Files\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe moved successfully.
C:\ProgramData\ADDICT-THING folder moved successfully.
C:\Users\Emi\AppData\Roaming\AVG\Rescue\PC Tuneup 2011 folder moved successfully.
File\Folder C:\Users\Emi\Downloads\SoftonicDownloader_for_youtube-song-downloader. not found.
C:\Users\Emi\Downloads\VeohWebPlayerSetup_eng.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User

User: Emi
->Temp folder emptied: 33670 bytes
->Temporary Internet Files folder emptied: 120839 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 367569210 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 2168 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 75932 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 351.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 10182012_105153

Files\Folders moved on Reboot…
File\Folder C:\Windows\temp\JETE0DC.tmp not found!

PendingFileRenameOperations files…

Registry entries deleted on Reboot…
Post #51
New OTL log
OTL logfile created on: 2012/10/18 11:11:51 - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Emi\Desktop\デスクトップ
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

1013.56 Mb Total Physical Memory | 286.25 Mb Available Physical Memory | 28.24% Memory free
2.24 Gb Paging File | 1.10 Gb Available in Paging File | 49.07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 85.71 Gb Total Space | 16.87 Gb Free Space | 19.69% Space Free | Partition Type: NTFS

Computer Name: EMI-PC | User Name: Emi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/13 15:51:17 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Emi\Desktop\デスクトップ\OTL.exe
PRC - [2012/08/13 03:24:48 | 005,167,736 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgidsagent.exe
PRC - [2012/07/31 03:37:02 | 002,596,984 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 03:23:08 | 000,758,392 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 03:48:24 | 001,255,544 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2012/01/23 05:43:08 | 000,247,728 | —- | M] (TomTom) – C:\Users\Emi\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2012/01/23 05:43:08 | 000,092,592 | —- | M] (TomTom) – C:\Users\Emi\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2011/11/03 17:20:58 | 000,803,144 | —- | M] (AVG) – C:\Program Files\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2011/07/29 00:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/10/29 07:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/08/24 12:59:10 | 000,870,240 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
PRC - [2007/02/06 04:36:22 | 000,090,112 | —- | M] (SigmaTel, Inc.) – C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
PRC - [2007/01/18 06:48:42 | 002,752,512 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2007/01/16 02:53:08 | 002,170,880 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
PRC - [2007/01/12 15:14:34 | 000,278,528 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
PRC - [2007/01/12 14:41:40 | 000,278,528 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2006/11/28 11:27:46 | 000,274,432 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
PRC - [2006/11/28 11:09:58 | 000,135,168 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
PRC - [2006/11/28 11:09:46 | 000,172,032 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
PRC - [2006/11/27 13:15:30 | 000,465,016 | —- | M] (Sony Corporation) – C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
PRC - [2006/11/24 09:58:38 | 000,919,672 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
PRC - [2006/11/24 02:36:54 | 000,182,392 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
PRC - [2006/11/24 02:36:54 | 000,100,472 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2006/11/14 02:46:24 | 000,411,768 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
PRC - [2006/11/13 10:43:36 | 000,472,632 | —- | M] () – C:\Program Files\Sony\SonicStage\SSAAD.exe
PRC - [2006/11/11 07:35:36 | 000,043,128 | —- | M] (Sony Corporation) – C:\Program Files\Sony\ISB Utility\ISBMgr.exe
PRC - [2006/11/02 10:45:21 | 000,165,376 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lpksetup.exe
PRC - [2006/11/02 10:45:21 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lpremove.exe
PRC - [2006/10/31 14:40:16 | 000,077,824 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2006/10/27 12:13:48 | 000,270,336 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2006/10/13 02:34:56 | 000,448,632 | —- | M] (Sony Corporation) – C:\Program Files\Sony\SetGamma\SetGamma.exe
PRC - [2006/10/01 04:00:00 | 000,045,056 | —- | M] (Texim Corporarion.) – C:\Program Files\Justsystem\PersonalShelter\TxVDrvSvc.exe
PRC - [2006/09/27 07:25:40 | 004,038,656 | —- | M] (Sony Corporation) – C:\Program Files\Sony\FeliCa Sensing\FeliSen.exe
