Author Topic: Pc Problems (Read 55603 times)

thammondwis · « **on:** October 22, 2010, 04:53:03 AM »

I have been having a few problems on my computer. I hope you can help me.

I keep getting a "Generic Host Process for Win32 Services encountered
a problem" error. I have problems with windows explorer not responding.
Firefox does run, but I get redirected to a different sites when clicking on a link
in Yahoo search. I also had a message when updating windows that the security
patches for .net framework? were not installed on 3 different versions I think.

I ran through steps 1-5 of the read this before requesting help.

Please help,

Thanks,

Tim

Allan · « **Reply #1 on:** October 22, 2010, 05:55:48 AM »

Please follow the instructions in the following link and post your logs:
http://www.computerhope.com/forum/index.php/topic,46313.0.html

thammondwis · « **Reply #2 on:** October 22, 2010, 06:08:53 PM »

Here is the SuperAntiSpyware log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/21/2010 at 09:20 PM

Application Version : 4.44.1000

Core Rules Database Version : 5730
Trace Rules Database Version: 3542

Scan type : Complete Scan
Total Scan Time : 02:50:31

Memory items scanned : 525
Memory threats detected : 0
Registry items scanned : 6921
Registry threats detected : 52
File items scanned : 219110
File threats detected : 111

Adware.CouponBar
   HKLM\Software\Classes\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\Implemented Categories
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\InprocServer32
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\InprocServer32#ThreadingModel
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\ProgID
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\Programmable
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\TypeLib
   HKCR\CLSID\{5BED3930-2E9E-76D8-BACC-80DF2188D455}\VersionIndependentProgID
   HKCR\TTB000001.TTB000001.1
   HKCR\TTB000001.TTB000001.1\CLSID
   HKCR\TTB000001.TTB000001
   HKCR\TTB000001.TTB000001\CLSID
   HKCR\TTB000001.TTB000001\CurVer
   HKCR\TypeLib\{9BA983B1-0C05-2DAF-9D1D-7E160077CAF4}
   HKCR\TypeLib\{9BA983B1-0C05-2DAF-9D1D-7E160077CAF4}\1.0
   HKCR\TypeLib\{9BA983B1-0C05-2DAF-9D1D-7E160077CAF4}\1.0\0
   HKCR\TypeLib\{9BA983B1-0C05-2DAF-9D1D-7E160077CAF4}\1.0\0\win32
   HKCR\TypeLib\{9BA983B1-0C05-2DAF-9D1D-7E160077CAF4}\1.0\FLAGS
   HKCR\TypeLib\{9BA983B1-0C05-2DAF-9D1D-7E160077CAF4}\1.0\HELPDIR
   C:\WINDOWS\COUPONBARIE.DLL
   HKLM\Software\Classes\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}\InprocServer32
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}\InprocServer32#ThreadingModel
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}\ProgID
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}\Programmable
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}\TypeLib
   HKCR\CLSID\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}\VersionIndependentProgID
   HKCR\ToolBand.TTB000000.1
   HKCR\ToolBand.TTB000000.1\CLSID
   HKCR\ToolBand.TTB000000
   HKCR\ToolBand.TTB000000\CLSID
   HKCR\ToolBand.TTB000000\CurVer
   C:\WINDOWS\COUPON~1.DLL
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   HKU\S-1-5-21-842925246-789336058-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5BED3930-2E9E-76D8-BACC-80DF2188D455}
   HKU\S-1-5-21-842925246-789336058-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{62960D20-6D0D-1AB4-4BF1-95B0B5B8783A}
   C:\WINDOWS\SYSTEM32\CPNPRT2.CID
   HKCR\Interface\{0D700D4A-F8C1-8888-C5BA-CB09D464A4E8}
   HKCR\Interface\{0D700D4A-F8C1-8888-C5BA-CB09D464A4E8}\ProxyStubClsid
   HKCR\Interface\{0D700D4A-F8C1-8888-C5BA-CB09D464A4E8}\ProxyStubClsid32
   HKCR\Interface\{0D700D4A-F8C1-8888-C5BA-CB09D464A4E8}\TypeLib
   HKCR\Interface\{0D700D4A-F8C1-8888-C5BA-CB09D464A4E8}\TypeLib#Version
   HKCR\Interface\{6D69B86A-B94C-59EE-BCB8-5F5DF46B2BE8}
   HKCR\Interface\{6D69B86A-B94C-59EE-BCB8-5F5DF46B2BE8}\ProxyStubClsid
   HKCR\Interface\{6D69B86A-B94C-59EE-BCB8-5F5DF46B2BE8}\ProxyStubClsid32
   HKCR\Interface\{6D69B86A-B94C-59EE-BCB8-5F5DF46B2BE8}\TypeLib
   HKCR\Interface\{6D69B86A-B94C-59EE-BCB8-5F5DF46B2BE8}\TypeLib#Version

Adware.Tracking Cookie
   C:\Documents and Settings\Home\Cookies\home@atdmt[2].txt
   C:\Documents and Settings\Home\Cookies\[email protected][2].txt
   C:\Documents and Settings\Home\Cookies\home@doubleclick[1].txt
   C:\Documents and Settings\Home\Cookies\[email protected][1].txt
   a.ads1.msn.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   ads1.msn.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   content3.pornkolt.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   files.streamsex.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   flvplayer2.hardsextube.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   free.porn.sc [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   interclick.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   maxporn.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   media.scanscout.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   media1.break.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   naiadsystems.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   porn.gonzo-movies.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   *censored*.dreammovies.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   sex.magicmovies.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   static.sexsearch.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   video.pornorama.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   www.freshteen.biz [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   www.maxporn.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   www.pornhub.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   www.sexyclips.in [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   www.ziporn.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   xxx.xnxxmovies.com [ C:\Documents and Settings\Admin\Application Data\Macromedia\Flash Player\#SharedObjects\MJJVADWM ]
   ad.yieldmanager.com [ C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\cookies.sqlite ]
   ad.yieldmanager.com [ C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\cookies.sqlite ]
   .imrworldwide.com [ C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\cookies.sqlite ]
   .imrworldwide.com [ C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\cookies.sqlite ]
   .doubleclick.net [ C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\cookies.sqlite ]
   core.insightexpressai.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   crackle.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   media.heavy.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   media.mtvnservices.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   media.scanscout.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   media1.break.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   msnbcmedia.msn.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   objects.tremormedia.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   secure-us.imrworldwide.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   www.crackle.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\VTDYXYFT ]
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@adbrite[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@adecn[1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@advertise[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@advertising[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@apmebf[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@atdmt[1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@doubleclick[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@invitemedia[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@media6degrees[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@mediabrandsww[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@mediaplex[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@pointroll[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@realmedia[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@ru4[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@serving-sys[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@shefinds[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@statcounter[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   crackle.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\WYBWAF82 ]
   media1.break.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\WYBWAF82 ]
   objects.tremormedia.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\WYBWAF82 ]
   secure-us.imrworldwide.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\WYBWAF82 ]
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@adbrite[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@adecn[1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@advertise[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@advertising[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@apmebf[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@atdmt[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@atdmt[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@bizzclick[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@casalemedia[1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@doubleclick[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@doubleclick[3].txt
   C:\Documents and Settings\NetworkService\Cookies\system@imrworldwide[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@invitemedia[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@lucidmedia[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@media6degrees[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@media6degrees[3].txt
   C:\Documents and Settings\NetworkService\Cookies\system@mediabrandsww[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@mediaplex[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@pointroll[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@realmedia[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@realmedia[3].txt
   C:\Documents and Settings\NetworkService\Cookies\system@ru4[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@statcounter[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@statcounter[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@tribalfusion[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@yieldmanager[1].txt

Trojan.Agent/Gen-Koobface[Bonkers]
   C:\CLASSIC COMBI LOADER\COMBILOADER.EXE
   C:\RFP_ADD-ONS\CLASSIC CARGO LOADER\CARGOLOADER.EXE
   C:\RFP_ADD-ONS\CLASSIC COMBI LOADER\COMBILOADER.EXE

Trojan.Unclassified/Dropper
   E:\BACKUP\TEMP\ALUP398.EXE

thammondwis · « **Reply #3 on:** October 22, 2010, 06:11:09 PM »

Here is the Malewarebyte log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4907

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/21/2010 9:53:52 PM
mbam-log-2010-10-21 (21-53-52).txt

Scan type: Quick scan
Objects scanned: 152198
Time elapsed: 9 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\
{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

thammondwis · « **Reply #4 on:** October 22, 2010, 06:25:15 PM »

I'm having a problem running HJT. It seems to hand up while running the scan. If I click anywhere in the HJT window I get the following message and can only close it by using End Task in the Windows Tak Manager:

This action can not be completed because the other application is busy

thammondwis · « **Reply #5 on:** October 22, 2010, 06:40:21 PM »

I did get HJT to run after rebooting the computer. Also another unusaul behavior I am noticing is that I usually have to double clicking multiple times on the Firefox icon to get Firefox to open.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:36:35 PM, on 10/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\mjusbsp\srvany.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\E-Color\Common\IconMgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\System32\snmp.exe
f:\autorun.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\MSI\DualCoreCenter\DualCoreCenter.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\E-Color\E-Color Indicator\TICIcon.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Home\Application Data\mjusbsp\st00000\mjsetup.exe
C:\Documents and Settings\Home\Application Data\mjusbsp\magicJack.exe
C:\Program Files\Trend Micro\HiJackThis\Sniper.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYATgBKADMAMgAtAEcAMwBMAEEAQQ"&"inst=NwA3AC0ANAAyADUAMAA2ADMANgA5ADUAL
QBUADUALQBCAEEAK
wAxAC0ASwBWADMAKwA3AC0AWABMACsAMQAtAFUA QwBBAEwATAArAA"&"prod=90"&"ver=9.0.856
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Home\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKUS\S-1-5-18\..\Run: [cdloader] "C:\Documents and Settings\NetworkService\Application Data\mjusbsp\cdloader2.exe" MAGICJACK (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [cdloader] "C:\Documents and Settings\NetworkService\Application Data\mjusbsp\cdloader2.exe" MAGICJACK (User 'Default user')
O4 - Global Startup: DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe
O4 - Global Startup: E-Color.lnk = C:\Program Files\E-Color\Common\IconMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.simnasa.org
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CVSNT Locking Service 2.5.03.2382 (cvslock) - Unknown owner - C:\Program Files\CVSNT\cvslock.exe
O23 - Service: CVSNT Dispatch service 2.5.03.2382 (cvsnt) - March Hare Software Ltd - C:\Program Files\CVSNT\cvsservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: magicJack - Unknown owner - C:\mjusbsp\srvany.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 11379 bytes

thammondwis · « **Reply #6 on:** October 23, 2010, 12:06:37 PM »

For what its worth, I reset internet explorer to the default settings and it seems as if the unusal behaviors I reported previously of both internet explorer and Firefox are not happening anymore.

thammondwis · « **Reply #7 on:** October 24, 2010, 08:13:58 AM »

After running a day or so since resetting internet explorer to default settings, I am still having some of the unusual behavior that I had originally posted but it occurs less frequently now.

I have not had the Win32 error since resetting but came had a new error message:

DualCoreCenter.exe has encountered a problem and needs to close.

SuperDave · « **Reply #8 on:** October 24, 2010, 11:29:03 AM »

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

************************************
Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.
***************************************
Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYATgBKADMAMgAtAEcAMwBMAEEAQQ"&"inst=NwA3AC0ANAAyADUAMAA2ADMANgA5ADUAL
QBUADUALQBCAEEAK
wAxAC0ASwBWADMAKwA3AC0AWABMACsAMQAtAFUA QwBBAEwATAArAA"&"prod=90"&"ver=9.0.856
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
Internet Explorer's security is based upon a set of zones. Each zone has different security in terms of what scripts and applications can be run from a site that is in that zone. There is a security zone called the Trusted Zone. This zone has the lowest security and allows scripts and applications from sites in this zone to run without your knowledge. It is therefore a popular setting for malware sites to use so that future infections can be easily done on your computer without your knowledge as these sites will be in the Trusted Zone. Therefore, I recommend that nothing be allowed in the trusted zone. If you agree, please do the following.Please place a check mark next to this/these line/lines.
O15 - Trusted Zone: http://www.simnasa.org

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.
************************************

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
*************************************
Please download ComboFix

from BleepingComputer.com

Alternate link: GeeksToGo.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console[/list]

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix

thammondwis · « **Reply #9 on:** October 24, 2010, 01:31:29 PM »

Completed the HJT instructions and here is the Security Check log:

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
AVG 2011
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 10.1.85.3
Adobe Reader 9.4.0
Mozilla Firefox (3.0.19) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

thammondwis · « **Reply #10 on:** October 24, 2010, 01:49:58 PM »

I did not complete the Combofix instructions because I received a warning message. I temporarily disabled AVG 2011 but when I ran Combofix, the warning message said Combofix detected that AVG 2011 is active. Any suggestions on how to proceed?

SuperDave · « **Reply #11 on:** October 25, 2010, 01:25:12 PM »

Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.
4. Run CCleaner.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
***********************************

Quote

Any suggestions on how to proceed?

Run the scan anyway.

thammondwis · « **Reply #12 on:** October 25, 2010, 07:51:25 PM »

I'm having problems with the Combofix. It started the scan and said it will take about 10 minutes, but could be double that if there is a lot of Maleware. I let it run for over a hour and nothing seemed to be happening. I could not stop or end it even with the task manager. The only thing I could do was turn the power off. I will try rerunning overnite in case it was still working when I shut down the power?

I also ran the program to remove old versions of java. I received a message that it encountered a problem and must shut down. I reran it and it seemed like it worked and gave the following log:

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Oct 25 20:41:09 2010

Found and removed: C:\Program Files\Java\jre1.6.0_05

Found and removed: C:\Program Files\Java\jre1.6.0_07

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_11

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_12

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_13

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_14

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_15

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_17

Found and removed: C:\Documents and Settings\Home\Application Data\Sun\Java\jre1.6.0_20

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610007

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610007

Found and removed: SOFTWARE\Classes\JavaPlugin.160_05

Found and removed: SOFTWARE\Classes\JavaPlugin.160_07

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_07

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_07

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160070}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: Software\Classes\JavaPlugin.160_05

Found and removed: Software\Classes\JavaPlugin.160_07

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_07

Found and removed: Software\JavaSoft\Java2D\1.6.0_05

Found and removed: Software\JavaSoft\Java2D\1.6.0_07

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_07

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Oct 25 20:42:19 2010

------------------------------------

Finished reporting.

thammondwis · « **Reply #13 on:** October 25, 2010, 08:10:09 PM »

I noticed something odd. Not sure if it is supposed to be there or not? I was rereading the instructions about ComboFix to make sure I did not miss something and noticed it referenced a log C:\combofix.txt. So I looked in the C:\ directory to see if there was a log there. I did not find a log but there is a "folder" there named commy (which is the name I changed combofix to per the instructions). It does not have a regular folder icon, but has the same icon as the "My Computer" icon in windows explorer. When I click on the commy folder it has the same icons in it that are in My Computer directory ( files, hard drives, removable drives, etc).

thammondwis · « **Reply #14 on:** October 26, 2010, 04:59:30 AM »

I had the same results with ComboFix after running it overnite. I get a message that the scan is started but hangs after that.