PRC - [2006/09/11 08:23:22 | 000,118,784 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\Apoint.exe
PRC - [2006/09/08 07:06:08 | 000,040,960 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApntEx.exe
PRC - [2006/09/08 06:54:30 | 000,042,544 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApMsgFwd.exe
PRC - [2006/02/06 15:00:20 | 000,311,296 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
PRC - [2006/01/23 15:14:10 | 000,069,632 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/03 17:21:06 | 000,350,024 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011/11/03 17:21:06 | 000,184,136 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011/11/03 17:21:06 | 000,050,504 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madDisAsm_.bpl
MOD - [2011/07/29 00:09:42 | 000,096,112 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011/07/29 00:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
MOD - [2011/06/24 22:56:36 | 000,087,328 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2006/11/14 02:46:24 | 000,040,960 | —- | M] () – C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll
MOD - [2006/11/13 10:43:36 | 000,472,632 | —- | M] () – C:\Program Files\Sony\SonicStage\SSAAD.exe
MOD - [2006/11/13 06:20:07 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2006/11/13 06:20:00 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/09/29 14:20:18 | 000,096,352 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\plugins\device\usb.gp
MOD - [2006/09/29 14:20:10 | 000,137,312 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\plugins\command\basic.gp
MOD - [2006/09/29 14:20:00 | 000,383,072 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\rw.dll
MOD - [2006/09/29 14:19:56 | 000,190,560 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\felica.dll
MOD - [2005/07/22 13:30:20 | 000,065,536 | —- | M] () – C:\Windows\System32\TosCommAPI.dll
MOD - [2004/10/14 02:18:24 | 000,040,960 | —- | M] () – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtAfh.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe – (vToolbarUpdater12.2.6)
SRV - File not found [Auto | Running] – C:\Program Files\Spybot – (SBSDWSCService)
SRV - [2012/10/11 02:04:37 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/10/08 20:51:56 | 000,250,808 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/13 03:24:48 | 005,167,736 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgidsagent.exe – (AVGIDSAgent)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/02/14 04:53:38 | 000,193,288 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2012/01/23 05:43:08 | 000,092,592 | —- | M] (TomTom) [Auto | Running] – C:\Users\Emi\TomTom HOME 2\TomTomHOMEService.exe – (TomTomHOMEService)
SRV - [2007/06/29 04:00:04 | 000,265,912 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/02/06 04:36:22 | 000,090,112 | —- | M] (SigmaTel, Inc.) [Auto | Running] – C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe – (STacSV)
SRV - [2007/01/10 08:51:06 | 000,745,472 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe – (VAIOMediaPlatform-UCLS-AppServer)
SRV - [2007/01/10 02:43:24 | 000,073,728 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe – (VAIO Entertainment TV Device Arbitration Service)
SRV - [2007/01/08 09:06:40 | 001,089,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-UCLS-UPnP)
SRV - [2007/01/08 09:06:40 | 001,089,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-IntegratedServer-UPnP)
SRV - [2007/01/08 09:06:40 | 000,397,312 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-UCLS-HTTP)
SRV - [2007/01/08 09:06:40 | 000,397,312 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-IntegratedServer-HTTP)
SRV - [2006/11/28 11:27:46 | 000,274,432 | —- | M] (Sony Corporation) [On_Demand | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe – (Vcsw)
SRV - [2006/11/28 11:09:58 | 000,135,168 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe – (VzFw)
SRV - [2006/11/28 11:09:46 | 000,172,032 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe – (VzCdbSvc)
SRV - [2006/11/27 09:14:44 | 000,413,696 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\Smart Network\BeService.exe – (BeService)
SRV - [2006/11/24 02:36:54 | 000,182,392 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe – (VAIO Event Service)
SRV - [2006/11/13 09:31:22 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe – (SSScsiSV)
SRV - [2006/10/31 14:40:16 | 000,077,824 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)
SRV - [2006/10/24 02:32:08 | 002,523,136 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe – (VAIOMediaPlatform-IntegratedServer-AppServer)
SRV - [2006/10/04 10:25:00 | 000,057,344 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe – (MSCSPTISRV)
SRV - [2006/10/04 10:15:30 | 000,057,344 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe – (PACSPTISVR)