SuperDave · « **Reply #15 on:** October 26, 2010, 01:04:04 PM »

Delete your copy of ComboFix; download a fresh copy, except before you download it, rename it to blackpudding.bat

Navigate to Start --> Run, and enter the following command exactly as shown:

"%userprofile%\desktop\blackpudding.bat" /killall

See if ComboFix will run now

thammondwis · « **Reply #16 on:** October 26, 2010, 07:56:16 PM »

No that did not work. I ended up with the same result in that it seemed to hang after starting the scan. I had some issues following your directions. When I tried to save it to the desktop as blackpudding.bat using FireFox, it would save it as Blackpudding.bat.exe which I suspected might be a problem.

So I tried using Internet Explorer, but I needed to reset to the default settings again in order to get to the linked site. So I tried saving as a different name and changed the name also in the run command.

SuperDave · « **Reply #17 on:** October 27, 2010, 12:55:32 PM »

Ok. Let's try something else.

Download OTL to your desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* When the window appears, underneath Output at the top change it to Minimal Output.
* Check the boxes beside LOP Check and Purity Check.
* Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy and pate the contents of these files, one at a time, into your next reply.

Note: You may need two or more posts to fit them all in.

thammondwis · « **Reply #18 on:** October 27, 2010, 04:35:12 PM »

OTL.TXT log:

OTL logfile created on: 10/27/2010 5:27:44 PM - Run 1
OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Home\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 420.00 Mb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.10 Gb Total Space | 7.21 Gb Free Space | 9.73% Space Free | Partition Type: NTFS
Drive E: | 112.21 Gb Total Space | 46.35 Gb Free Space | 41.31% Space Free | Partition Type: NTFS

Computer Name: HOME | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Home\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Documents and Settings\NetworkService\Application Data\mjusbsp\magicJack.exe (magicJack L.P.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\mjusbsp\srvany.exe ()
PRC - C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
PRC - C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\MSI\DualCoreCenter\DualCoreCenter.exe ()
PRC - C:\Program Files\Lexmark 1200 Series\lxczbmon.exe (Lexmark International, Inc.)
PRC - C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe (Lexmark International, Inc.)
PRC - C:\Program Files\E-Color\E-Color Indicator\TICIcon.exe (E-Color, Inc.)
PRC - C:\Program Files\E-Color\Common\IconMgr.exe (E-Color, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Home\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Unlocker\UnlockerHook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (NMIndexingService) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe File not found
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (magicJack) -- C:\mjusbsp\srvany.exe ()
SRV - (W3SVC) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (MSFtpsvc) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (p2pgasvc) -- C:\WINDOWS\system32\p2pgasvc.dll (Microsoft Corporation)
SRV - (cvslock) -- C:\Program Files\CVSNT\cvslock.exe ()
SRV - (cvsnt) -- C:\Program Files\CVSNT\cvsservice.exe (March Hare Software Ltd)

========== Driver Services (SafeList) ==========

DRV - (NTACCESS) -- D:\NTACCESS.sys File not found
DRV - (MSICPL) -- D:\install4\MSICPL.sys File not found
DRV - (MRESP50a64) -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS File not found
DRV - (MREMP50a64) -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS File not found
DRV - (mcdbus) -- C:\WINDOWS\System32\DRIVERS\mcdbus.sys File not found
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
DRV - (catchme) -- C:\brown\catchme.sys File not found
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (WmXlCore) -- C:\WINDOWS\system32\drivers\WmXlCore.sys (Logitech Inc.)
DRV - (WmVirHid) -- C:\WINDOWS\system32\drivers\WmVirHid.sys (Logitech Inc.)
DRV - (WmFilter) -- C:\WINDOWS\system32\drivers\WmFilter.sys (Logitech Inc.)
DRV - (WmBEnum) -- C:\WINDOWS\system32\drivers\WmBEnum.sys (Logitech Inc.)
DRV - (RMCAST) -- C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (MQAC) -- C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (DualCoreCenter) -- C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys (MICRO-STAR INT'L CO., LTD.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvata) -- C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (PQNTDrv) -- C:\WINDOWS\System32\drivers\PQNTDRV.sys (PowerQuest Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginen ame: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1151
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.3
FF - prefs.js..extensions.enabledItems: [email protected]:1.4

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/04/17 08:12:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/10/25 09:38:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/21 05:20:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/06 06:56:11 | 000,000,000 | ---D | M]

[2009/04/13 05:36:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\Mozilla\Extensions
[2010/10/26 20:59:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\extensions
[2010/06/25 06:05:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/10/26 20:59:21 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/13 18:16:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/20 19:59:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2008/06/18 02:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2004/08/03 15:07:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Lexmark 1200 Series] C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WinSys2] C:\WINDOWS\system32\WinSys2.exe ()
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found
O4 - HKCU..\Run: [cdloader] C:\Documents and Settings\Home\Application Data\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\E-Color.lnk = C:\Program Files\E-Color\Common\IconMgr.exe (E-Color, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: simnasa.org ([www] https in Trusted sites)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Device Detection)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} http://secure2.comned.com/signuptemplates/securelogin-devel.cab (SecureLogin class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} http://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab (IGDTester Class)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.94.156.1 68.94.157.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Home\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Home\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Authentication Packages - (setuid) - C:\WINDOWS\System32\setuid.dll (March-Hare Software Ltd)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/16 18:39:31 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/10/27 17:24:55 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Home\Desktop\OTL.exe
[2010/10/27 05:46:47 | 000,000,000 | --SD | C] -- C:\brown
[2010/10/26 19:33:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Real
[2010/10/26 09:13:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2010/10/25 21:16:20 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Home\Recent
[2010/10/25 21:12:57 | 001,187,896 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\Home\My Documents\ccsetup236_slim.exe
[2010/10/25 20:39:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Home\My Documents\JavaRa
[2010/10/25 20:10:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/10/25 17:39:29 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/10/25 17:32:17 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/10/25 17:32:17 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/10/25 17:32:17 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/10/25 17:32:17 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/10/25 17:12:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/10/24 14:37:39 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/10/23 12:55:19 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Home\Desktop\Favorites
[2010/10/22 19:16:09 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/10/21 21:39:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\Malwarebytes
[2010/10/21 21:38:49 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/10/21 21:38:48 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/10/21 21:38:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/10/21 21:38:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/10/21 18:12:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\SUPERAntiSpyware.com
[2010/10/21 18:12:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/10/21 18:11:53 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/10/21 06:49:06 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/10/21 00:32:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Identities
[2010/10/20 22:26:58 | 000,000,000 | -H-D | C] -- C:\$AVG
[2010/10/20 21:42:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\AVG10
[2010/10/20 21:41:02 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2010/10/20 21:39:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/20 21:39:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2010/10/20 21:38:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/10/20 19:42:30 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010/10/20 05:07:18 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/10/20 05:07:18 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/10/20 05:07:18 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/10/19 02:26:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/10/19 02:26:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/10/13 16:10:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/10/13 02:36:02 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/13 02:36:02 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/13 02:35:47 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/10/06 06:55:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/27 17:29:52 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/27 17:27:09 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-842925246-789336058-839522115-1003.job
[2010/10/27 17:27:09 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-842925246-789336058-839522115-1003.job
[2010/10/27 17:25:00 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Home\Desktop\OTL.exe
[2010/10/27 17:19:22 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/10/27 17:17:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/10/27 05:45:57 | 003,887,256 | R--- | M] () -- C:\Documents and Settings\Home\Desktop\brown.bat
[2010/10/26 22:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At47.job
[2010/10/26 22:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At23.job
[2010/10/26 21:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At46.job
[2010/10/26 21:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At22.job
[2010/10/26 20:40:11 | 000,001,034 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\magicJack.lnk
[2010/10/26 20:39:15 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At45.job
[2010/10/26 19:25:34 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D1A74F21-8B46-4EC6-A0A8-9C369E7281DC}.job
[2010/10/26 17:41:53 | 097,787,600 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2010/10/26 06:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At31.job
[2010/10/26 06:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At7.job
[2010/10/26 05:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At30.job
[2010/10/25 22:16:10 | 000,079,872 | ---- | M] () -- C:\WINDOWS\MBR.exe
[2010/10/25 21:13:04 | 001,187,896 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\Home\My Documents\ccsetup236_slim.exe
[2010/10/25 20:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At21.job
[2010/10/25 17:39:36 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/10/25 09:38:53 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2010/10/24 19:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At20.job
[2010/10/24 18:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At43.job
[2010/10/24 18:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At19.job
[2010/10/24 17:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At42.job
[2010/10/24 17:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At18.job
[2010/10/24 16:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At41.job
[2010/10/24 16:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At17.job
[2010/10/24 15:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At40.job
[2010/10/24 15:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At16.job
[2010/10/24 14:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At39.job
[2010/10/24 14:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At15.job
[2010/10/24 13:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At38.job
[2010/10/24 13:27:16 | 000,069,632 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/24 09:20:21 | 000,000,468 | ---- | M] () -- C:\WINDOWS\lexstat.ini
[2010/10/23 23:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At48.job
[2010/10/23 23:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At24.job
[2010/10/23 19:37:05 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At44.job
[2010/10/23 13:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At14.job
[2010/10/22 19:17:41 | 000,000,814 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Shortcut to Sniper.exe.lnk
[2010/10/22 00:10:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2010/10/21 18:11:55 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/10/21 09:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At10.job
[2010/10/21 08:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At33.job
[2010/10/21 08:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At9.job
[2010/10/21 07:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At32.job
[2010/10/21 07:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At8.job
[2010/10/19 02:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At27.job
[2010/10/19 02:10:01 | 000,013,590 | ---- | M] () -- C:\WINDOWS\System32\235.js
[2010/10/19 02:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2010/10/19 01:37:03 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At26.job
[2010/10/19 01:10:16 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2010/10/19 00:37:16 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At25.job
[2010/10/18 12:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At37.job
[2010/10/18 12:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At13.job
[2010/10/18 11:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At36.job
[2010/10/18 11:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At12.job
[2010/10/18 10:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At35.job
[2010/10/18 10:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At11.job
[2010/10/18 09:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At34.job
[2010/10/18 05:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At6.job
[2010/10/18 04:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At29.job
[2010/10/18 04:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At5.job
[2010/10/18 03:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At28.job
[2010/10/18 03:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2010/10/13 17:10:00 | 000,010,053 | ---- | M] () -- C:\WINDOWS\System32\234.js
[2010/10/13 11:38:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/13 06:20:32 | 000,000,100 | ---- | M] () -- C:\WINDOWS\dellstat.ini
[2010/10/08 17:05:42 | 000,504,496 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/10/08 17:05:42 | 000,091,822 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/10/06 06:56:11 | 000,001,761 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/26 19:30:30 | 003,887,256 | R--- | C] () -- C:\Documents and Settings\Home\Desktop\brown.bat
[2010/10/26 17:41:53 | 097,787,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2010/10/25 17:39:35 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/10/25 17:39:32 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/10/25 17:32:17 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/10/25 17:32:17 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/10/25 17:32:17 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/10/25 17:32:17 | 000,079,872 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/10/25 17:32:17 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/10/22 19:17:41 | 000,000,814 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Shortcut to Sniper.exe.lnk
[2010/10/21 18:11:55 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/10/20 21:40:47 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2010/10/19 01:50:25 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/19 01:37:02 | 000,013,590 | ---- | C] () -- C:\WINDOWS\System32\235.js
[2010/10/13 12:37:00 | 000,010,053 | ---- | C] () -- C:\WINDOWS\System32\234.js
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At48.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At47.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At46.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At45.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At44.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At43.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At42.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At41.job
[2010/10/12 05:29:06 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At40.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At39.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At38.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At37.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At36.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At35.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At34.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At33.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At32.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At31.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At30.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At29.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At28.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At27.job
[2010/10/12 05:29:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At26.job
[2010/10/12 05:29:04 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At25.job
[2010/10/11 05:45:02 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At24.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At9.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At23.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At22.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At21.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At20.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At19.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At18.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At17.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At16.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At15.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At14.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At13.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At12.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At11.job
[2010/10/11 05:45:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At10.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At8.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At7.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At6.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At5.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At4.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At3.job
[2010/10/11 05:45:00 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At2.job
[2010/10/11 05:44:59 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2010/10/06 06:56:11 | 000,001,761 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/07 18:50:15 | 000,000,133 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/09/19 16:57:34 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/08/20 05:16:40 | 000,000,020 | ---- | C] () -- C:\WINDOWS\Markers.ini
[2008/07/17 06:51:39 | 000,000,540 | ---- | C] () -- C:\WINDOWS\UpdateClient.INI
[2008/07/17 06:44:55 | 000,000,042 | ---- | C] () -- C:\WINDOWS\InstallerStatus.ini
[2008/07/17 06:44:42 | 000,010,032 | ---- | C] () -- C:\WINDOWS\FliteStar.ini
[2008/07/13 19:29:14 | 000,000,098 | ---- | C] () -- C:\WINDOWS\JeppECData.ini
[2008/07/13 19:28:34 | 000,003,949 | ---- | C] () -- C:\WINDOWS\JeppView3.ini
[2008/07/13 16:35:39 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2008/05/27 07:50:05 | 000,000,082 | ---- | C] () -- C:\WINDOWS\SimViewJr.ini
[2008/05/25 02:34:21 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/05/25 02:34:21 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/05/07 04:55:44 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\mrvtcl.dll
[2008/05/07 04:55:28 | 000,001,240 | ---- | C] () -- C:\WINDOWS\SimView.ini
[2008/05/07 04:55:28 | 000,000,222 | ---- | C] () -- C:\WINDOWS\Jeppesen.ini
[2008/05/06 05:05:13 | 000,000,060 | ---- | C] () -- C:\WINDOWS\Vmax_742.ini
[2008/05/03 16:57:01 | 000,000,236 | ---- | C] () -- C:\WINDOWS\RFP.ini
[2008/05/03 12:46:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\frontpg.ini
[2008/05/03 12:46:00 | 000,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2008/05/03 12:46:00 | 000,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2008/05/03 12:45:49 | 000,007,909 | ---- | C] () -- C:\WINDOWS\System32\ftpctrs.ini
[2008/05/03 12:45:47 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2008/05/03 12:45:47 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2008/05/03 12:45:46 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2008/04/17 21:00:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\msicpl.ini
[2008/04/17 20:35:35 | 000,217,088 | ---- | C] () -- C:\WINDOWS\NVGfxOgl.dll
[2008/04/17 20:12:34 | 000,131,072 | R--- | C] () -- C:\WINDOWS\System32\smdll.dll
[2008/04/17 20:12:32 | 000,032,768 | R--- | C] () -- C:\WINDOWS\System32\Auxiliary.dll
[2008/04/17 20:12:31 | 000,266,240 | R--- | C] () -- C:\WINDOWS\System32\HookShield.dll
[2008/04/17 20:12:31 | 000,262,144 | R--- | C] () -- C:\WINDOWS\System32\HookMAp.dll
[2008/04/17 20:12:31 | 000,009,728 | R--- | C] () -- C:\WINDOWS\System32\sysinfoX64.sys
[2008/04/17 20:12:31 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\sysinfo.sys
[2008/04/17 11:57:05 | 000,069,632 | ---- | C] () -- C:\Documents and Settings\Home\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/17 05:11:01 | 000,000,165 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2008/04/17 05:08:20 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/04/16 21:33:51 | 000,000,100 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2008/04/16 21:33:50 | 000,000,468 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2008/04/16 21:33:40 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxczvs.dll
[2008/04/16 21:33:32 | 000,000,270 | ---- | C] () -- C:\WINDOWS\System32\lxczcoin.ini
[2007/01/01 15:06:51 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/09/01 12:14:08 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\TSRemote.dll
[2006/08/16 02:35:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 02:35:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/08/16 02:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 02:35:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 02:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/08/16 02:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/29 10:24:43 | 000,318,014 | ---- | C] () -- C:\WINDOWS\System32\flt1chk4.dll
[2005/09/25 12:48:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2005/02/11 11:12:42 | 000,040,960 | ---- | C] () -- C:\WINDOWS\GaugeSound.dll
[2004/12/10 08:33:46 | 000,315,728 | ---- | C] () -- C:\WINDOWS\System32\flt1chk3.dll
[2002/02/23 16:57:00 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\nosgeo10.dll
[1999/04/24 09:57:16 | 000,018,854 | ---- | C] () -- C:\WINDOWS\ntctrm.sys
[1999/01/22 13:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2010/10/20 21:41:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2008/05/21 05:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2008/05/08 17:27:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CaptainSim
[2010/10/20 21:41:02 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2009/03/22 19:10:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FlightPrep
[2008/04/16 21:55:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/08/25 14:27:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\magicJack
[2010/10/20 21:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2008/07/28 21:10:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/03/18 18:33:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/11/26 12:09:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/08 16:46:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/10/20 21:42:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\AVG10
[2010/10/21 12:05:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\Azureus
[2009/03/28 09:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/04/28 20:35:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\DAEMON Tools
[2008/05/22 20:04:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\Flight1
[2010/10/26 20:40:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mjusbsp
[2009/12/31 17:09:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\XTrackCad
[2010/10/22 00:10:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2010/10/21 09:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job
[2010/10/18 10:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job
[2010/10/18 11:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job
[2010/10/18 12:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job
[2010/10/23 13:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job
[2010/10/24 14:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job
[2010/10/24 15:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job
[2010/10/24 16:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job
[2010/10/24 17:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job
[2010/10/24 18:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job
[2010/10/19 01:10:16 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2010/10/24 19:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job
[2010/10/25 20:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job
[2010/10/26 21:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job
[2010/10/26 22:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job
[2010/10/23 23:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job
[2010/10/19 00:37:16 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At25.job
[2010/10/19 01:37:03 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At26.job
[2010/10/19 02:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At27.job
[2010/10/18 03:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At28.job
[2010/10/18 04:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At29.job
[2010/10/19 02:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2010/10/26 05:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At30.job
[2010/10/26 06:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At31.job
[2010/10/21 07:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At32.job
[2010/10/21 08:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At33.job
[2010/10/18 09:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At34.job
[2010/10/18 10:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At35.job
[2010/10/18 11:37:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At36.job
[2010/10/18 12:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At37.job
[2010/10/24 13:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At38.job
[2010/10/24 14:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At39.job
[2010/10/18 03:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
[2010/10/24 15:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At40.job
[2010/10/24 16:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At41.job
[2010/10/24 17:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At42.job
[2010/10/24 18:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At43.job
[2010/10/23 19:37:05 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At44.job
[2010/10/26 20:39:15 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At45.job
[2010/10/26 21:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At46.job
[2010/10/26 22:37:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At47.job
[2010/10/23 23:37:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At48.job
[2010/10/18 04:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job
[2010/10/18 05:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job
[2010/10/26 06:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job
[2010/10/21 07:10:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job
[2010/10/21 08:10:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job
[2010/10/26 19:25:34 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{D1A74F21-8B46-4EC6-A0A8-9C369E7281DC}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF

< End of report >

thammondwis · « **Reply #19 on:** October 27, 2010, 04:35:57 PM »

Extra.txt log:

OTL Extras logfile created on: 10/27/2010 5:27:44 PM - Run 1
OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Home\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 420.00 Mb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.10 Gb Total Space | 7.21 Gb Free Space | 9.73% Space Free | Partition Type: NTFS
Drive E: | 112.21 Gb Total Space | 46.35 Gb Free Space | 41.31% Space Free | Partition Type: NTFS

Computer Name: HOME | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-to-Peer Grouping
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution Protocol (PNRP)
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-to-Peer Grouping
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution Protocol (PNRP)
"42019:TCP" = 42019:TCP:*:Enabled:Azures
"42019:UDP" = 42019:UDP:*:Enabled:Azures
"49152:TCP" = 49152:TCP:*:Enabled:azures
"49152:UDP" = 49152:UDP:*:Enabled:azures

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Grisoft\AVG7\avginet.exe" = C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe -- File not found
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe" = C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe -- File not found
"C:\Program Files\Grisoft\AVG7\avgcc.exe" = C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe -- File not found
"D:\Installation\Setupx.exe" = D:\Installation\Setupx.exe:*:Enabled:Nero ProductSetup -- File not found
"C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe" = C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)
"C:\Program Files\Azureus\Azureus.exe" = C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus -- (Azureus Inc)
"C:\Program Files\FSFDT\FWInn\FWINN.exe" = C:\Program Files\FSFDT\FWInn\FWINN.exe:*:Enabled:FSInn Application -- ()
"C:\Program Files\FSFDT\Control Panel\FSFDTCP.exe" = C:\Program Files\FSFDT\Control Panel\FSFDTCP.exe:*:Enabled:FSFDT Control Panel -- (FS - French Dev Team)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player -- (Veoh Networks)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- File not found
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- File not found
"C:\mjusbsp\magicJack.exe" = C:\mjusbsp\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)
"C:\Documents and Settings\Home\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\Home\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)
"C:\Documents and Settings\NetworkService\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\NetworkService\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{164360E5-0AAD-48AD-8A36-3F8A859FAB6F}" = PMDG747_400F
"{1819F22A-8B42-4CF5-88C1-97B6F4A7849A}" = ActiveSky Version 6 and ActiveSky Graphics
"{1A258E63-8DF5-4ADB-9832-38A0121D65EB}" = AVG 2011
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21DBBDD6-93A5-4326-9A04-C9A5C9148502}" = Norton PartitionMagic
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
"{2F76FF6D-B992-4FD9-8686-F09F868B2C58}" = FSNavigator
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EB34322-B940-46EB-810E-68E71A819269}" = AVG 2011
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{61812F6F-0705-4B20-B914-32C1E3C155C7}" = SimCharts 3.0
"{6283826F-59A2-11D9-BB04-000AE6BE6EE7}" = On-line Help Console
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6E0D150E-E486-4D20-BB7F-E091032C34D9}" = JeppView / JeppView FliteDeck
"{768F22DC-2D20-4F52-A9A1-5E231FB7F752}" = Logitech Gaming Software 5.04
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7C480BB2-42A9-40C6-AA5F-7AA20FC7C7F3}" = CVSNT 2.5.03.2382
"{7D28A0F2-349E-11D3-A90C-0090270E86DC}" = JeppTerrain
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8558C0DA-37FA-4F66-8BEA-D1DA33A33828}" = Just Flight - Airliner Pilot v1.00
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{8F8C91F0-F15C-11D4-A4D6-0004ACD720DA}" = FliteStar
"{97679567-0095-464E-B5F2-E218A1CF3421}" = PMDG747_400 Queen of the Skies
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81
"{9CDD8DA2-7BFE-40FD-AEC8-5A48B7C88BFB}" = PMDG 747-400F PW FedEx
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4AC94AE-A5CE-4BB5-897C-E45E558F3277}" = Golden Eagle FlightPrep 2007 SP1
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software 1.10.13.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D42D6936-F7F3-4077-9851-538B0DA685A8}" = Just Flight Dash 8-300 Professional v1.00
"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{ED2A3C11-3EA8-4380-B59C-F2C1832731B0}" = Quicken 2009
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"737 Pilot in Command - 400/500 Upgrade" = 737 Pilot in Command - 400/500 Upgrade
"737-300 Pilot in Command" = 737-300 Pilot in Command
"A310 Database Update" = A310 Database Update
"A310 The Master's Edition" = A310 The Master's Edition
"A753CAPTAIN" = 757-300 Captain
"Active Camera 2004 patch for FS 9.1" = Active Camera 2004 patch for FS 9.1
"Active Camera 2004 update to version 2.1 (FS 9.1)" = Active Camera 2004 update to version 2.1 (FS 9.1)
"Active Camera 2004 version 2.0" = Active Camera 2004 version 2.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Airbus Series Vol.1 Deluxe (FS2004)" = Airbus Series Vol.1 Deluxe (FS2004)
"ATT-PRT22" = ATT-PRT22
"AVG" = AVG 2011
"Azureus Vuze" = Azureus Vuze
"B752CAPTAIN" = '757-200 Captain' (Base Package) 1.4
"BAV OSP_is1" = BAV OSP 3.0 Public Beta 3
"Boeing B314 - The Clipper V2.0" = Boeing B314 - The Clipper V2.0
"C757CAPTAIN" = '757 Captain' ACE 1.4
"CCleaner" = CCleaner
"CDisplay_is1" = CDisplay 1.8
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"Curse of the Azure Bonds" = Curse of the Azure Bonds
"DivX Setup.divx.com" = DivX Setup
"DraftDominator_is1" = DraftDominator Version 10.0b Full
"DualCoreCenter_is1" = DualCoreCenter
"DVD Flick_is1" = DVD Flick 1.3.0.7
"E757CAPTAIN" = Block E - 757 Soundsets
"ExtractNow_is1" = ExtractNow
"F1DF727" = Greatest Airliners: 727
"Flight Simulator 9.0" = Microsoft Flight Simulator 2004 A Century of Flight
"Fraps" = Fraps (remove only)
"FS Global 2008 for FS2004" = FS Global 2008 for FS2004
"FS Panel Studio for FSX" = FS Panel Studio for FSX Build 20340
"FSDiscover!" = FSDiscover!
"FSFDT FSCopilot" = FSFDT FSCopilot
"FSFDT FSInn" = FSFDT FSInn
"FSFlightMax Base Package_is1" = FSFlightMax Base Package 1.0
"FSFlightMax_is1" = FSFlightMax 1.4
"getPlus(R)_ocx" = getPlus(R)_ocx
"Ground Environment Professional" = Ground Environment Professional
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{21DBBDD6-93A5-4326-9A04-C9A5C9148502}" = Norton PartitionMagic 8.0
"IrfanView" = IrfanView (remove only)
"JFlightlog_is1" = JFlightLog 0.5
"Legendary 707" = Legendary 707
"Legendary 727 Professional " = Legendary 727 Professional
"Level-D 767-300 Tutorials" = Level-D 767-300 Tutorials
"Level-D Simulations 767-300" = Level-D Simulations 767-300
"Lexmark 1200 Series" = Lexmark 1200 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MDMAX Pro Premiere Edition" = MDMAX Pro Premiere Edition
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Pool of Radiance" = Pool of Radiance
"Punch! Professional Home Design - Platinum" = Punch! Professional Home Design - Platinum
"Railroad Tycoon II" = Railroad Tycoon II
"Ready for Pushback Add-Ons" = Ready for Pushback Add-Ons
"Ready for Pushback V2 Combi Loader" = Ready for Pushback V2 Combi Loader
"Ready for Pushback V2_10 Full Version" = Ready for Pushback V2_10 Full Version
"RealPlayer 12.0" = RealPlayer
"Savings Bond Wizard" = Savings Bond Wizard
"Sid Meier's Railroad Tycoon" = Sid Meier's Railroad Tycoon
"SpaceShuttleMission2007_is1" = SpaceShuttleMission2007 PATCH v5.30
"SR71 Stealth" = SR71 Stealth
"tdp" = 3Deep
"The FFS Saab 340 Base InstallerVersion 1.0.0" = The FFS Saab 340 Base Installer
"The FFS Saab 340 UpdateVersion 1.1" = The FFS Saab 340 Update
"The Vans Aircraft Company - Boeing 717-200 "The Last Legacy" V2" = The Vans Aircraft Company - Boeing 717-200 "The Last Legacy" V2
"TortoiseCVS_is1" = TortoiseCVS 1.10.10
"True Internet Color" = E-Color Indicator
"TTB000001.TTB000001Toolbar" = CouponBar
"Tweak UI 2.10" = Tweak UI
"Unlocker" = Unlocker 1.9.0
"WIC" = Windows Imaging Component
"Wilco Fleet : A380" = Wilco Fleet : A380
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"Wings of Power: Heavy Bombers and Jets" = Wings of Power: Heavy Bombers and Jets
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"X-treme King Air B200v.2.0.1" = X-treme King Air B200 v.2.0.1
"XTrkCAD 4.0.3a" = XTrkCAD 4.0.3a
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Airbus Series Vol.2 (FS2004)" = Airbus Series Vol.2 (FS2004)
"magicJack" = magicJack
"Move Media Player" = Move Media Player
"Radio Range v4.0" = Radio Range v4.0
"WoS INSTALLERS AEROSIM DHC-6 TWIN OTTER" = WoS INSTALLERS AEROSIM DHC-6 TWIN OTTER

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/26/2010 8:32:49 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/26/2010 8:32:59 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/26/2010 8:33:55 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application AVGIDSAgent.exe, version 10.0.0.344, faulting
module msvcr90.dll, version 9.0.30729.4148, fault address 0x0006ccb5.