SRV - [2006/10/04 10:06:58 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe – (SPTISRV)
SRV - [2006/10/01 04:00:00 | 000,045,056 | —- | M] (Texim Corporarion.) [Auto | Running] – C:\Program Files\Justsystem\PersonalShelter\TxVDrvSvc.exe – (TxVDrvSvc)
SRV - [2006/08/28 13:38:04 | 000,491,520 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe – (VAIOMediaPlatform-Mobile-Gateway)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\SymIM.sys – (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Emi\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2012/09/04 09:18:29 | 000,027,496 | —- | M] (AVG Technologies) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtpx86.sys – (avgtp)
DRV - [2012/08/24 15:43:18 | 000,301,920 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2012/07/26 03:21:30 | 000,237,408 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2012/04/19 04:50:26 | 000,024,896 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\Windows\System32\drivers\avgidshx.sys – (AVGIDSHX)
DRV - [2012/01/31 04:46:50 | 000,031,952 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\System32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/12/23 13:32:14 | 000,041,040 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsshimx.sys – (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsfilterx.sys – (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsdriverx.sys – (AVGIDSDriver)
DRV - [2008/04/22 18:33:30 | 000,038,856 | —- | M] (Teruten Co. LTD.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\GDISpy.sys – (GDISpyDevice)
DRV - [2007/02/06 04:36:48 | 000,650,240 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/01/12 13:41:32 | 000,113,792 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbd.sys – (tosrfbd)
DRV - [2007/01/12 13:16:54 | 000,040,576 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfusb.sys – (tosrfusb)
DRV - [2006/11/20 09:55:16 | 000,036,480 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbnp.sys – (tosrfbnp)
DRV - [2006/11/07 03:51:50 | 000,506,368 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ExpasAG.sys – (LEX_AS_NIC_SERVICE_YNOS)
DRV - [2006/11/06 14:56:03 | 000,227,328 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ti21sony.sys – (ti21sony)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express)
DRV - [2006/11/01 05:31:46 | 000,017,328 | —- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SiWinAcc.sys – (SiFilter)
DRV - [2006/11/01 05:31:14 | 000,012,464 | —- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SiRemFil.sys – (SiRemFil)
DRV - [2006/11/01 05:30:34 | 000,074,672 | —- | M] (Silicon Image, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\SI3132.sys – (SI3132)
DRV - [2006/10/30 01:42:28 | 001,786,880 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw3v32.sys – (NETw3v32)
DRV - [2006/10/27 14:08:36 | 000,072,704 | —- | M] (Ricoh) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\R5U870FLx86.sys – (R5U870FLx86)
DRV - [2006/10/27 14:08:32 | 000,043,904 | —- | M] (Ricoh) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\R5U870FUx86.sys – (R5U870FUx86)
DRV - [2006/10/25 12:53:00 | 000,058,112 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Sonyddpu.sys – (Sonyddpu)
DRV - [2006/10/18 03:56:30 | 000,010,216 | —- | M] (Sony Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\DMICall.sys – (DMICall)
DRV - [2006/10/13 12:34:22 | 000,027,520 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SonyNC.sys – (SNC)
DRV - [2006/10/10 11:33:00 | 000,041,600 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosporte.sys – (tosporte)
DRV - [2006/10/05 08:07:46 | 000,073,600 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Tosrfhid.sys – (Tosrfhid)
DRV - [2006/10/01 04:00:00 | 000,022,272 | —- | M] (Texim Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\TxVDrv.sys – (TxVDrv)
DRV - [2006/09/06 10:44:52 | 000,030,976 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SonyImgF.sys – (SonyImgF)
DRV - [2006/08/30 01:35:58 | 000,140,800 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2006/08/04 09:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2005/08/01 08:45:00 | 000,064,896 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2005/01/06 05:42:00 | 000,018,612 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfnds.sys – (tosrfnds)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.jp/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.yahoo.co.jp"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Emi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/11 10:43:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/07/02 16:58:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/17 13:22:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/13 15:05:03 | 000,000,000 | —D | M]