Error - 10/26/2010 9:46:56 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/26/2010 9:48:25 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/26/2010 10:11:33 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x00023845.

Error - 10/27/2010 6:30:04 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/27/2010 6:30:40 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/27/2010 6:31:12 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 10/27/2010 6:31:43 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium -- Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

[ System Events ]
Error - 10/27/2010 12:25:48 PM | Computer Name = HOME | Source = DCOM | ID = 10010
Description = The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register
with DCOM within the required timeout.

Error - 10/27/2010 2:17:48 PM | Computer Name = HOME | Source = DCOM | ID = 10010
Description = The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register
with DCOM within the required timeout.

Error - 10/27/2010 4:09:48 PM | Computer Name = HOME | Source = DCOM | ID = 10010
Description = The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register
with DCOM within the required timeout.

Error - 10/27/2010 6:01:48 PM | Computer Name = HOME | Source = DCOM | ID = 10010
Description = The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register
with DCOM within the required timeout.

Error - 10/27/2010 6:18:38 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7023
Description = The IIS Admin service terminated with the following error: %%13

Error - 10/27/2010 6:18:38 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7001
Description = The FTP Publishing service depends on the IIS Admin service which
failed to start because of the following error: %%13

Error - 10/27/2010 6:18:38 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7001
Description = The Simple Mail Transfer Protocol (SMTP) service depends on the IIS
Admin service which failed to start because of the following error: %%13

Error - 10/27/2010 6:18:38 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7001
Description = The World Wide Web Publishing service depends on the IIS Admin service
which failed to start because of the following error: %%13

Error - 10/27/2010 6:19:42 PM | Computer Name = HOME | Source = DCOM | ID = 10010
Description = The server {A9E69610-B80D-11D0-B9B9-00A0C922E750} did not register
with DCOM within the required timeout.

Error - 10/27/2010 6:20:57 PM | Computer Name = HOME | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

< End of report >

thammondwis · « **Reply #20 on:** October 27, 2010, 06:35:01 PM »

FWIW I had a new error message that popped up. It happened well after I finished running the OTL scan.

Microsoft Visual C++ Runtime Library
Program: C:\WINDOWS\System32\svchost.exe
R6025
-pure virtual function call

SuperDave · « **Reply #21 on:** October 28, 2010, 04:42:30 PM »

You only have 7.21 Gb Free Space on your C: drive which is why you can't run some programs. You will have to find some way to transfer some of your files to your slave drive. Also uninstall/remove and unneeded programs. You should have at least 15% free space in order for your computer to function properly.

P2P - I see you have P2P software installed on your machine (Azureus Vuze). We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
**********************************************
* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

Code: [Select]

:OTL

:Files
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At9.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\System32\235.js
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\System32\235.js
C:\WINDOWS\System32\234.js
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At9.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job

:otl 
O15 - HKCU\..Trusted Domains: simnasa.org ([www] https in Trusted sites)

:COMMANDS
[resethosts]
[purity]
[clearrestorepoints]
[emptytemp]
[start explorer]

* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.

thammondwis · « **Reply #22 on:** October 28, 2010, 05:08:35 PM »

Cleaned up some files on C: and now have 16 GB free. I uninstalled Azureus. When it finished uninstalling, a Internet Explorer window opened up by itself. Then I ran the OTL fix and here is the log.

All processes killed
========== OTL ==========
========== FILES ==========
C:\WINDOWS\tasks\At47.job moved successfully.
C:\WINDOWS\tasks\At23.job moved successfully.
C:\WINDOWS\tasks\At46.job moved successfully.
C:\WINDOWS\tasks\At22.job moved successfully.
C:\WINDOWS\tasks\At45.job moved successfully.
C:\WINDOWS\tasks\At31.job moved successfully.
C:\WINDOWS\tasks\At7.job moved successfully.
C:\WINDOWS\tasks\At30.job moved successfully.
C:\WINDOWS\tasks\At21.job moved successfully.
C:\WINDOWS\tasks\At20.job moved successfully.
C:\WINDOWS\tasks\At43.job moved successfully.
C:\WINDOWS\tasks\At19.job moved successfully.
C:\WINDOWS\tasks\At42.job moved successfully.
C:\WINDOWS\tasks\At18.job moved successfully.
C:\WINDOWS\tasks\At41.job moved successfully.
C:\WINDOWS\tasks\At17.job moved successfully.
C:\WINDOWS\tasks\At40.job moved successfully.
C:\WINDOWS\tasks\At16.job moved successfully.
C:\WINDOWS\tasks\At39.job moved successfully.
C:\WINDOWS\tasks\At15.job moved successfully.
C:\WINDOWS\tasks\At38.job moved successfully.
C:\WINDOWS\tasks\At48.job moved successfully.
C:\WINDOWS\tasks\At24.job moved successfully.
C:\WINDOWS\tasks\At44.job moved successfully.
C:\WINDOWS\tasks\At14.job moved successfully.
C:\WINDOWS\tasks\At1.job moved successfully.
C:\WINDOWS\tasks\At10.job moved successfully.
C:\WINDOWS\tasks\At33.job moved successfully.
C:\WINDOWS\tasks\At9.job moved successfully.
C:\WINDOWS\tasks\At32.job moved successfully.
C:\WINDOWS\tasks\At8.job moved successfully.
C:\WINDOWS\tasks\At27.job moved successfully.
C:\WINDOWS\System32\235.js moved successfully.
C:\WINDOWS\tasks\At3.job moved successfully.
C:\WINDOWS\tasks\At26.job moved successfully.
C:\WINDOWS\tasks\At2.job moved successfully.
C:\WINDOWS\tasks\At25.job moved successfully.
C:\WINDOWS\tasks\At37.job moved successfully.
C:\WINDOWS\tasks\At13.job moved successfully.
C:\WINDOWS\tasks\At36.job moved successfully.
C:\WINDOWS\tasks\At12.job moved successfully.
C:\WINDOWS\tasks\At35.job moved successfully.
C:\WINDOWS\tasks\At11.job moved successfully.
C:\WINDOWS\tasks\At34.job moved successfully.
C:\WINDOWS\tasks\At6.job moved successfully.
C:\WINDOWS\tasks\At29.job moved successfully.
C:\WINDOWS\tasks\At5.job moved successfully.
C:\WINDOWS\tasks\At28.job moved successfully.
C:\WINDOWS\tasks\At4.job moved successfully.
File\Folder C:\WINDOWS\System32\235.js not found.
C:\WINDOWS\System32\234.js moved successfully.
File\Folder C:\WINDOWS\tasks\At48.job not found.
File\Folder C:\WINDOWS\tasks\At47.job not found.
File\Folder C:\WINDOWS\tasks\At46.job not found.
File\Folder C:\WINDOWS\tasks\At45.job not found.
File\Folder C:\WINDOWS\tasks\At44.job not found.
File\Folder C:\WINDOWS\tasks\At43.job not found.
File\Folder C:\WINDOWS\tasks\At42.job not found.
File\Folder C:\WINDOWS\tasks\At41.job not found.
File\Folder C:\WINDOWS\tasks\At40.job not found.
File\Folder C:\WINDOWS\tasks\At39.job not found.
File\Folder C:\WINDOWS\tasks\At38.job not found.
File\Folder C:\WINDOWS\tasks\At37.job not found.
File\Folder C:\WINDOWS\tasks\At36.job not found.
File\Folder C:\WINDOWS\tasks\At35.job not found.
File\Folder C:\WINDOWS\tasks\At34.job not found.
File\Folder C:\WINDOWS\tasks\At33.job not found.
File\Folder C:\WINDOWS\tasks\At32.job not found.
File\Folder C:\WINDOWS\tasks\At31.job not found.
File\Folder C:\WINDOWS\tasks\At30.job not found.
File\Folder C:\WINDOWS\tasks\At29.job not found.
File\Folder C:\WINDOWS\tasks\At28.job not found.
File\Folder C:\WINDOWS\tasks\At27.job not found.
File\Folder C:\WINDOWS\tasks\At26.job not found.
File\Folder C:\WINDOWS\tasks\At25.job not found.
File\Folder C:\WINDOWS\tasks\At24.job not found.
File\Folder C:\WINDOWS\tasks\At9.job not found.
File\Folder C:\WINDOWS\tasks\At23.job not found.
File\Folder C:\WINDOWS\tasks\At22.job not found.
File\Folder C:\WINDOWS\tasks\At21.job not found.
File\Folder C:\WINDOWS\tasks\At20.job not found.
File\Folder C:\WINDOWS\tasks\At19.job not found.
File\Folder C:\WINDOWS\tasks\At18.job not found.
File\Folder C:\WINDOWS\tasks\At17.job not found.
File\Folder C:\WINDOWS\tasks\At16.job not found.
File\Folder C:\WINDOWS\tasks\At15.job not found.
File\Folder C:\WINDOWS\tasks\At14.job not found.
File\Folder C:\WINDOWS\tasks\At13.job not found.
File\Folder C:\WINDOWS\tasks\At12.job not found.
File\Folder C:\WINDOWS\tasks\At11.job not found.
File\Folder C:\WINDOWS\tasks\At10.job not found.
File\Folder C:\WINDOWS\tasks\At8.job not found.
File\Folder C:\WINDOWS\tasks\At7.job not found.
File\Folder C:\WINDOWS\tasks\At6.job not found.
File\Folder C:\WINDOWS\tasks\At5.job not found.
File\Folder C:\WINDOWS\tasks\At4.job not found.
File\Folder C:\WINDOWS\tasks\At3.job not found.
File\Folder C:\WINDOWS\tasks\At2.job not found.
File\Folder C:\WINDOWS\tasks\At1.job not found.
File\Folder C:\WINDOWS\Tasks\At1.job not found.
File\Folder C:\WINDOWS\Tasks\At10.job not found.
File\Folder C:\WINDOWS\Tasks\At11.job not found.
File\Folder C:\WINDOWS\Tasks\At12.job not found.
File\Folder C:\WINDOWS\Tasks\At13.job not found.
File\Folder C:\WINDOWS\Tasks\At14.job not found.
File\Folder C:\WINDOWS\Tasks\At15.job not found.
File\Folder C:\WINDOWS\Tasks\At16.job not found.
File\Folder C:\WINDOWS\Tasks\At17.job not found.
File\Folder C:\WINDOWS\Tasks\At18.job not found.
File\Folder C:\WINDOWS\Tasks\At19.job not found.
File\Folder C:\WINDOWS\Tasks\At2.job not found.
File\Folder C:\WINDOWS\Tasks\At20.job not found.
File\Folder C:\WINDOWS\Tasks\At21.job not found.
File\Folder C:\WINDOWS\Tasks\At22.job not found.
File\Folder C:\WINDOWS\Tasks\At23.job not found.
File\Folder C:\WINDOWS\Tasks\At24.job not found.
File\Folder C:\WINDOWS\Tasks\At25.job not found.
File\Folder C:\WINDOWS\Tasks\At26.job not found.
File\Folder C:\WINDOWS\Tasks\At27.job not found.
File\Folder C:\WINDOWS\Tasks\At28.job not found.
File\Folder C:\WINDOWS\Tasks\At29.job not found.
File\Folder C:\WINDOWS\Tasks\At3.job not found.
File\Folder C:\WINDOWS\Tasks\At30.job not found.
File\Folder C:\WINDOWS\Tasks\At31.job not found.
File\Folder C:\WINDOWS\Tasks\At32.job not found.
File\Folder C:\WINDOWS\Tasks\At33.job not found.
File\Folder C:\WINDOWS\Tasks\At34.job not found.
File\Folder C:\WINDOWS\Tasks\At35.job not found.
File\Folder C:\WINDOWS\Tasks\At36.job not found.
File\Folder C:\WINDOWS\Tasks\At37.job not found.
File\Folder C:\WINDOWS\Tasks\At38.job not found.
File\Folder C:\WINDOWS\Tasks\At39.job not found.
File\Folder C:\WINDOWS\Tasks\At4.job not found.
File\Folder C:\WINDOWS\Tasks\At40.job not found.
File\Folder C:\WINDOWS\Tasks\At41.job not found.
File\Folder C:\WINDOWS\Tasks\At42.job not found.
File\Folder C:\WINDOWS\Tasks\At43.job not found.
File\Folder C:\WINDOWS\Tasks\At44.job not found.
File\Folder C:\WINDOWS\Tasks\At45.job not found.
File\Folder C:\WINDOWS\Tasks\At46.job not found.
File\Folder C:\WINDOWS\Tasks\At47.job not found.
File\Folder C:\WINDOWS\Tasks\At48.job not found.
File\Folder C:\WINDOWS\Tasks\At5.job not found.
File\Folder C:\WINDOWS\Tasks\At6.job not found.
File\Folder C:\WINDOWS\Tasks\At7.job not found.
File\Folder C:\WINDOWS\Tasks\At8.job not found.
File\Folder C:\WINDOWS\Tasks\At9.job not found.
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\simnasa.org\www\ deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Error: Unable to interpret <[clearrestorepoints]> in the current context!

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 951772 bytes
->Temporary Internet Files folder emptied: 2058886 bytes
->Java cache emptied: 602656 bytes
->Flash cache emptied: 16422 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Home
->Temp folder emptied: 5547550 bytes
->Temporary Internet Files folder emptied: 5435079 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 133554162 bytes
->Flash cache emptied: 49484 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 1982866 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 60380 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 70277147 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 69196 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 17246579 bytes
%systemroot%\System32 .tmp files removed: 2887185 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 876159 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 52512784 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 139128 bytes

Total Files Cleaned = 281.00 mb

OTL by OldTimer - Version 3.2.17.1 log created on 10282010_175725

Files\Folders moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_d94.dat moved successfully.

Registry entries deleted on Reboot...

SuperDave · « **Reply #23 on:** October 29, 2010, 11:27:32 AM »

Could you please try running ComboFix again.

thammondwis · « **Reply #24 on:** October 30, 2010, 05:57:35 AM »

Can you clarify the instructions for ComboFix? I tried using the original instructions that you gave me in which I renamed it commy.exe but I recieved a error meassage that it could not run because of copprut files.

SuperDave · « **Reply #25 on:** October 30, 2010, 11:59:34 AM »

Ok Please delete ComboFix from your desktop and do this.

Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.

link # 1
link #2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts. (you will receive a UAC prompt, please allow it)

Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

thammondwis · « **Reply #26 on:** October 30, 2010, 10:00:42 PM »

ComboFix still does not run. Same result as before. Note I saw a reference that CD emulators can interfere with ComboFix. I did have Daemon Tools installed and uninstalled it not to long ago (don't remember if it was before or after the first time I was instructed to run ComboFix). I don't know if that info will help or not.

SuperDave · « **Reply #27 on:** October 31, 2010, 10:44:12 AM »

Ok. How's your computer running?

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the

button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

•Check

•Click the

button.
•Accept any security warnings from your browser.
•Check

•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push

•Push

, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the

button.
•Push

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

thammondwis · « **Reply #28 on:** October 31, 2010, 07:55:10 PM »

Maybe a bit better at this point but still getting some rediredts in FireFox. Internet Explorer still is unresponsive at times. I think it has been a day or two since I last got the WIN32 error.

The ESET scan picker up 5 infected files. Here is the log:

C:\Documents and Settings\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay.lnk   Win32/Adware.ADON application   cleaned by deleting - quarantined
C:\Documents and Settings\Home\Application Data\Sun\Java\Deployment\cache\6.0\26\5e0959da-1d40f071   a variant of Java/TrojanDownloader.OpenStream.NAU trojan   deleted - quarantined
C:\Documents and Settings\Home\Desktop\eBay.lnk   Win32/Adware.ADON application   cleaned by deleting - quarantined
C:\Documents and Settings\Home\Start Menu\eBay.lnk   Win32/Adware.ADON application   cleaned by deleting - quarantined
E:\Laptop data files\copy\[PC GAME ADULT] video strip poker 2006.ISO   probably a variant of Win32/Agent.FOSBCKS trojan   deleted - quarantined

SuperDave · « **Reply #29 on:** November 01, 2010, 12:56:37 PM »

Ok. Let's try another scan.

Please download [color="#FF0000"]GooredFix[/color] from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Ensure all Firefox windows are closed.
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
When prompted to run the scan, click Yes.
GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

thammondwis · « **Reply #30 on:** November 01, 2010, 04:17:04 PM »

Here is the log:

GooredFix by jpshortstuff (03.07.10.1)
Log created at 17:15 on 01/11/2010 (Home)
Firefox version 3.0.19 (en-US)

========== GooredScan ==========

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [10:36 13/04/2009]
{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [11:45 19/06/2009]
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [01:07 29/08/2009]
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [00:22 18/11/2009]
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [23:16 13/06/2010]
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [10:07 20/10/2010]

C:\Documents and Settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b} [11:05 25/06/2010]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [02:46 01/04/2009]
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext" [13:12 17/04/2010]
"[email protected]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [03:05 20/12/2008]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG10\Firefox\" [02:39 21/10/2010]

-=E.O.F=-

SuperDave · « **Reply #31 on:** November 02, 2010, 12:53:02 PM »

Are you still getting redirects? Is it always to the same site?

thammondwis · « **Reply #32 on:** November 04, 2010, 07:57:51 PM »

Yes I am still getting the rediredts. I have not seen the pop ups in new tabs lately. The redirects seem to be happening only when clicking on a link in a yahoo search while using Firefox.

I am still having issues with internet explorer non responding, which tends to occur after it has been open for a while.

I am still getting the WIN32 error message. And I have been getting periodic issues with MagicJack software (internet phone) not running.

One other question. I did not install a 3rd party firewall software. I do have the firewall active on my router. Should I install one of the firewall's that were suggested in the intro thread? If so should I disable the firewall on the router?

thammondwis · « **Reply #33 on:** November 05, 2010, 03:40:00 AM »

Just after I posted my last message, I did have a new tab open up in FireFox. It opened up to google.

I also have not been able to print since I started this thread from my other computer. I have the two computers networked together. The printer is hooked up to this computer. I was troubleshooting the printer issue when I realized that all the network info/settings on this computer were gone/reset. There was no computer name or workgroup name assigned on this computer. I ended up running the network setup wizzard and it acted as though no network was ever set up on this computer.

After I had the network reset up correctly and could print from the other computer again, I cam back later to the following error message:

Hammond (workgroup name) is not accessable. You might not have permission to use this network resource.

SuperDave · « **Reply #34 on:** November 05, 2010, 12:45:05 PM »

Quote

One other question. I did not install a 3rd party firewall software. I do have the firewall active on my router. Should I install one of the firewall's that were suggested in the intro thread? If so should I disable the firewall on the router?

If you have a secure firewall there, that should be good.
Could you please try ComboFix again as detailed in Reply #25.
Do you have your OS disk?

thammondwis · « **Reply #35 on:** November 05, 2010, 04:52:53 PM »

OK ComboFix did not work again, but it was a bit different error than before. This time I received a message that ComboFix could not run with AVG installed and would need to uninstall AVG. I figured I would try that and then reinstall it afterwords. However, I am unable to uninstall AVG. I get a message that service AVG Watchdog (avgwd) can not be stopped. Verify that you have sufficient privileges to stop system services.

The user account I am using is not the administrator, but does have full admin privileges.

Yes I do have the Windows XP Pro OS CD.

thammondwis · « **Reply #36 on:** November 05, 2010, 06:31:34 PM »

I did get AVG uninstalled by downloading and running the installation file and selecting uninstall.

I was then able to run ComboFix...almost. It got all the way through the program and at the very end just after it said it was creating a log report the computer crashed (BSOD flashed) and then rebooted. I looked around and found a file called file called ComboFix.txt, but all that was in it is posted below.

ComboFix 10-11-03.04 - Home 11/05/2010 19:03:33.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.492 [GMT -5:00]
Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe
.

thammondwis · « **Reply #37 on:** November 06, 2010, 09:03:25 AM »

One other issue that I have found. I have noticed on occasion during bootup, I see the Windows update icon appear in the system tray. However it disappears soon after before the computer finishes booting up. I tried to go to the windows update site, but can't connect to it. I have tried to get to it via various methods and get different results, but can't get there.

SuperDave · « **Reply #38 on:** November 06, 2010, 01:34:44 PM »

* Go to Start > Run and type mrt.exe then press Enter on the keyboard).
* (Vista and Windows 7 users go to Start and type mrt.exe in the search box then press Enter on the keyboard.
* Click Next.
* Choose Full Scan and click Next.
* Once the scan is finished click View detailed results of the scan.

Look through the list and let me know if anything was found infected.
***************************************
Place the OS disk in your CD ROM drive and follow the instructions below:
•Click on Start > Run and type sfc /scannow then press Enter (note the space between scf and /scannow)
*Let this run undisturbed until the window with the blue progress bar goes away
SFC - Which stands for System File Checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.
***************************************

Delete your copy of ComboFix; download a fresh copy, except before you download it, rename it to blackpudding.bat

Navigate to Start --> Run, and enter the following command exactly as shown:

"%userprofile%\desktop\blackpudding.bat" /killall

See if ComboFix will run now

thammondwis · « **Reply #39 on:** November 06, 2010, 08:45:59 PM »

mrt.exe did not find any infected files.

I ran the system file checker as instructed. It seemed to work OK.

I uninstalled AVG and ran ComboFix as instructed and it worked!!! Log is below.

ComboFix 10-11-07.01 - Home 11/06/2010 21:13:54.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.699 [GMT -5:00]
Running from: c:\documents and settings\Home\desktop\blackpudding.bat
Command switches used :: /killall
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Home\Desktop\blackpudding.bat
.
---- Previous Run -------
.
c:\windows\system32\Cache

.
((((((((((((((((((((((((( Files Created from 2010-10-07 to 2010-11-07 )))))))))))))))))))))))))))))))
.

2010-11-07 01:51 . 2008-04-14 00:12   116224   -c--a-w-   c:\windows\system32\dllcache\xrxwiadr.dll
2010-11-07 01:51 . 2001-08-18 03:36   23040   -c--a-w-   c:\windows\system32\dllcache\xrxwbtmp.dll
2010-11-07 01:51 . 2008-04-14 00:12   18944   -c--a-w-   c:\windows\system32\dllcache\xrxscnui.dll
2010-11-07 01:51 . 2001-08-18 03:37   27648   -c--a-w-   c:\windows\system32\dllcache\xrxftplt.exe
2010-11-07 01:51 . 2001-08-18 03:37   4608   -c--a-w-   c:\windows\system32\dllcache\xrxflnch.exe
2010-11-07 01:51 . 2001-08-18 03:37   99865   -c--a-w-   c:\windows\system32\dllcache\xlog.exe
2010-11-07 01:51 . 2001-08-17 17:11   16970   -c--a-w-   c:\windows\system32\dllcache\xem336n5.sys
2010-11-07 01:51 . 2004-08-04 03:29   19455   -c--a-w-   c:\windows\system32\dllcache\wvchntxx.sys
2010-11-07 01:51 . 2008-04-13 18:46   19200   -c--a-w-   c:\windows\system32\dllcache\wstcodec.sys
2010-11-07 01:51 . 2004-08-04 03:29   12063   -c--a-w-   c:\windows\system32\dllcache\wsiintxx.sys
2010-11-07 01:51 . 2008-04-14 00:12   8192   -c--a-w-   c:\windows\system32\dllcache\wshirda.dll
2010-11-07 01:49 . 2001-08-17 18:48   11520   -c--a-w-   c:\windows\system32\dllcache\twotrack.sys
2010-11-07 01:48 . 2001-08-17 17:50   50432   -c--a-w-   c:\windows\system32\dllcache\sisv.sys
2010-11-07 01:47 . 2008-04-13 18:41   17664   -c--a-w-   c:\windows\system32\dllcache\ppa3.sys
2010-11-07 01:46 . 2001-08-17 17:50   103296   -c--a-w-   c:\windows\system32\dllcache\mtxvideo.sys
2010-11-07 01:45 . 2008-04-14 00:11   48640   -c--a-w-   c:\windows\system32\dllcache\kdsui.dll
2010-11-07 01:44 . 2008-04-14 00:11   702845   -c--a-w-   c:\windows\system32\dllcache\i81xdnt5.dll
2010-11-07 01:43 . 2001-08-18 03:36   45568   -c--a-w-   c:\windows\system32\dllcache\esunib.dll
2010-11-07 01:42 . 2004-08-04 03:32   48640   -c--a-w-   c:\windows\system32\dllcache\cwrwdm.sys
2010-11-07 01:41 . 2001-08-17 18:51   13824   -c--a-w-   c:\windows\system32\dllcache\bulltlp3.sys
2010-11-07 01:40 . 2001-08-17 17:49   46464   -c--a-w-   c:\windows\system32\dllcache\atibt829.sys
2010-11-06 16:05 . 2009-06-25 18:20   1446264   ----a-w-   c:\program files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
2010-11-06 16:02 . 2009-08-03 20:07   373104   ----a-w-   c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
2010-11-06 14:53 . 2010-11-06 14:53   --------   d-----w-   c:\documents and settings\Admin\Local Settings\Application Data\Mozilla
2010-11-02 11:11 . 2010-11-02 11:11   --------   d-----w-   c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-11-02 11:11 . 2010-11-02 11:11   --------   d-----w-   c:\documents and settings\NetworkService\Application Data\Apple Computer
2010-11-02 10:28 . 2010-11-02 10:51   --------   d-----w-   c:\documents and settings\Home\Application Data\OnlineArmor
2010-10-31 19:38 . 2010-10-31 19:38   --------   d-----w-   c:\program files\ESET
2010-10-31 15:04 . 2010-07-09 18:18   20328   ----a-w-   c:\windows\system32\drivers\cpuz134_x32.sys
2010-10-31 15:04 . 2010-10-31 15:04   --------   d-----w-   c:\program files\CPUID
2010-10-28 22:57 . 2010-10-28 22:57   --------   d-----w-   C:\_OTL
2010-10-23 17:04 . 2010-10-23 17:04   --------   d-----w-   c:\documents and settings\Admin\Application Data\AVG10
2010-10-23 17:02 . 2010-10-23 17:02   --------   d-sh--w-   c:\documents and settings\Admin\IETldCache
2010-10-23 00:16 . 2010-10-23 00:16   388096   ----a-r-   c:\documents and settings\Home\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-10-23 00:16 . 2010-10-23 00:16   --------   d-----w-   c:\program files\Trend Micro
2010-10-22 02:39 . 2010-10-22 02:39   --------   d-----w-   c:\documents and settings\Home\Application Data\Malwarebytes
2010-10-22 02:38 . 2010-04-29 20:39   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-22 02:38 . 2010-10-22 02:38   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-10-22 02:38 . 2010-10-22 02:38   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2010-10-22 02:38 . 2010-04-29 20:39   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-10-21 23:12 . 2010-10-21 23:12   --------   d-----w-   c:\documents and settings\Home\Application Data\SUPERAntiSpyware.com
2010-10-21 23:12 . 2010-10-21 23:12   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-10-21 23:11 . 2010-10-21 23:12   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-10-21 11:49 . 2010-10-26 02:14   --------   d-----w-   c:\program files\CCleaner
2010-10-21 02:42 . 2010-10-21 02:42   --------   d-----w-   c:\documents and settings\Home\Application Data\AVG10
2010-10-21 02:41 . 2010-10-21 02:41   --------   d--h--w-   c:\documents and settings\All Users\Application Data\Common Files
2010-10-21 02:39 . 2010-11-07 02:03   --------   d-----w-   c:\documents and settings\All Users\Application Data\AVG10
2010-10-21 02:38 . 2010-11-05 23:53   --------   d-----w-   c:\documents and settings\All Users\Application Data\MFAData
2010-10-19 07:26 . 2010-10-19 07:26   --------   d-sh--w-   c:\documents and settings\LocalService\IETldCache
2010-10-12 10:33 . 2010-10-12 10:33   --------   d-----w-   c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 17:23 . 2004-08-03 20:07   974848   ----a-w-   c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-03 20:07   974848   ----a-w-   c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-03 20:07   954368   ----a-w-   c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-03 20:07   953856   ----a-w-   c:\windows\system32\mfc40u.dll
2010-09-15 09:50 . 2010-06-13 23:16   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2010-09-15 07:29 . 2008-05-03 17:50   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2010-09-10 05:58 . 2004-08-03 20:07   916480   ----a-w-   c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2004-08-03 20:07   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2004-08-03 20:07   1469440   ----a-w-   c:\windows\system32\inetcpl.cpl
2010-08-23 16:12 . 2004-08-03 20:07   617472   ----a-w-   c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-03 20:07   58880   ----a-w-   c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-03 20:07   590848   ----a-w-   c:\windows\system32\rpcrt4.dll
2010-08-13 12:53 . 2009-04-16 21:40   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"cdloader"="c:\documents and settings\Home\Application Data\mjusbsp\cdloader2.exe" [2010-10-08 50592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"WinSys2"="c:\windows\system32\winsys2.exe" [2006-04-29 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-01-21 92168]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-17 202256]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\NetworkService\Application Data\mjusbsp\cdloader2.exe" [2010-10-08 50592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DualCoreCenter.lnk - c:\program files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe [2008-4-17 192512]
E-Color.lnk - c:\program files\E-Color\Common\IconMgr.exe [2008-4-17 61440]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ     msv1_0 setuid

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\FSFDT\\FWInn\\FWINN.exe"=
"c:\\Program Files\\FSFDT\\Control Panel\\FSFDTCP.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Home\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\NetworkService\\Application Data\\mjusbsp\\magicJack.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"42019:TCP"= 42019:TCP:Azures
"42019:UDP"= 42019:UDP:Azures
"49152:TCP"= 49152:TCP:azures
"49152:UDP"= 49152:UDP:azures

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [10/31/2010 10:04 AM 20328]
R2 magicJack;magicJack;c:\mjusbsp\srvany.exe [4/25/2010 8:35 AM 8192]
R3 DualCoreCenter;DualCoreCenter;c:\program files\MSI\DualCoreCenter\NTGLM7X.sys [4/17/2008 8:35 PM 28160]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/28/2008 8:35 PM 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc   REG_MULTI_SZ     p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 22:34   451872   ----a-w-   c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-10-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-11-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-11-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-842925246-789336058-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-11-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-842925246-789336058-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-11-02 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-18.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-842925246-789336058-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-11-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-842925246-789336058-839522115-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-11-06 c:\windows\Tasks\User_Feed_Synchronization-{D1A74F21-8B46-4EC6-A0A8-9C369E7281DC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
FF - ProfilePath - c:\documents and settings\Home\Application Data\Mozilla\Firefox\Profiles\ashxfdvz.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\Home\Application Data\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
HKLM-Run-@OnlineArmor GUI - c:\program files\Emsisoft\Online Armor\oaui.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-06 21:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.1 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SAMSUNG_SP2004C rev.VM100-49 -> \Device\00000032

device: opened successfully
user: MBR read successfully
error: Read Incorrect function.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\0000006d -> \??\IDE#DiskSAMSUNG_SP2004C_________________________VM100-49#30534737314A4C55304332383830202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user & kernel MBR OK

Registry trace:
called modules: ntkrnlpa.exe hal.dll

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(552)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.DLL

- - - - - - - > 'lsass.exe'(612)
c:\windows\system32\WININET.dll
c:\windows\system32\setuid.dll

- - - - - - - > 'explorer.exe'(2028)
c:\windows\system32\WININET.dll
c:\program files\TortoiseCVS\TortoiseShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\msdtc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Lexmark 1200 Series\lxczbmon.exe
c:\program files\E-Color\E-Color Indicator\TICIcon.exe
c:\program files\iPod\bin\iPodService.exe
c:\documents and settings\NetworkService\Application Data\mjusbsp\magicJack.exe
.
**************************************************************************
.
Completion time: 2010-11-06 21:36:17 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-07 02:36

Pre-Run: 16,530,817,024 bytes free
Post-Run: 16,640,778,240 bytes free

- - End Of File - - 73DF11FB62FDDEE199732022B7623C5F

thammondwis · « **Reply #40 on:** November 07, 2010, 06:34:59 AM »

Hello,

Just to let you know what is currently going on with my computer. I tried to go to the Microsoft update website via Internet Explorer/Tools/Windows Update and still get a message that I can not connect. I then went to the google home page and before I typed anything into the search box, a new Intnernet Explorer window opened. I closed the pop up window before it loaded but AVG detected and blocked a threat - Exploit JavaScript Obfuscation (Type 1512), Process ID 1352. I clicked on more info link in the AVG threat window and a new Internet Explorer window opened but then Internet Explorer froze up and I needed to End Task with the Windows Task Manager to close out Internet Explorer.

SuperDave · « **Reply #41 on:** November 07, 2010, 11:07:18 AM »

Please go to Jotti's malware scan
(If more than one file needs scanned they must be done separately and links posted for each one)

* Copy the file path in the below Code box:

Code: [Select]

c:\program files\Real\RealUpgrade\realupgrade.exe
* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.
********************************
Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

•Open the folder and run Dial-a-fix.exe
•2 windows will open. Close the one in the background labeled Restrictive Policies
•Check the box in section 1, Empty temp folders.

•Check the box in section 2, Fix Windows Installer.

•Check the box in section 3, Fix Windows Update.

•Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked

•Check all boxes in section 5, labeled Registration Center.

•Click Go

•OK any error messages if received, but write them down and post them here.

•Restart the computer when done.
***************************************
SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select the following items.

Process << Selected
Kernel Modules << Selected
SSDT << Selected
Kernel Hooks << Selected
IRP Hooks << NOT Selected
Ports << NOT Selected
Hidden Files << Selected

At the bottom of the page

Hidden Objects Only << Selected

Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was

extracted to. Open the text file and copy/paste the log here.
[/list]

thammondwis · « **Reply #42 on:** November 07, 2010, 02:26:35 PM »

Here is the link to the scan per your instructions.

http://virusscan.jotti.org/en/scanresult/788727fcf467c78e77c5b66
887c9daf459a9c019/3e3553fe2c7a1792ce905423c40bc4fc921c59d7

thammondwis · « **Reply #43 on:** November 07, 2010, 03:41:33 PM »

I had an error in the dial-a-fix before the program started:

Dial-a-fix was unable to determine your version on Internet Explorer. Certain DLL registrations will be skipped.

There wasn't a 2nd window labeled Restrictive Policies that opened.

Below are the error messages that occurred while the program was running, at the end when I tried to restarted the computer I got an error message that realupgrade.exe is not responding and had to click on end now to get the computer to reboot.

Error 127: C:\Windows\System32\iesetup.dll is not registerable or the file is corrupted. Your version of iesetup.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\iesetup.dll is not DLLInstall-able or the file is corrupted. Your version of iesetup.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\imgutil.dll is not registerable or the file is corrupted. Your version of imgutil.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\inseng.dll is not registerable or the file is corrupted. Your version of inseng.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\inseng.dll is not DLLInstall-able or the file is corrupted. Your version of inseng.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\mshtml.dll is not registerable or the file is corrupted. Your version of mshtml.dll is 8.00.6001.18975(?). Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\mshtml.dll is not DLLInstall-able or the file is corrupted. Your version of mshtml.dll is 8.00.6001.18975(?). Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\msrating.dll is not registerable or the file is corrupted. Your version of msrating.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\occache.dll is not registerable or the file is corrupted. Your version of occache.dll is 8.00.6001.18968. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\occache.dll is not DLLInstall-able or the file is corrupted. Your version of occache.dll is 8.00.6001.18968. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\pngfilt.dll is not registerable or the file is corrupted. Your version of pngfilt.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\webcheck.dll is not registerable or the file is corrupted. Your version of webcheck.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\webcheck.dll is not DLLInstall-able or the file is corrupted. Your version of webcheck.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

thammondwis · « **Reply #44 on:** November 07, 2010, 04:44:25 PM »

Here is the Antirootkit Log:

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_nvata.sys
Service Name: ---
Module Base: F3CD2000
Module End: F3CEC000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Service Name: ---
Module Base: F79A5000
Module End: F79A7000
Hidden: Yes

******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwOpenProcess
Address: F67356C0
Driver Base: F6733000
Driver End: F673D000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwTerminateProcess
Address: F6735770
Driver Base: F6733000
Driver End: F673D000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwTerminateThread
Address: F6735810
Driver Base: F6733000
Driver End: F673D000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwWriteVirtualMemory
Address: F67358B0
Driver Base: F6733000
Driver End: F673D000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied

SuperDave · « **Reply #45 on:** November 08, 2010, 12:23:01 PM »

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the

button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

•Check

•Click the

button.
•Accept any security warnings from your browser.
•Check

•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push

•Push

, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the

button.
•Push

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

thammondwis · « **Reply #46 on:** November 09, 2010, 04:19:00 AM »

Here is the ESET scan log:

C:\Documents and Settings\Home\Application Data\Sun\Java\Deployment\cache\6.0\1\db986c1-5cc26034   a variant of Java/TrojanDownloader.OpenStream.NAU trojan   deleted - quarantined
C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\63\79a5627f-4abe2570   a variant of Java/TrojanDownloader.OpenStream.NAU trojan   deleted - quarantined
C:\System Volume Information\_restore{52DDFAA4-0645-4506-922B-F89A2F601219}\RP423\A0059779.lnk   Win32/Adware.ADON application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{52DDFAA4-0645-4506-922B-F89A2F601219}\RP423\A0059780.lnk   Win32/Adware.ADON application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{52DDFAA4-0645-4506-922B-F89A2F601219}\RP423\A0059781.lnk   Win32/Adware.ADON application   cleaned by deleting - quarantined

thammondwis · « **Reply #47 on:** November 09, 2010, 06:05:18 AM »

SuperDave,

I inadvertently updated FireFox. I have been getting messages that there is a new version of FireFox available. I figured I would wait until my computer gets cleaned up before updating, but I accidentally hit the upgrade button today instead of the wait button. After it downloaded the upgrade, I was told that when I restart FireFox the upgrade would be installed. So I closed FireFox and restarted it. I got a message that the upgrade could not occur because FireFox was still running (there wasn't anything running that I could see). So I rebooted windows (needed to hard reboot). When windows restarted I tried starting FireFox and got the same message about FireFox was still running but shortly after that it installed the upgrade. However after the upgrade 4 tabs opened in FireFox and a popup window saying my computer was infected. I did not click on anything but closed FireFox via the task manager. When I restarted FireFox again the 4 tabs opened up again. I quickly closed the extra 3 before the pages loaded.

Also of note, I typically have to double click on the desktop FireFox icon 2 or 3 times before FireFox will open up.

SuperDave · « **Reply #48 on:** November 09, 2010, 01:00:03 PM »

You should uninstall FireFox then get the newest version and install it. Please update and run SAS and MBAM again and post the logs.

thammondwis · « **Reply #49 on:** November 10, 2010, 04:23:09 AM »

I uninstalled FireFox. Ran SAS and MBAM. Internet Explorer has become totally unresponsive now. When I open the program it does not load a web page (just a blank white screen), when I click on anything it locks up and I need to end task with the task manager. However while I was setting up SAS to run, I think it was when I was checking for updates, SAS opened up a Internet Explorer window. I was able to use Internet Explorer normally from this window and downloaded the FireFox installation file at this point. After I ran the scans, I installed FireFox. However after the installation, I needed to double click on the FireFox icon about 4 times before it started and I've received a number of pop up windows.

Also as I have been typing this, the light to the 3.5" floppy drive has come on a couple of times which is unusal.

The SAS scan is below. The MBAM scan did not find anything and I will add that log in my next post.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/09/2010 at 09:36 PM

Application Version : 4.45.1000

Core Rules Database Version : 5836
Trace Rules Database Version: 3648

Scan type : Complete Scan
Total Scan Time : 03:16:03

Memory items scanned : 503
Memory threats detected : 0
Registry items scanned : 6731
Registry threats detected : 0
File items scanned : 233199
File threats detected : 52

Adware.Tracking Cookie
   C:\Documents and Settings\Home\Cookies\home@atdmt[2].txt
   C:\Documents and Settings\Home\Cookies\[email protected][2].txt
   C:\Documents and Settings\Home\Cookies\home@hitbox[3].txt
   C:\Documents and Settings\Home\Cookies\home@n-traffic[1].txt
   C:\Documents and Settings\Home\Cookies\home@advertising[1].txt
   C:\Documents and Settings\Home\Cookies\[email protected][2].txt
   C:\Documents and Settings\Home\Cookies\[email protected][3].txt
   C:\Documents and Settings\Home\Cookies\home@doubleclick[2].txt
   C:\Documents and Settings\Home\Cookies\home@specificclick[2].txt
   C:\Documents and Settings\Home\Cookies\[email protected][3].txt
   C:\Documents and Settings\Home\Cookies\[email protected][3].txt
   C:\Documents and Settings\Home\Cookies\home@advertise[1].txt
   C:\Documents and Settings\Home\Cookies\home@questionmarket[2].txt
   C:\Documents and Settings\Home\Cookies\home@interclick[3].txt
   C:\Documents and Settings\Home\Cookies\home@insightexpressai[2].txt
   C:\Documents and Settings\Home\Cookies\home@adbrite[3].txt
   C:\Documents and Settings\Home\Cookies\home@trafficmp[2].txt
   C:\Documents and Settings\Home\Cookies\home@revsci[2].txt
   C:\Documents and Settings\Home\Cookies\[email protected][1].txt
   C:\Documents and Settings\Home\Cookies\home@pointroll[3].txt
   C:\Documents and Settings\Home\Cookies\[email protected][1].txt
   a.ads2.msads.net [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   ads2.msads.net [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   adsatt.espn.go.com [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   b.ads2.msads.net [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   convoad.technoratimedia.com [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   core.insightexpressai.com [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   media.mtvnservices.com [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   msnbcmedia.msn.com [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   secure-us.imrworldwide.com [ C:\Documents and Settings\Home\Application Data\Macromedia\Flash Player\#SharedObjects\D3Y5NHFK ]
   core.insightexpressai.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   crackle.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   media.heavy.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   media.mtvnservices.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   media.scanscout.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   media1.break.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   objects.tremormedia.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   s0.2mdn.net [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   secure-us.imrworldwide.com [ C:\Documents and Settings\LocalService\Application Data\Macromedia\Flash Player\#SharedObjects\Y3QQDMF2 ]
   core.insightexpressai.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   crackle.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   media.heavy.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   media.mtvnservices.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   media.scanscout.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   media1.break.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   objects.tremormedia.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]
   secure-us.imrworldwide.com [ C:\Documents and Settings\NetworkService\Application Data\Macromedia\Flash Player\#SharedObjects\W83AQ88H ]

Trojan.Agent/Gen-Koobface[Bonkers]
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DDFAA4-0645-4506-922B-F89A2F601219}\RP420\A0045048.EXE
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DDFAA4-0645-4506-922B-F89A2F601219}\RP420\A0045049.EXE
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DDFAA4-0645-4506-922B-F89A2F601219}\RP420\A0045050.EXE

Trojan.Agent/Gen-Nullo[Short]
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DDFAA4-0645-4506-922B-F89A2F601219}\RP430\A0070576.EXE

Trojan.Agent/Gen
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DDFAA4-0645-4506-922B-F89A2F601219}\RP430\A0073208.EXE

thammondwis · « **Reply #50 on:** November 10, 2010, 04:24:22 AM »

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5086

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/9/2010 11:20:57 PM
mbam-log-2010-11-09 (23-20-57).txt

Scan type: Full scan (C:\|E:\|)
Objects scanned: 378758
Time elapsed: 1 hour(s), 28 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

thammondwis · « **Reply #51 on:** November 10, 2010, 05:38:01 AM »

I tried opening up Internet Explorer one more time, I was going to see if I would be able to reset IE to the default settings. Everytime I would start IE lately, I would get a message to restore previous session or go to home page. Without thinking about it I had always been selecting go tho home page. This time I figured I would try selecting restore previous session. Now both IE and FireFox appear to be working normal.