[2012/10/16 17:46:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Extensions
[2008/10/22 12:00:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Extensions\[removed]
[2012/10/17 13:22:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/10/13 15:04:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012/10/11 02:05:24 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/10/11 02:36:32 | 000,002,016 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-jp.xml
[2012/10/11 02:36:32 | 000,004,043 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google-jp.xml
[2012/10/11 02:36:32 | 000,001,443 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\oshiete-goo.xml
[2012/10/11 02:36:32 | 000,000,988 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\rakuten.xml
[2012/10/11 02:36:32 | 000,002,271 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter-ja.xml
[2012/10/11 02:36:32 | 000,001,392 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-ja.xml
[2012/10/11 02:36:32 | 000,001,063 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-jp-auctions.xml
[2012/10/11 02:36:32 | 000,000,870 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-jp.xml

========== Chrome ==========

CHR - homepage: http://search.searchonme.com/

O1 HOSTS File: ([2012/10/12 22:19:06 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (かんたん登録2) - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\Program Files\Justsystem\SimpleAutoInput\AtInBnd.dll (株式会社ジャストシステム)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (かんたん登録2 ツールバー) - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\Program Files\Justsystem\SimpleAutoInput\AtInBnd.dll (株式会社ジャストシステム)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [E-Flyer] C:\Program Files\Sony\E-Flyer\SubFlyer.exe ()
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [SetGamma] C:\Program Files\Sony\SetGamma\SetGamma.exe (Sony Corporation)
O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation)
O4 - HKCU..\Run: [SsAAD.exe] C:\Program Files\Sony\SonicStage\SSAAD.exe ()
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Users\Emi\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Users\Emi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\かざそうFeliCa.lnk = C:\Program Files\Sony\FeliCa Sensing\FeliSen.exe (Sony Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Easy-WebPrint プレビュー - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 印刷 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 印刷リストに追加 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 高速印刷 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {91DFB26C-AFD7-47C2-A07D-D22AF3548169} http://beauty.geocities.yahoo.co.jp/namo/g…or/NamoWec6.cab (NamoWeCtl 6.0 for YahooJpn)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22CD1543-C312-4180-8903-388A87EEC278}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Emi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows フォト ギャラリー壁紙.jpg
O24 - Desktop BackupWallPaper: C:\Users\Emi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows フォト ギャラリー壁紙.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/17 19:08:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/10/17 13:22:32 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/10/14 18:43:02 | 000,000,000 | —D | C] – C:\_OTL
[2012/10/13 15:04:53 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/10/12 22:25:00 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/10/12 22:24:46 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\temp
[2012/10/12 21:59:18 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/10/12 21:59:18 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/10/12 21:59:17 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/10/12 21:59:17 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2012/10/12 21:59:03 | 000,000,000 | —D | C] – C:\ComboFix
[2012/10/12 21:55:24 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\デスクトップ
[2012/10/11 22:15:47 | 000,000,000 | —D | C] – C:\Qoobox
[2012/10/11 22:14:35 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/10/11 11:59:16 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Malwarebytes
[2012/10/11 11:58:49 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/10/11 11:58:47 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/10/11 11:58:47 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/10 16:07:52 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\RK_Quarantine
[2012/10/09 16:40:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/10/09 16:40:19 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/10/09 16:40:19 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/10/07 22:07:01 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\favorite songs 2
[2012/10/05 22:32:52 | 000,000,000 | —D | C] – C:\Program Files\SProtector
[2012/10/05 22:32:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ADDICT-THING
[2012/10/05 21:52:06 | 000,000,000 | —D | C] – C:\Users\Emi\dwhelper
[2012/10/03 22:11:46 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Video
[2012/10/03 22:10:41 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Video
[2012/10/03 22:09:21 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Converter
[2012/10/03 22:09:04 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Converter
[2012/10/03 22:07:42 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Audio
[2012/10/03 22:07:16 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Audio
[2012/10/03 22:07:16 | 000,000,000 | —D | C] – C:\Users\Emi\Documents\Freecorder
[2012/10/03 22:06:38 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Jaksta_Technologies_Pty_L
[2012/10/03 22:00:49 | 000,000,000 | —D | C] – C:\Program Files\Applian Technologies
[2012/10/03 20:52:05 | 000,000,000 | —D | C] – C:\Users\Emi\Documents\Abelssoft
[2012/10/03 20:03:27 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Abelssoft
[2012/10/03 15:26:32 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\favorite music
[2012/09/29 08:22:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2012/09/27 18:12:09 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\photos from ray
[2012/09/23 19:59:33 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Unity

========== Files - Modified Within 30 Days ==========

[2012/10/18 10:56:24 | 000,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/18 10:56:24 | 000,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/18 10:56:15 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/10/18 10:51:02 | 000,000,626 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/18 08:16:28 | 097,673,482 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/10/17 13:22:36 | 000,000,870 | —- | M] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/10/17 13:22:36 | 000,000,846 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/10/15 08:47:02 | 000,113,461 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjw.avm
[2012/10/12 22:19:06 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/10/11 11:58:50 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/10 18:31:20 | 000,000,512 | —- | M] () – C:\Users\Emi\Documents\MBR.dat
[2012/10/10 18:22:02 | 000,467,173 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/10/09 16:41:01 | 000,001,079 | —- | M] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/10/09 16:41:01 | 000,001,055 | —- | M] () – C:\Users\Emi\Desktop\Spybot - Search & Destroy.lnk
[2012/10/09 07:48:55 | 000,446,406 | —- | M] () – C:\Windows\System32\perfh011.dat
[2012/10/09 07:48:55 | 000,140,234 | —- | M] () – C:\Windows\System32\perfc011.dat
[2012/10/09 07:48:54 | 000,704,984 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/10/09 07:48:54 | 000,140,134 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/10/05 22:12:41 | 000,118,272 | —- | M] () – C:\Users\Emi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/19 09:20:26 | 158,419,261 | —- | M] () – C:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2012/10/17 13:22:36 | 000,000,870 | —- | C] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/10/17 13:22:36 | 000,000,858 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/10/17 13:22:36 | 000,000,846 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/10/12 21:59:18 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/10/12 21:59:18 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/10/12 21:59:18 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/10/12 21:59:18 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/10/12 21:59:18 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/10/11 11:58:50 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/10 18:31:20 | 000,000,512 | —- | C] () – C:\Users\Emi\Documents\MBR.dat
[2012/10/09 16:41:01 | 000,001,079 | —- | C] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/10/09 16:41:01 | 000,001,055 | —- | C] () – C:\Users\Emi\Desktop\Spybot - Search & Destroy.lnk
[2012/06/06 10:54:02 | 000,034,814 | —- | C] () – C:\Users\Emi\AppData\Local\dt.dat
[2011/02/08 12:48:55 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/10/28 08:04:15 | 000,001,940 | —- | C] () – C:\Users\Emi\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/26 11:01:28 | 000,000,680 | —- | C] () – C:\Users\Emi\AppData\Local\d3d9caps.dat
[2009/10/16 13:41:04 | 000,700,572 | —- | C] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2009/02/10 18:49:02 | 000,000,104 | —- | C] () – C:\Users\Emi\コンピュータ - ショートカット.lnk
[2007/06/27 14:16:13 | 000,118,272 | —- | C] () – C:\Users\Emi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 13:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2008/11/06 13:57:06 | 011,315,712 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/03/03 05:16:12 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/02 10:46:13 | 000,348,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/06/06 11:00:08 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\AVG
[2011/10/30 22:26:06 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\AVG2012
[2009/11/29 10:37:48 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\EPSON
[2012/10/03 22:07:16 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Audio
[2012/10/03 22:09:05 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Converter
[2012/10/03 22:11:32 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Video
[2007/12/22 01:23:22 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\InterVideo
[2007/08/05 11:08:57 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Justsystem
[2010/01/20 12:02:21 | 000,000,000 | -H-D | M] – C:\Users\Emi\AppData\Roaming\Question Tools
[2008/10/22 12:00:50 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\TomTom
[2009/10/27 22:05:55 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\らくちんCDダイレクトプリント for Canon
[2008/05/22 03:32:36 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\エレコムらくちんプリント