SuperDave · « **Reply #52 on:** November 10, 2010, 01:20:37 PM »

Ok. Let's give it a few days to see if they stay that way.

thammondwis · « **Reply #53 on:** November 10, 2010, 05:10:18 PM »

OK after using both IE and FireFox a bit I am not getting the unresponsive issues with IE anymore or needing to double click multiple times to start FireFox. However I am still getting redirects in both IE and FireFox and an occasional pop up after a redirect. The redirects so far are occurring when clicking on a link from a Yahoo or Google search.

thammondwis · « **Reply #54 on:** November 10, 2010, 06:11:16 PM »

I am also still getting a Generic Host Process For Win32 Services needs to close message every time I reboot (sometimes right away and sometimes an hour or so after I reboot).

I am also still not able to connect to the windows update site.

SuperDave · « **Reply #55 on:** November 11, 2010, 07:18:03 AM »

Ok. Let's see if we can fix that update problem.

Download Dial-a-Fix by djlizard, save it to the desktop then extract it to it's own folder.

•Open the folder and run Dial-a-fix.exe
•2 windows will open. Close the one in the background labeled Restrictive Policies
•Check the box in section 1, Empty temp folders.

•Check the box in section 2, Fix Windows Installer.

•Check the box in section 3, Fix Windows Update.

•Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked

•Check all boxes in section 5, labeled Registration Center.

•Click Go

•OK any error messages if received, but write them down and post them here.

•Restart the computer when done.
*************************************
You can check out that Generic Host process here.

thammondwis · « **Reply #56 on:** November 11, 2010, 06:41:11 PM »

OK I ran the Dial-a-fix program and the error messages are listed below. I tried to get to the windows update site to see if anything has changed and still can't connect. The microsoft solution link you provided for the Generic Host Process error did not help because that fix is only for SP2 and I am running SP3. I did notice something interesting in the microsft link it mentioned something about the Generic Host Process error is related to a problem with the previous shutdown. For the last week or so I have not been able to perform a soft shut down or reboot. I have to shut down or reboot with a hard reboot.

I had an error in the dial-a-fix before the program started:

Dial-a-fix was unable to determine your version on Internet Explorer. Certain DLL registrations will be skipped.

There wasn't a 2nd window labeled Restrictive Policies that opened.

Below are the error messages that occurred while the program was running.

Error 127: C:\Windows\System32\iesetup.dll is not registerable or the file is corrupted. Your version of iesetup.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\iesetup.dll is not DLLInstall-able or the file is corrupted. Your version of iesetup.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\imgutil.dll is not registerable or the file is corrupted. Your version of imgutil.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\inseng.dll is not registerable or the file is corrupted. Your version of inseng.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\inseng.dll is not DLLInstall-able or the file is corrupted. Your version of inseng.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\mshtml.dll is not registerable or the file is corrupted. Your version of mshtml.dll is 8.00.6001.18975(?). Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\mshtml.dll is not DLLInstall-able or the file is corrupted. Your version of mshtml.dll is 8.00.6001.18975(?). Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\msrating.dll is not registerable or the file is corrupted. Your version of msrating.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\occache.dll is not registerable or the file is corrupted. Your version of occache.dll is 8.00.6001.18968. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\occache.dll is not DLLInstall-able or the file is corrupted. Your version of occache.dll is 8.00.6001.18968. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\pngfilt.dll is not registerable or the file is corrupted. Your version of pngfilt.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\webcheck.dll is not registerable or the file is corrupted. Your version of webcheck.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

Error 127: C:\Windows\System32\webcheck.dll is not DLLInstall-able or the file is corrupted. Your version of webcheck.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.

thammondwis · « **Reply #57 on:** November 11, 2010, 08:04:45 PM »

I am able to perform a "soft" shutdown of the computer if I click on shutdown right after the computer starts up. I also reviewed the program lists in the Add/Remove program listing. There is one program that I was not sure about called CouponBar. I decided to remove it based on some internet research, but clicking on the remove button does not do anything.

SuperDave · « **Reply #58 on:** November 12, 2010, 01:11:32 PM »

Ok. Please try to uninstall it with HJT.

Delete An Uninstall Entry

•Start HijackThis

•Click on the Open the Misc Tools section

•Click on the Open Uninstall Manager button.

•Highlight the entry you want to remove.
•Click Delete this entry

******************************
Do you get any errors when trying to get your updates?
When was the last time you defragged your harddrive?

thammondwis · « **Reply #59 on:** November 12, 2010, 04:06:34 PM »

OK I was able to get rid of CouponBar with HJT.

The message I get when trying to connect to the Windows update site is:

With FireFox the tab says: "Problem Loading Page" and the error message on the page is:

The connection was reset
The connection to the server was reset while the page was loading
Then it has some suggestions to what the problem could be and a button to try again which results in the same thing.

IE is hung up right now so I will need to reboot the computer.

thammondwis · « **Reply #60 on:** November 12, 2010, 04:23:50 PM »

For IE I get the following message:

Internet Explorer cannot display the webpage

For both FireFox and IE it does not matter if I type the web page address or click on a link to the Windows Update site I get the same result every time. Its as if something is blocking that web site on both programs.

thammondwis · « **Reply #61 on:** November 13, 2010, 05:58:55 AM »

SuperDave,

I have been doing a bit of investigation on my windows update problem (although difficult with the redirect issues but I have found a workaround but it is somewhat cumbersome).

Some of the information I have found lead me to check Automatic Updates Service via Sevices.msc. Running that command shows that the Automatic Updates service is stopped. I tried to start it but received the following error message:

Could not start the automatic updates service on local computer. Error 1053 the service did not respond to the start or control request in a timely fashion.

Other things that I found in my research that got my interest were:

Issues with older versions of Java. When I click on Add-ons from the Tools menu in FireFox it lists a number of different versions of Java Console (6.0.15, 6.0.17, 6.0.20, 6.0.22, 6.0.14). This seems strange to me because I used a program earlier in this thread to remove older versions of Java. There is an option to uninstall in this Add-ons list. Should I uninstall all but the 6.0.22 version? Also when I click on the Java Console under the Tools menu item in FireFox, nothing happens.

Issues with .net.framework(?). I don't recall any of the specific details, but in the last few weeks while working on this computer with you I have noticed a couple times .net messages or errors of some type occurring.

Issues with defrag. You asked me about that and I have not performed a defrag on this computer in a long time. I am going to perform a defrag now.

thammondwis · « **Reply #62 on:** November 13, 2010, 08:35:11 AM »

I ran defrag on both drives which went OK. It did give a message that it could not defrag everything on each drive (don't know if that is normal or an issue). I then rebooted. I checked the services right away after it rebooted and the Automatic Update service was listed as started. I tried to get to the Windows Update site but got the same results as before. I then went back and looked at the Services again and then the Windows Update service is listed as starting. Went back after a while and it is still listed as starting.

thammondwis · « **Reply #63 on:** November 13, 2010, 11:18:47 AM »

FYI, when I came back to my computer after a while there was a AVG Alert window open stating that a threat was blocked. Info on the threat:

File Name: 195.54.171.169/index.php?...(lot of various characters)
Threat Name: Exploit Rogue Scanner (type 1652)
Process Name: C:\Windows\system32\svchost.exe
Process ID: 4584

Is this type of info useful to you?

SuperDave · « **Reply #64 on:** November 13, 2010, 12:58:06 PM »

Quote

IIs this type of info useful to you?

Not Really. There's no information about it. I'm going to consult my mentor about this problem. In the meantime, could you please run OTL again as instructed in Reply #17

SuperDave · « **Reply #65 on:** November 13, 2010, 06:39:14 PM »

Before you do these scans please reset your router. Power off for more than 10 secs.

Download this << file >> & extract TDSSKiller.exe onto your Desktop

Then create this batch file to be placed next to TDSSKiller

=====

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

Code: [Select]

@ECHO OFF
START /WAIT TDSSKILLER.exe -l Logit.txt -v
START Logit.txt
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:

Double click on fix.bat & allow it to run

Post back to tell me what it says
*********************************

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

•Double-click on MBRCheck.exe to run it.

•It will open a black window...please do not fix anything (if it gives you an option).

•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.

•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.

thammondwis · « **Reply #66 on:** November 13, 2010, 07:51:05 PM »

I get an error message when I run fix.bat. The error message is:

Valid command line parameters: (it then has a listing of all the valid command line parameters)

Not sure if this is what you are looking for or if I copied, pasted, or did something else incorrectly? For what its worth, I don't see a -v as one of the valid command line parameters in the listing?

BTW I had already run the OTL before I saw your last posting so let me know if you still want me to post those logs.

SuperDave · « **Reply #67 on:** November 14, 2010, 01:02:35 PM »

Are you certain that you followed the instructions precisely? This should work because I've used it before.
Were you able to run the MBR scan?

thammondwis · « **Reply #68 on:** November 14, 2010, 03:01:33 PM »

Yes I believe I am following it precisely??? Should the encoding drop down box be selected as ANSI? Anyways searching the internet I found various other people that have reported the same condition I have and have seemed to be able to run without the -v parameter. Should I try that?

Here is the MRB log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version:      Windows XP Professional
Windows Information:      Service Pack 3 (build 2600)
Logical Drives Mask:      0x0000013d

Kernel Drivers (total 140):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0x86CF3000 \WINDOWS\system32\KDCOM.DLL
0xF789B000 \WINDOWS\system32\BOOTVID.dll
0xF7358000 ACPI.sys
0xF7987000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7347000 pci.sys
0xF7487000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7497000 MountMgr.sys
0xF7328000 ftdisk.sys
0xF7989000 dmload.sys
0xF7302000 dmio.sys
0xF770F000 PartMgr.sys
0xF74A7000 VolSnap.sys
0xF72EA000 atapi.sys
0xF72D0000 nvata.sys
0xF74B7000 disk.sys
0xF74C7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF72B0000 fltmgr.sys
0xF729E000 sr.sys
0xF74D7000 PxHelp20.sys
0xF7287000 KSecDD.sys
0xF71FA000 Ntfs.sys
0xF71CD000 NDIS.sys
0xF71B3000 Mup.sys
0xF7717000 avgrkx86.sys
0xF74E7000 AVGIDSEH.Sys
0xF7927000 \SystemRoot\system32\DRIVERS\tunmp.sys
0xF7607000 \SystemRoot\system32\DRIVERS\processr.sys
0xF7807000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7617000 \SystemRoot\system32\DRIVERS\serial.sys
0xF792F000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7157000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7627000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7847000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7857000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7867000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF7133000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7727000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF710B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7637000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7647000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7657000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF70E8000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7667000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF7677000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
0xF6FCC000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
0xF68B4000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF68A0000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7B4A000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7687000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7967000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6889000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7697000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF780F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF781F000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF782F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF6831000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7997000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6733000 \SystemRoot\system32\DRIVERS\update.sys
0xF718B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7187000 \SystemRoot\system32\drivers\WmBEnum.sys
0xF76C7000 \SystemRoot\system32\drivers\WmXlCore.sys
0xF76D7000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF77C7000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
0xF7517000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF799F000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF4139000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xF4115000 \SystemRoot\system32\drivers\portcls.sys
0xF7537000 \SystemRoot\system32\drivers\drmk.sys
0xF7557000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0xF79A9000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B9B000 \SystemRoot\System32\Drivers\Null.SYS
0xF79AD000 \SystemRoot\System32\Drivers\Beep.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF775F000 \SystemRoot\System32\drivers\vga.sys
0xF79B1000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79B5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF776F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF777F000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF793B000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF40BA000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF7567000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF4061000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF4001000 \SystemRoot\system32\DRIVERS\tcpip6.sys
0xF3FDB000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7577000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF3EF3000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0xF7587000 \SystemRoot\system32\drivers\ip6fw.sys
0xF3ECB000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF3EA9000 \SystemRoot\System32\drivers\afd.sys
0xF7597000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF3E87000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF778F000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xF3E5C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF7A6D000 \SystemRoot\System32\Drivers\PQNTDrv.SYS
0xF3DEC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF75A7000 \SystemRoot\System32\Drivers\Fips.SYS
0xF3DB0000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0xF77F7000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF7817000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF3F6B000 \SystemRoot\system32\drivers\usbaudio.sys
0xF4111000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF75C7000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF3D64000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF7547000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF3CD2000 \SystemRoot\System32\Drivers\dump_nvata.sys
0xF7A0B000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3D34000 \SystemRoot\System32\drivers\Dxapi.sys
0xF77CF000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7A9C000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xF784F000 \SystemRoot\system32\drivers\WmFilter.sys
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF3DAC000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xBA38B000 \SystemRoot\system32\drivers\wdmaud.sys
0xBA5B8000 \SystemRoot\system32\drivers\sysaudio.sys
0xBA12C000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7A33000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF6801000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0xBA118000 \??\C:\WINDOWS\system32\drivers\cpuz134_x32.sys
0xB9F95000 \SystemRoot\system32\DRIVERS\srv.sys
0xB9D76000 \??\C:\WINDOWS\system32\drivers\mqac.sys
0xB9B61000 \??\C:\WINDOWS\system32\drivers\RMCast.sys
0xF7995000 \SystemRoot\system32\drivers\WmVirHid.sys
0xB9BC3000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xB9BAB000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA4A0000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0xB9722000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0xB92F6000 \SystemRoot\System32\Drivers\HTTP.sys
0xB93C7000 \??\C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys
0xB84C2000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 60):
0 System Idle Process
4 System
484 C:\WINDOWS\system32\smss.exe
516 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
692 csrss.exe
728 C:\WINDOWS\system32\winlogon.exe
784 C:\WINDOWS\system32\services.exe
800 C:\WINDOWS\system32\lsass.exe
988 C:\WINDOWS\system32\svchost.exe
1076 svchost.exe
1260 svchost.exe
1328 svchost.exe
1496 C:\WINDOWS\system32\LEXBCES.EXE
1540 C:\WINDOWS\system32\LEXPPS.EXE
1548 C:\WINDOWS\system32\spoolsv.exe
1904 C:\WINDOWS\explorer.exe
2008 svchost.exe
192 msdtc.exe
352 C:\Program Files\AVG\AVG10\avgwdsvc.exe
312 C:\Program Files\Java\jre6\bin\jqs.exe
976 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
932 C:\mjusbsp\srvany.exe
1700 C:\Program Files\Common Files\Motive\McciCMService.exe
1780 C:\WINDOWS\RTHDCPL.exe
1784 C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
396 C:\Program Files\AVG\AVG10\avgnsx.exe
1584 C:\Program Files\AVG\AVG10\avgemcx.exe
2184 C:\Program Files\Logitech\Gaming Software\LWEMon.exe
2200 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2256 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2272 C:\Program Files\AVG\AVG10\avgtray.exe
2296 C:\WINDOWS\system32\ctfmon.exe
2320 C:\Program Files\E-Color\Common\IconMgr.exe
2352 C:\WINDOWS\system32\nvsvc32.exe
2436 C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
2796 C:\WINDOWS\system32\tcpsvcs.exe
2968 C:\WINDOWS\system32\snmp.exe
3088 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
3096 C:\Program Files\E-Color\E-Color Indicator\TICIcon.exe
3100 C:\Program Files\MSI\DualCoreCenter\DualCoreCenter.exe
3156 C:\WINDOWS\system32\svchost.exe
3280 C:\WINDOWS\system32\mqsvc.exe
3412 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
3476 C:\WINDOWS\system32\wuauclt.exe
3684 C:\WINDOWS\system32\mqtgsvc.exe
2852 C:\Program Files\Mozilla Firefox\firefox.exe
464 alg.exe
2740 C:\Documents and Settings\NetworkService\Application Data\mjusbsp\magicJack.exe
2780 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
3408 C:\Program Files\AVG\AVG10\avgcsrvx.exe
4044 C:\WINDOWS\system32\wuauclt.exe
3788 C:\WINDOWS\system32\wuauclt.exe
2316 C:\WINDOWS\system32\wuauclt.exe
2072 C:\WINDOWS\system32\wuauclt.exe
676 C:\WINDOWS\system32\wuauclt.exe
2068 C:\WINDOWS\system32\wuauclt.exe
672 C:\WINDOWS\system32\wuauclt.exe
3504 C:\WINDOWS\system32\wuauclt.exe
924 C:\WINDOWS\system32\svchost.exe
2152 C:\Documents and Settings\Home\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000012`86551200 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGSP2004C, Rev: VM100-49

Size Device Name MBR Status
--------------------------------------------
186 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644 A

Done!

SuperDave · « **Reply #69 on:** November 14, 2010, 11:46:12 PM »

Ok. Please try this:

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory..

thammondwis · « **Reply #70 on:** November 15, 2010, 05:22:11 AM »

OK I am now able to connect to the Windows update site. Not sure about any of the other issues I have been having yet. Here is the log:

2010/11/15 06:14:12.0875   TDSS rootkit removing tool 2.4.7.0 Nov 8 2010 10:52:22
2010/11/15 06:14:12.0875   ================================================================================
2010/11/15 06:14:12.0875   SystemInfo:
2010/11/15 06:14:12.0875
2010/11/15 06:14:12.0875   OS Version: 5.1.2600 ServicePack: 3.0
2010/11/15 06:14:12.0875   Product type: Workstation
2010/11/15 06:14:12.0890   ComputerName: HOME
2010/11/15 06:14:12.0890   UserName: Home
2010/11/15 06:14:12.0890   Windows directory: C:\WINDOWS
2010/11/15 06:14:12.0890   System windows directory: C:\WINDOWS
2010/11/15 06:14:12.0890   Processor architecture: Intel x86
2010/11/15 06:14:12.0890   Number of processors: 2
2010/11/15 06:14:12.0890   Page size: 0x1000
2010/11/15 06:14:12.0890   Boot type: Normal boot
2010/11/15 06:14:12.0890   ================================================================================
2010/11/15 06:14:13.0406   Initialize success
2010/11/15 06:14:18.0015   ================================================================================
2010/11/15 06:14:18.0015   Scan started
2010/11/15 06:14:18.0015   Mode: Manual;
2010/11/15 06:14:18.0015   ================================================================================
2010/11/15 06:14:19.0328   ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/11/15 06:14:19.0468   ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/11/15 06:14:19.0796   aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/11/15 06:14:19.0984   AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/11/15 06:14:20.0343   AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/11/15 06:14:20.0421   atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/11/15 06:14:20.0468   Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/11/15 06:14:20.0546   audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/11/15 06:14:20.0640   AVGIDSDriver (0c61f066f4d94bd67063dc6691935143) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
2010/11/15 06:14:20.0687   AVGIDSEH (84853f800cd69252c3c764fe50d0346f) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
2010/11/15 06:14:20.0750   AVGIDSFilter (28d6adcd03e10f3838488b9b5d407dd4) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
2010/11/15 06:14:20.0828   AVGIDSShim (0eb16f4dbbb946360af30d2b13a52d1d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
2010/11/15 06:14:20.0921   Avgldx86 (1119e5bec6e749e0d292f0f84d48edba) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
2010/11/15 06:14:20.0953   Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
2010/11/15 06:14:20.0968   Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
2010/11/15 06:14:21.0015   Avgtdix (2fd3e3a57fb90679a3a83eeed0360cfd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
2010/11/15 06:14:21.0062   Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/11/15 06:14:21.0125   cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/11/15 06:14:21.0218   Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/11/15 06:14:21.0312   Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/11/15 06:14:21.0375   Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/11/15 06:14:21.0531   cpuz134 (75fa19142531cbf490770c2988a7db64) C:\WINDOWS\system32\drivers\cpuz134_x32.sys
2010/11/15 06:14:21.0625   Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/11/15 06:14:21.0671   dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2010/11/15 06:14:21.0750   dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2010/11/15 06:14:21.0781   dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/11/15 06:14:21.0828   DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/11/15 06:14:21.0937   drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/11/15 06:14:22.0015   DualCoreCenter (994d42a1c15f0a64662d9c06b3345964) C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys
2010/11/15 06:14:22.0046   Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/11/15 06:14:22.0078   Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/11/15 06:14:22.0156   Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2010/11/15 06:14:22.0203   Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/11/15 06:14:22.0296   FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/11/15 06:14:22.0328   Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/11/15 06:14:22.0359   Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/11/15 06:14:22.0406   GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2010/11/15 06:14:22.0453   Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/11/15 06:14:22.0515   HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/11/15 06:14:22.0578   HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/11/15 06:14:22.0687   HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/11/15 06:14:22.0750   i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/11/15 06:14:22.0843   Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/11/15 06:14:23.0078   IntcAzAudAddService (001aaca6ed0e6b00fc5b8faf74977e81) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/11/15 06:14:23.0218   Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/11/15 06:14:23.0250   IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/11/15 06:14:23.0296   IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/11/15 06:14:23.0390   IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/11/15 06:14:23.0421   IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/11/15 06:14:23.0468   IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/11/15 06:14:23.0593   isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/11/15 06:14:23.0625   Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/11/15 06:14:23.0656   kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/11/15 06:14:23.0687   kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/11/15 06:14:23.0718   KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/11/15 06:14:23.0859   mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/11/15 06:14:23.0906   Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2010/11/15 06:14:23.0953   Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/11/15 06:14:23.0984   mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/11/15 06:14:24.0015   MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/11/15 06:14:24.0062   MQAC (70c14f5cca5cf73f8a645c73a01d8726) C:\WINDOWS\system32\drivers\mqac.sys
2010/11/15 06:14:24.0203   MREMP50 (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
2010/11/15 06:14:24.0265   MRESP50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
2010/11/15 06:14:24.0343   MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/11/15 06:14:24.0406   MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/11/15 06:14:24.0437   Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/11/15 06:14:24.0484   MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/11/15 06:14:24.0578   MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/11/15 06:14:24.0609   MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/11/15 06:14:24.0687   mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/11/15 06:14:24.0703   Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/11/15 06:14:24.0765   NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/11/15 06:14:24.0796   NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/11/15 06:14:24.0875   Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/11/15 06:14:24.0906   NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/11/15 06:14:24.0984   NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/11/15 06:14:25.0031   NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/11/15 06:14:25.0078   NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/11/15 06:14:25.0140   Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/11/15 06:14:25.0203   Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/11/15 06:14:25.0265   Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/11/15 06:14:25.0515   nv (8c0456001b6900114bbb1c548bd8aaf5) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2010/11/15 06:14:25.0796   nvata (9eccd189a9554c30a0d18a429778c7ba) C:\WINDOWS\system32\DRIVERS\nvata.sys
2010/11/15 06:14:25.0843   NVENETFD (4d6f0d3fb17c1ba64942f415c73adcdb) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2010/11/15 06:14:25.0906   nvnetbus (921e63aa1e1a20302223d016acafb52b) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2010/11/15 06:14:26.0015   NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/11/15 06:14:26.0046   NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/11/15 06:14:26.0093   Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/11/15 06:14:26.0140   PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/11/15 06:14:26.0187   ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/11/15 06:14:26.0218   PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/11/15 06:14:26.0265   PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/11/15 06:14:26.0312   Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/11/15 06:14:26.0515   PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/11/15 06:14:26.0578   PQNTDrv (04f3971b70a7855f04d351aa4bee7799) C:\WINDOWS\system32\drivers\PQNTDrv.sys
2010/11/15 06:14:26.0609   Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2010/11/15 06:14:26.0656   PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/11/15 06:14:26.0718   Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/11/15 06:14:26.0781   PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/11/15 06:14:26.0906   RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/11/15 06:14:26.0953   Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/11/15 06:14:27.0015   RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/11/15 06:14:27.0109   Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/11/15 06:14:27.0156   Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/11/15 06:14:27.0187   RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/11/15 06:14:27.0250   rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/11/15 06:14:27.0296   RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/11/15 06:14:27.0343   redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/11/15 06:14:27.0453   RMCAST (96f7a9a7bf0c9c0440a967440065d33c) C:\WINDOWS\system32\drivers\RMCast.sys
2010/11/15 06:14:27.0671   SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2010/11/15 06:14:27.0703   SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2010/11/15 06:14:27.0781   Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/11/15 06:14:27.0890   serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/11/15 06:14:27.0937   Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/11/15 06:14:28.0000   Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/11/15 06:14:28.0140   splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/11/15 06:14:28.0203   sptd (71e276f6d189413266ea22171806597b) C:\WINDOWS\system32\Drivers\sptd.sys
2010/11/15 06:14:28.0265   sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/11/15 06:14:28.0328   Srv (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/11/15 06:14:28.0375   swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/11/15 06:14:28.0406   swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/11/15 06:14:28.0546   sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/11/15 06:14:28.0640   Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/11/15 06:14:28.0687   Tcpip6 (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
2010/11/15 06:14:28.0765   TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/11/15 06:14:28.0828   TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/11/15 06:14:28.0875   TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/11/15 06:14:28.0968   tunmp (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
2010/11/15 06:14:29.0000   Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/11/15 06:14:29.0062   Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/11/15 06:14:29.0140   usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/11/15 06:14:29.0203   usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/11/15 06:14:29.0281   usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/11/15 06:14:29.0328   usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/11/15 06:14:29.0390   usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2010/11/15 06:14:29.0406   usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/11/15 06:14:29.0453   usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/11/15 06:14:29.0531   USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/11/15 06:14:29.0562   VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/11/15 06:14:29.0625   VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/11/15 06:14:29.0671   Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/11/15 06:14:29.0718   wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/11/15 06:14:29.0781   WmBEnum (59c90bc8317bd3f6e5559a4deaf35090) C:\WINDOWS\system32\drivers\WmBEnum.sys
2010/11/15 06:14:29.0828   WmFilter (999a4539ad634a741afd357e290bd461) C:\WINDOWS\system32\drivers\WmFilter.sys
2010/11/15 06:14:29.0906   WmVirHid (0b8c64b13776f17537f0705fe62799c6) C:\WINDOWS\system32\drivers\WmVirHid.sys
2010/11/15 06:14:29.0953   WmXlCore (8d388aeb1a12c1192aa9b4ebceabcba6) C:\WINDOWS\system32\drivers\WmXlCore.sys
2010/11/15 06:14:30.0015   WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/11/15 06:14:30.0062   WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/11/15 06:14:30.0140   \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/11/15 06:14:30.0140   ================================================================================
2010/11/15 06:14:30.0140   Scan finished
2010/11/15 06:14:30.0140   ================================================================================
2010/11/15 06:14:30.0156   Detected object count: 1
2010/11/15 06:14:44.0718   \HardDisk0 - will be cured after reboot
2010/11/15 06:14:44.0718   Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2010/11/15 06:14:51.0921   Deinitialize success

thammondwis · « **Reply #71 on:** November 15, 2010, 05:51:43 AM »

Just a bit more feedback, after using both IE and FireFox for a little while I did not have any redirects or pop ups.

SuperDave · « **Reply #72 on:** November 15, 2010, 01:32:00 PM »

Quote

Just a bit more feedback, after using both IE and FireFox for a little while I did not have any redirects or pop ups.

Well, that's good news. Please run ESET again as instructed in Reply # 45

thammondwis · « **Reply #73 on:** November 16, 2010, 04:16:07 AM »

ESET picked up a couple of threats. Here is the log:

C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\47\fa54f6f-332ad8a6 a variant of Java/Rowindal.C trojan deleted - quarantined
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\36\6b20c64-75814c05 a variant of Java/TrojanDownloader.OpenStream.NAU trojan deleted - quarantined

SuperDave · « **Reply #74 on:** November 16, 2010, 01:08:20 PM »

I would say that your computer appears to be clean. This has been a long process. Than your for being so patient.Let's do some cleanup.

* Click START then RUN - Vista users press the Windows Key and the R keys together for the Run box.
* Now type blackpudding /uninstall in the runbox
* Make sure there's a space between blackpudding and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.

***********************************
To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

Click the CleanUp button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.
******************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
*******************************************
Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
*********************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

thammondwis · « **Reply #75 on:** November 17, 2010, 09:26:09 PM »

Still finishing off the cleanup and preventative maintenance items you suggested, but wanted to give you a huge thanks for all your help. It has been a long process but got there with your help. Everything has been running great now.

Computer Hope Forum

News:

Author Topic: Pc Problems (Read 55603 times)

thammondwis

Allan

thammondwis

thammondwis

thammondwis

thammondwis

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

thammondwis

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis

thammondwis

thammondwis

thammondwis

thammondwis

SuperDave

SuperDave

thammondwis

SuperDave

thammondwis

SuperDave

thammondwis

thammondwis

SuperDave

thammondwis