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >
Post #53
No, I don't think so, it's working smoothly now! A few things to ask… 1) Is there anything that I should do to maintain my PC clean regularly? 2) Can I uninstall software I downloaded this time for this issue or are some of them useful to keep in the future? (I can delete the all logs I posted you, can't I?) 3)What sort of anti-virus (or possibly other sort such as internet security and stuff) do you recommend??? I used to have Norton, but my PC is now over 5years old and Norton was too powerful then (it was 1-2years ago) and couldn't work fast enough, so I ended up having free version AVG. Thanks.
Post #54 last edited
Good work, your computer appears to be clean.

Most of your questions will be answered with the information below.

With regard to your antivirus question:
  • Norton has always been, and still is, a resource hog and I would never have it on my system
  • AVG has always been very reliable but is now also becoming a bit “bulky” and also slowing systems down
I use Microsoft Security Essentials but Avira and Avast are also very good and ones that we recommend. They are also all free.

Here are links to all three:

Free Avast Home Edition
Avira AntiVir® Personal Edition Classic
Microsoft Security Essentials

NOTE: If you download any of these, uninstall AVG before installing a different one and do NOT install more than one or they will fight against each other and render each ineffective.

===================================================

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix
  • click START then RUN
  • now type Combofix /uninstall in the runbox and click OK.
Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)
  • please follow the prompts to uninstall Combofix.
  • once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================

Uninstall OTL
  • Double-click OTL.exe
  • Click the CleanUp! button.
  • Select Yes when the Begin cleanup Process? prompt appears.
  • If you are prompted to reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

You can just delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Uninstall AdwCleaner
  • double click on adwcleaner.exe to run the tool
  • click on Uninstall
  • confirm with Yes.
You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Update installed programs

You have old versions on your computer which are vulnerable to infections.

Java, Flash & Adobe Reader
  • from the Start menu, select Control Panel.
  • in Large or Small icon view, click Programs and Features. If you're using Category view, under "Programs", click Uninstall a program.
  • select any versions of Java, Flash and Adobe Reader then click Uninstall.
Install the latest versions:

Java
Adobe Reader
Flash

Windows Internet Explorer 7

You should install Internet Explorer 9. It has many new and improved features. The most important of these features is that older browsers will not be able to access some of those written in the new HTML5 code and earlier browsers may not comply with security requirements of some sites including banking sites.

Go here for information and download.

===================================================

Spybot - Search and Destroy’ – Re-enable TeaTimer and remember to scan your computer with the program on a regular basis as you would with your anti-virus software.

===================================================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes


If I hear nothing for 24 hours I shall assume all is well and close the topic.

Safe computing

Satchfan
Post #55
Hi, me again. I'm in the middle of updating Java and the others as you said. Now, I tried to uninstall Combofix , but there is no 'run' button from the 'start' button. Is it ok to uninstall it from the control panel in a normal way??? Thanks.
Post #56
You can either hold down the Windows key and press "R" at the same time or you can get yourself an entry for "Run"from the start menu.

To get yourself an entry from the start menu:
  • right-click on the start button and choose "Properties".
  • make sure the “Start Menu” tab is selected and click on customise
  • scroll down to “Run command”, put a tick in the box and click OK.
Post #57
Satchfan Well, I think, now, the problem has been sorted! If there are any other questions, I may have to ask you again within 24hours from whenever you said, but I'd like to say A BIG THANK YOU for your great help :) :) :) and I hope a little donation I made is coming through OK. Thanks again!
Post #58

I'd like to say A BIG THANK YOU for your great help and I hope a little donation I made is coming through OK

You are welcome for the help and glad I could ebe of assistance. :)

The donation is very kind.

I'll leave this for 24 hours from now just to be sure.

Kind regards

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI