berryski Posted December 17, 2011 ID:506007 Share Posted December 17, 2011 Hi.I was infected with this virus and I have read that it often comes associated with a TDSS bug. As it stands now, I have managed to get the popups and Win 7 stuff clear (thanks to Malwarebytes), but I am getting weird redirects when I surf the net. I have tried to run TDSSKiller, but when i do, the program pushed the "run?" prompt and when I say yes nothing happens. Any help would with my issue be endlessly appreciated. I would post full logs here, but I'm not sure how to generate those files. Below is my most recent Hijackthis log:Logfile of HijackThis v1.97.7Scan saved at 11:23:23 AM, on 12/17/2011Platform: Unknown Windows (WinNT 6.01.3504)MSIE: Internet Explorer v8.00 (8.00.7600.16912)Running processes:C:\Program Files (x86)\Steam\Steam.exeC:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exeC:\Program Files (x86)\iTunes\iTunesHelper.exeC:\Program Files (x86)\Windows Live\Mail\wlmail.exeC:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Users\Garvin\Desktop\Utilities\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dll (file missing)O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dll (file missing)O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"O4 - HKLM\..\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttrayO4 - HKCU\..\Run: [steam] "c:\program files (x86)\steam\steam.exe" -silentO10 - Broken Internet access because of LSP provider 'mswsock.dll' missing Link to post Share on other sites More sharing options...
berryski Posted December 17, 2011 Author ID:506054 Share Posted December 17, 2011 Additional info. When I try and install my antivirus, it blocks out and cannot be installed. Malwarebytes has installed, but when i attempt to initiate the protection module i get failure and the error code 1068.Please help Link to post Share on other sites More sharing options...
berryski Posted December 18, 2011 Author ID:506126 Share Posted December 18, 2011 OTL LogfileOTL logfile created on: 12/17/2011 9:12:28 PM - Run 1OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Garvin\Downloads64bit- Professional (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 2.78 Gb Available Physical Memory | 69.57% Memory free8.00 Gb Paging File | 6.65 Gb Available in Paging File | 83.22% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.07 Gb Total Space | 251.22 Gb Free Space | 55.69% Space Free | Partition Type: NTFSComputer Name: GARVIN-PC | User Name: Garvin | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - [2011/12/17 21:11:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Garvin\Downloads\OTL.exePRC - [2011/11/13 15:51:34 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exePRC - [2011/08/03 03:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exePRC - [2011/08/03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exePRC - [2011/08/01 20:47:26 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exePRC - [2010/10/02 21:03:31 | 000,002,560 | ---- | M] () -- C:\Windows\Runservice.exePRC - [2010/08/07 23:12:39 | 000,218,464 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exePRC - [2010/07/13 20:32:13 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exePRC - [2009/12/29 13:35:38 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exePRC - [2009/10/15 00:10:28 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exePRC - [2009/07/13 17:14:28 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\PING.EXEPRC - [2009/05/21 05:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exePRC - [2009/05/05 02:39:18 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe========== Modules (No Company Name) ==========MOD - [2011/12/14 00:19:00 | 014,410,024 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dllMOD - [2011/12/14 00:19:00 | 000,194,344 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dllMOD - [2011/12/14 00:19:00 | 000,091,432 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-50.dllMOD - [2011/12/14 00:18:59 | 000,914,216 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-52.dllMOD - [2011/12/14 00:18:59 | 000,155,432 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-52.dllMOD - [2011/11/29 19:23:13 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dllMOD - [2011/11/13 15:51:34 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dllMOD - [2011/08/03 02:31:28 | 000,255,592 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dllMOD - [2011/06/24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dllMOD - [2011/06/24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dllMOD - [2009/10/15 00:10:28 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exeMOD - [2009/07/13 17:15:51 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll========== Win32 Services (SafeList) ==========SRV:64bit: - [2009/07/13 17:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV:64bit: - [2009/03/31 14:01:34 | 000,092,160 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe -- (AERTFilters)SRV - [2011/11/05 11:40:24 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2011/08/31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2011/08/03 03:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)SRV - [2011/08/03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)SRV - [2010/10/02 21:03:31 | 000,002,560 | ---- | M] () [Auto | Running] -- C:\Windows\Runservice.exe -- (LicCtrlService)SRV - [2010/08/07 23:12:39 | 000,218,464 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)SRV - [2010/07/13 20:32:13 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)SRV - [2010/02/11 08:53:00 | 000,660,800 | ---- | M] (SoftThinks) [Disabled | Stopped] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)SRV - [2009/06/10 13:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2009/05/21 05:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)SRV - [2009/05/05 02:39:18 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe -- (sprtsvc_DellComms) SupportSoft Sprocket Service (DellComms)========== Driver Services (SafeList) ==========DRV:64bit: - [2011/12/16 21:59:26 | 000,105,744 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi)DRV:64bit: - [2011/02/18 15:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:64bit: - [2009/08/20 16:00:10 | 000,664,576 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)DRV:64bit: - [2009/07/21 15:32:50 | 007,345,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)DRV:64bit: - [2009/07/13 17:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2009/07/13 17:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 17:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/07/09 00:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)DRV:64bit: - [2009/06/10 12:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/05/18 11:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2006/11/01 08:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)DRV - [2009/07/13 17:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blankIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0========== FireFox ==========FF - prefs.js..browser.search.update: falseFF - prefs.js..browser.startup.homepage: "www.yahoo.com"FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21FF - prefs.js..network.proxy.type: 4FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{38783831-6098-4faa-A9C9-1EE1E343F4D2}: C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\firefoxextensionFF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/14 00:16:20 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/14 00:16:20 | 000,000,000 | ---D | M][2010/06/12 15:22:10 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Garvin\AppData\Roaming\Mozilla\Extensions[2011/12/14 00:12:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Garvin\AppData\Roaming\Mozilla\Firefox\Profiles\519tvsst.default\extensions[2011/12/14 00:16:26 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Garvin\AppData\Roaming\Mozilla\Firefox\Profiles\519tvsst.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2011/12/14 02:09:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions[2011/12/14 00:16:20 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}[2011/12/14 02:09:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}[2011/11/13 15:51:34 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll[2011/11/10 05:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll[2011/10/01 23:46:20 | 000,002,252 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml[2011/11/13 15:51:35 | 000,002,040 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xmlHosts file not foundO2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg.dll File not foundO2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe64.dll File not foundO2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dll File not foundO2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dll File not foundO3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll File not foundO4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)O4:64bit: - HKLM..\Run: [skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe File not foundO4:64bit: - HKLM..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" File not foundO4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)O4 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001..\Run: [steam] c:\program files (x86)\steam\steam.exe (Valve Corporation)O4 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not foundO4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO4 - Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1O7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003\Software\Policies\Microsoft\Internet Explorer\Recovery presentO10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.76.182 68.87.78.134O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F8A9854-E404-4FD5-906A-CC1187F4A887}: DhcpNameServer = 68.87.76.182 68.87.78.134O18:64bit: - Protocol\Handler\livecall - No CLSID value foundO18:64bit: - Protocol\Handler\ms-help - No CLSID value foundO18:64bit: - Protocol\Handler\msnim - No CLSID value foundO18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value foundO18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe64.dll File not foundO18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg.dll File not foundO18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value foundO18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dll File not foundO18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dll File not foundO20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)O32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = ComFile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 30 Days ==========[2011/12/16 22:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware[2011/12/16 22:14:56 | 000,105,744 | ---- | C] (Trend Micro Inc.) -- C:\Windows\SysNative\drivers\tmtdi.sys[2011/12/16 22:12:10 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro[2011/12/16 20:41:28 | 000,000,000 | ---D | C] -- C:\Users\Garvin\AppData\Roaming\Malwarebytes[2011/12/16 20:41:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2011/12/16 20:41:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2011/12/16 20:29:40 | 009,851,496 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Garvin\Desktop\mbam-setup.exe[2011/12/15 21:59:34 | 000,000,000 | ---D | C] -- C:\Windows\system64[2011/12/15 21:04:09 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN[2011/12/15 20:50:26 | 000,000,000 | ---D | C] -- C:\Windows\temp[2011/12/15 19:37:50 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT[2011/12/15 18:55:27 | 000,000,000 | ---D | C] -- C:\Windows\Minidump[2011/12/15 13:28:03 | 114,751,872 | ---- | C] (Trend Micro Inc.) -- C:\Users\Garvin\Desktop\Ti_TIS_5.0_EN_Full.exe[2011/12/15 13:07:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Trend Micro[2011/12/15 13:05:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro[2011/12/15 13:00:18 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Interactive[2011/12/15 12:55:07 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\log[2011/12/15 10:27:44 | 000,000,000 | ---D | C] -- C:\Users\Garvin\Desktop\FakeAVRemover[2011/12/15 02:10:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP[2011/12/15 01:54:38 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools[2011/12/14 00:43:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes[2011/12/14 00:42:24 | 000,000,000 | ---D | C] -- C:\Program Files\iPod[2011/12/14 00:42:23 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes[2011/12/14 00:42:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes[2011/12/13 10:41:02 | 001,577,264 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Garvin\Desktop\TDSSKiller.exe[2011/11/21 20:49:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2011/12/17 20:58:01 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2011/12/17 20:03:35 | 001,577,264 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Garvin\Desktop\TDSSKiller.exe[2011/12/17 20:03:31 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2011/12/17 20:03:31 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2011/12/17 20:03:24 | 001,557,791 | ---- | M] () -- C:\Users\Garvin\Desktop\tdsskiller.zip[2011/12/17 20:02:49 | 000,744,852 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2011/12/17 20:02:49 | 000,637,946 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2011/12/17 20:02:49 | 000,111,000 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2011/12/17 19:56:21 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2011/12/17 19:56:18 | 000,000,841 | -HS- | M] () -- C:\Windows\SysWow64\mmf.sys[2011/12/17 19:56:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2011/12/17 19:56:06 | 3220,480,000 | -HS- | M] () -- C:\hiberfil.sys[2011/12/16 22:13:52 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\SupportTool.exe.bat[2011/12/16 21:59:26 | 000,105,744 | ---- | M] (Trend Micro Inc.) -- C:\Windows\SysNative\drivers\tmtdi.sys[2011/12/16 20:26:37 | 000,011,988 | -HS- | M] () -- C:\Users\Garvin\AppData\Local\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/16 20:26:37 | 000,011,988 | -HS- | M] () -- C:\ProgramData\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/16 20:19:14 | 009,851,496 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Garvin\Desktop\mbam-setup.exe[2011/12/16 20:15:56 | 001,008,141 | ---- | M] () -- C:\Users\Garvin\Desktop\iExplore.exe[2011/12/16 20:09:50 | 000,001,205 | ---- | M] () -- C:\Users\Garvin\Desktop\FixNCR.reg[2011/12/15 18:55:19 | 400,218,340 | ---- | M] () -- C:\Windows\MEMORY.DMP[2011/12/15 13:30:58 | 000,001,294 | -HS- | M] () -- C:\Users\Garvin\AppData\Local\122677m6s337x050g433o4kda1a3[2011/12/15 13:30:58 | 000,001,294 | -HS- | M] () -- C:\ProgramData\122677m6s337x050g433o4kda1a3[2011/12/15 13:28:16 | 114,751,872 | ---- | M] (Trend Micro Inc.) -- C:\Users\Garvin\Desktop\Ti_TIS_5.0_EN_Full.exe[2011/12/15 10:32:15 | 000,000,036 | ---- | M] () -- C:\Users\Garvin\AppData\Local\housecall.guid.cache[2011/12/15 10:17:14 | 000,002,600 | ---- | M] () -- C:\Users\Garvin\Desktop\exefix.reg[2011/12/15 09:56:26 | 000,019,228 | -HS- | M] () -- C:\Users\Garvin\AppData\Local\126502a2r002b012a847l1tla6l8[2011/12/15 09:56:26 | 000,019,228 | -HS- | M] () -- C:\ProgramData\126502a2r002b012a847l1tla6l8[2011/12/14 23:25:24 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfud.bin[2011/12/14 23:25:22 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfss.bin[2011/12/14 20:11:44 | 000,343,840 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2011/12/14 00:43:03 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk[2011/12/13 23:42:22 | 000,000,408 | ---- | M] () -- C:\ProgramData\rbuEIn2gaehyM9[2011/12/13 23:42:11 | 000,000,304 | ---- | M] () -- C:\ProgramData\~rbuEIn2gaehyM9[2011/12/13 23:42:11 | 000,000,216 | ---- | M] () -- C:\ProgramData\~rbuEIn2gaehyM9r[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]========== Files Created - No Company Name ==========[2011/12/17 20:03:24 | 001,557,791 | ---- | C] () -- C:\Users\Garvin\Desktop\tdsskiller.zip[2011/12/16 20:29:39 | 001,008,141 | ---- | C] () -- C:\Users\Garvin\Desktop\iExplore.exe[2011/12/16 20:28:09 | 000,001,205 | ---- | C] () -- C:\Users\Garvin\Desktop\FixNCR.reg[2011/12/15 21:58:28 | 000,011,988 | -HS- | C] () -- C:\Users\Garvin\AppData\Local\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/15 21:58:28 | 000,011,988 | -HS- | C] () -- C:\ProgramData\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/15 18:55:19 | 400,218,340 | ---- | C] () -- C:\Windows\MEMORY.DMP[2011/12/15 13:30:58 | 000,001,294 | -HS- | C] () -- C:\Users\Garvin\AppData\Local\122677m6s337x050g433o4kda1a3[2011/12/15 13:30:58 | 000,001,294 | -HS- | C] () -- C:\ProgramData\122677m6s337x050g433o4kda1a3[2011/12/15 13:08:19 | 000,000,056 | ---- | C] () -- C:\Windows\SysNative\SupportTool.exe.bat[2011/12/15 10:32:15 | 000,000,036 | ---- | C] () -- C:\Users\Garvin\AppData\Local\housecall.guid.cache[2011/12/15 10:25:28 | 000,002,600 | ---- | C] () -- C:\Users\Garvin\Desktop\exefix.reg[2011/12/14 23:19:37 | 000,019,228 | -HS- | C] () -- C:\Users\Garvin\AppData\Local\126502a2r002b012a847l1tla6l8[2011/12/14 23:19:37 | 000,019,228 | -HS- | C] () -- C:\ProgramData\126502a2r002b012a847l1tla6l8[2011/12/14 00:43:03 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk[2011/12/13 23:42:11 | 000,000,304 | ---- | C] () -- C:\ProgramData\~rbuEIn2gaehyM9[2011/12/13 23:42:11 | 000,000,216 | ---- | C] () -- C:\ProgramData\~rbuEIn2gaehyM9r[2011/12/13 23:41:54 | 000,000,408 | ---- | C] () -- C:\ProgramData\rbuEIn2gaehyM9[2011/08/03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe[2011/08/01 20:54:48 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat[2011/02/08 16:38:40 | 000,000,026 | -H-- | C] () -- C:\ProgramData\.811261211181235583101118113995[2011/02/05 09:34:28 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat[2010/10/02 21:03:32 | 000,000,841 | -HS- | C] () -- C:\Windows\SysWow64\mmf.sys[2010/10/02 21:03:31 | 000,048,640 | ---- | C] () -- C:\Windows\mmfs.dll[2010/10/02 21:03:31 | 000,002,560 | ---- | C] () -- C:\Windows\Runservice.exe[2010/07/13 20:32:15 | 000,218,464 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe[2010/07/13 20:32:13 | 000,075,064 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe[2010/07/13 20:32:12 | 002,444,656 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_apb.exe[2010/07/13 20:31:47 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini[2010/06/12 15:22:01 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat[2010/05/20 08:47:30 | 000,982,220 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin[2010/05/20 08:47:30 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin[2010/05/20 08:47:30 | 000,092,216 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin[2010/05/20 08:47:29 | 000,439,300 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin[2010/05/20 08:01:37 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL[2010/05/20 08:01:37 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL[2010/04/02 15:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat[2009/07/13 21:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat[2009/07/13 18:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT[2009/07/13 18:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat[2009/07/13 16:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin[2009/07/13 15:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 13:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2009/06/10 13:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat========== LOP Check ==========[2011/12/14 00:16:25 | 000,000,000 | ---D | M] -- C:\Users\Garvin\AppData\Roaming\Bioshock2[2011/02/08 16:38:43 | 000,000,000 | -H-D | M] -- C:\Users\Garvin\AppData\Roaming\Final Draft[2011/11/06 19:35:54 | 000,000,000 | -H-D | M] -- C:\Users\Garvin\AppData\Roaming\runic games[2011/12/14 00:12:25 | 000,000,000 | ---D | M] -- C:\Users\Garvin\AppData\Roaming\Sports Interactive[2010/11/27 20:04:16 | 000,000,000 | -H-D | M] -- C:\Users\Garvin\AppData\Roaming\Tropico 3[2011/10/26 20:44:24 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Alternate Data Streams ==========@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2< End of report > Link to post Share on other sites More sharing options...
berryski Posted December 18, 2011 Author ID:506127 Share Posted December 18, 2011 OTL LogfileOTL logfile created on: 12/17/2011 9:12:28 PM - Run 1OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Garvin\Downloads64bit- Professional (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 2.78 Gb Available Physical Memory | 69.57% Memory free8.00 Gb Paging File | 6.65 Gb Available in Paging File | 83.22% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.07 Gb Total Space | 251.22 Gb Free Space | 55.69% Space Free | Partition Type: NTFSComputer Name: GARVIN-PC | User Name: Garvin | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - [2011/12/17 21:11:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Garvin\Downloads\OTL.exePRC - [2011/11/13 15:51:34 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exePRC - [2011/08/03 03:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exePRC - [2011/08/03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exePRC - [2011/08/01 20:47:26 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exePRC - [2010/10/02 21:03:31 | 000,002,560 | ---- | M] () -- C:\Windows\Runservice.exePRC - [2010/08/07 23:12:39 | 000,218,464 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exePRC - [2010/07/13 20:32:13 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exePRC - [2009/12/29 13:35:38 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exePRC - [2009/10/15 00:10:28 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exePRC - [2009/07/13 17:14:28 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\PING.EXEPRC - [2009/05/21 05:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exePRC - [2009/05/05 02:39:18 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe========== Modules (No Company Name) ==========MOD - [2011/12/14 00:19:00 | 014,410,024 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dllMOD - [2011/12/14 00:19:00 | 000,194,344 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dllMOD - [2011/12/14 00:19:00 | 000,091,432 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-50.dllMOD - [2011/12/14 00:18:59 | 000,914,216 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-52.dllMOD - [2011/12/14 00:18:59 | 000,155,432 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-52.dllMOD - [2011/11/29 19:23:13 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dllMOD - [2011/11/13 15:51:34 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dllMOD - [2011/08/03 02:31:28 | 000,255,592 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dllMOD - [2011/06/24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dllMOD - [2011/06/24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dllMOD - [2009/10/15 00:10:28 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exeMOD - [2009/07/13 17:15:51 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll========== Win32 Services (SafeList) ==========SRV:64bit: - [2009/07/13 17:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV:64bit: - [2009/03/31 14:01:34 | 000,092,160 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe -- (AERTFilters)SRV - [2011/11/05 11:40:24 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2011/08/31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2011/08/03 03:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)SRV - [2011/08/03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)SRV - [2010/10/02 21:03:31 | 000,002,560 | ---- | M] () [Auto | Running] -- C:\Windows\Runservice.exe -- (LicCtrlService)SRV - [2010/08/07 23:12:39 | 000,218,464 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)SRV - [2010/07/13 20:32:13 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)SRV - [2010/02/11 08:53:00 | 000,660,800 | ---- | M] (SoftThinks) [Disabled | Stopped] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)SRV - [2009/06/10 13:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2009/05/21 05:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)SRV - [2009/05/05 02:39:18 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe -- (sprtsvc_DellComms) SupportSoft Sprocket Service (DellComms)========== Driver Services (SafeList) ==========DRV:64bit: - [2011/12/16 21:59:26 | 000,105,744 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi)DRV:64bit: - [2011/02/18 15:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:64bit: - [2009/08/20 16:00:10 | 000,664,576 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)DRV:64bit: - [2009/07/21 15:32:50 | 007,345,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)DRV:64bit: - [2009/07/13 17:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2009/07/13 17:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 17:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/07/09 00:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)DRV:64bit: - [2009/06/10 12:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/05/18 11:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2006/11/01 08:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)DRV - [2009/07/13 17:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blankIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0========== FireFox ==========FF - prefs.js..browser.search.update: falseFF - prefs.js..browser.startup.homepage: "www.yahoo.com"FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21FF - prefs.js..network.proxy.type: 4FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{38783831-6098-4faa-A9C9-1EE1E343F4D2}: C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\firefoxextensionFF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/14 00:16:20 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/14 00:16:20 | 000,000,000 | ---D | M][2010/06/12 15:22:10 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Garvin\AppData\Roaming\Mozilla\Extensions[2011/12/14 00:12:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Garvin\AppData\Roaming\Mozilla\Firefox\Profiles\519tvsst.default\extensions[2011/12/14 00:16:26 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Garvin\AppData\Roaming\Mozilla\Firefox\Profiles\519tvsst.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2011/12/14 02:09:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions[2011/12/14 00:16:20 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}[2011/12/14 02:09:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}[2011/11/13 15:51:34 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll[2011/11/10 05:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll[2011/10/01 23:46:20 | 000,002,252 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml[2011/11/13 15:51:35 | 000,002,040 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xmlHosts file not foundO2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg.dll File not foundO2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe64.dll File not foundO2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dll File not foundO2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dll File not foundO3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll File not foundO4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)O4:64bit: - HKLM..\Run: [skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe File not foundO4:64bit: - HKLM..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" File not foundO4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)O4 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001..\Run: [steam] c:\program files (x86)\steam\steam.exe (Valve Corporation)O4 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not foundO4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO4 - Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\Software\Policies\Microsoft\Internet Explorer\Recovery presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1O7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKU\S-1-5-21-3026362431-2087246934-3751454797-1003\Software\Policies\Microsoft\Internet Explorer\Recovery presentO10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.76.182 68.87.78.134O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F8A9854-E404-4FD5-906A-CC1187F4A887}: DhcpNameServer = 68.87.76.182 68.87.78.134O18:64bit: - Protocol\Handler\livecall - No CLSID value foundO18:64bit: - Protocol\Handler\ms-help - No CLSID value foundO18:64bit: - Protocol\Handler\msnim - No CLSID value foundO18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value foundO18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe64.dll File not foundO18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg.dll File not foundO18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value foundO18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dll File not foundO18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dll File not foundO20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)O32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = ComFile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 30 Days ==========[2011/12/16 22:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware[2011/12/16 22:14:56 | 000,105,744 | ---- | C] (Trend Micro Inc.) -- C:\Windows\SysNative\drivers\tmtdi.sys[2011/12/16 22:12:10 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro[2011/12/16 20:41:28 | 000,000,000 | ---D | C] -- C:\Users\Garvin\AppData\Roaming\Malwarebytes[2011/12/16 20:41:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2011/12/16 20:41:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2011/12/16 20:29:40 | 009,851,496 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Garvin\Desktop\mbam-setup.exe[2011/12/15 21:59:34 | 000,000,000 | ---D | C] -- C:\Windows\system64[2011/12/15 21:04:09 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN[2011/12/15 20:50:26 | 000,000,000 | ---D | C] -- C:\Windows\temp[2011/12/15 19:37:50 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT[2011/12/15 18:55:27 | 000,000,000 | ---D | C] -- C:\Windows\Minidump[2011/12/15 13:28:03 | 114,751,872 | ---- | C] (Trend Micro Inc.) -- C:\Users\Garvin\Desktop\Ti_TIS_5.0_EN_Full.exe[2011/12/15 13:07:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Trend Micro[2011/12/15 13:05:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro[2011/12/15 13:00:18 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Interactive[2011/12/15 12:55:07 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\log[2011/12/15 10:27:44 | 000,000,000 | ---D | C] -- C:\Users\Garvin\Desktop\FakeAVRemover[2011/12/15 02:10:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP[2011/12/15 01:54:38 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools[2011/12/14 00:43:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes[2011/12/14 00:42:24 | 000,000,000 | ---D | C] -- C:\Program Files\iPod[2011/12/14 00:42:23 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes[2011/12/14 00:42:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes[2011/12/13 10:41:02 | 001,577,264 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Garvin\Desktop\TDSSKiller.exe[2011/11/21 20:49:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2011/12/17 20:58:01 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2011/12/17 20:03:35 | 001,577,264 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Garvin\Desktop\TDSSKiller.exe[2011/12/17 20:03:31 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2011/12/17 20:03:31 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2011/12/17 20:03:24 | 001,557,791 | ---- | M] () -- C:\Users\Garvin\Desktop\tdsskiller.zip[2011/12/17 20:02:49 | 000,744,852 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2011/12/17 20:02:49 | 000,637,946 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2011/12/17 20:02:49 | 000,111,000 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2011/12/17 19:56:21 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2011/12/17 19:56:18 | 000,000,841 | -HS- | M] () -- C:\Windows\SysWow64\mmf.sys[2011/12/17 19:56:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2011/12/17 19:56:06 | 3220,480,000 | -HS- | M] () -- C:\hiberfil.sys[2011/12/16 22:13:52 | 000,000,056 | ---- | M] () -- C:\Windows\SysNative\SupportTool.exe.bat[2011/12/16 21:59:26 | 000,105,744 | ---- | M] (Trend Micro Inc.) -- C:\Windows\SysNative\drivers\tmtdi.sys[2011/12/16 20:26:37 | 000,011,988 | -HS- | M] () -- C:\Users\Garvin\AppData\Local\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/16 20:26:37 | 000,011,988 | -HS- | M] () -- C:\ProgramData\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/16 20:19:14 | 009,851,496 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Garvin\Desktop\mbam-setup.exe[2011/12/16 20:15:56 | 001,008,141 | ---- | M] () -- C:\Users\Garvin\Desktop\iExplore.exe[2011/12/16 20:09:50 | 000,001,205 | ---- | M] () -- C:\Users\Garvin\Desktop\FixNCR.reg[2011/12/15 18:55:19 | 400,218,340 | ---- | M] () -- C:\Windows\MEMORY.DMP[2011/12/15 13:30:58 | 000,001,294 | -HS- | M] () -- C:\Users\Garvin\AppData\Local\122677m6s337x050g433o4kda1a3[2011/12/15 13:30:58 | 000,001,294 | -HS- | M] () -- C:\ProgramData\122677m6s337x050g433o4kda1a3[2011/12/15 13:28:16 | 114,751,872 | ---- | M] (Trend Micro Inc.) -- C:\Users\Garvin\Desktop\Ti_TIS_5.0_EN_Full.exe[2011/12/15 10:32:15 | 000,000,036 | ---- | M] () -- C:\Users\Garvin\AppData\Local\housecall.guid.cache[2011/12/15 10:17:14 | 000,002,600 | ---- | M] () -- C:\Users\Garvin\Desktop\exefix.reg[2011/12/15 09:56:26 | 000,019,228 | -HS- | M] () -- C:\Users\Garvin\AppData\Local\126502a2r002b012a847l1tla6l8[2011/12/15 09:56:26 | 000,019,228 | -HS- | M] () -- C:\ProgramData\126502a2r002b012a847l1tla6l8[2011/12/14 23:25:24 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfud.bin[2011/12/14 23:25:22 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfss.bin[2011/12/14 20:11:44 | 000,343,840 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2011/12/14 00:43:03 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk[2011/12/13 23:42:22 | 000,000,408 | ---- | M] () -- C:\ProgramData\rbuEIn2gaehyM9[2011/12/13 23:42:11 | 000,000,304 | ---- | M] () -- C:\ProgramData\~rbuEIn2gaehyM9[2011/12/13 23:42:11 | 000,000,216 | ---- | M] () -- C:\ProgramData\~rbuEIn2gaehyM9r[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]========== Files Created - No Company Name ==========[2011/12/17 20:03:24 | 001,557,791 | ---- | C] () -- C:\Users\Garvin\Desktop\tdsskiller.zip[2011/12/16 20:29:39 | 001,008,141 | ---- | C] () -- C:\Users\Garvin\Desktop\iExplore.exe[2011/12/16 20:28:09 | 000,001,205 | ---- | C] () -- C:\Users\Garvin\Desktop\FixNCR.reg[2011/12/15 21:58:28 | 000,011,988 | -HS- | C] () -- C:\Users\Garvin\AppData\Local\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/15 21:58:28 | 000,011,988 | -HS- | C] () -- C:\ProgramData\ltimdk3l3niw0wlr0vbc8n143a5b[2011/12/15 18:55:19 | 400,218,340 | ---- | C] () -- C:\Windows\MEMORY.DMP[2011/12/15 13:30:58 | 000,001,294 | -HS- | C] () -- C:\Users\Garvin\AppData\Local\122677m6s337x050g433o4kda1a3[2011/12/15 13:30:58 | 000,001,294 | -HS- | C] () -- C:\ProgramData\122677m6s337x050g433o4kda1a3[2011/12/15 13:08:19 | 000,000,056 | ---- | C] () -- C:\Windows\SysNative\SupportTool.exe.bat[2011/12/15 10:32:15 | 000,000,036 | ---- | C] () -- C:\Users\Garvin\AppData\Local\housecall.guid.cache[2011/12/15 10:25:28 | 000,002,600 | ---- | C] () -- C:\Users\Garvin\Desktop\exefix.reg[2011/12/14 23:19:37 | 000,019,228 | -HS- | C] () -- C:\Users\Garvin\AppData\Local\126502a2r002b012a847l1tla6l8[2011/12/14 23:19:37 | 000,019,228 | -HS- | C] () -- C:\ProgramData\126502a2r002b012a847l1tla6l8[2011/12/14 00:43:03 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk[2011/12/13 23:42:11 | 000,000,304 | ---- | C] () -- C:\ProgramData\~rbuEIn2gaehyM9[2011/12/13 23:42:11 | 000,000,216 | ---- | C] () -- C:\ProgramData\~rbuEIn2gaehyM9r[2011/12/13 23:41:54 | 000,000,408 | ---- | C] () -- C:\ProgramData\rbuEIn2gaehyM9[2011/08/03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe[2011/08/01 20:54:48 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat[2011/02/08 16:38:40 | 000,000,026 | -H-- | C] () -- C:\ProgramData\.811261211181235583101118113995[2011/02/05 09:34:28 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat[2010/10/02 21:03:32 | 000,000,841 | -HS- | C] () -- C:\Windows\SysWow64\mmf.sys[2010/10/02 21:03:31 | 000,048,640 | ---- | C] () -- C:\Windows\mmfs.dll[2010/10/02 21:03:31 | 000,002,560 | ---- | C] () -- C:\Windows\Runservice.exe[2010/07/13 20:32:15 | 000,218,464 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe[2010/07/13 20:32:13 | 000,075,064 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe[2010/07/13 20:32:12 | 002,444,656 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_apb.exe[2010/07/13 20:31:47 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini[2010/06/12 15:22:01 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat[2010/05/20 08:47:30 | 000,982,220 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin[2010/05/20 08:47:30 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin[2010/05/20 08:47:30 | 000,092,216 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin[2010/05/20 08:47:29 | 000,439,300 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin[2010/05/20 08:01:37 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL[2010/05/20 08:01:37 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL[2010/04/02 15:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat[2009/07/13 21:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat[2009/07/13 18:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT[2009/07/13 18:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat[2009/07/13 16:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin[2009/07/13 15:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 13:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2009/06/10 13:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat========== LOP Check ==========[2011/12/14 00:16:25 | 000,000,000 | ---D | M] -- C:\Users\Garvin\AppData\Roaming\Bioshock2[2011/02/08 16:38:43 | 000,000,000 | -H-D | M] -- C:\Users\Garvin\AppData\Roaming\Final Draft[2011/11/06 19:35:54 | 000,000,000 | -H-D | M] -- C:\Users\Garvin\AppData\Roaming\runic games[2011/12/14 00:12:25 | 000,000,000 | ---D | M] -- C:\Users\Garvin\AppData\Roaming\Sports Interactive[2010/11/27 20:04:16 | 000,000,000 | -H-D | M] -- C:\Users\Garvin\AppData\Roaming\Tropico 3[2011/10/26 20:44:24 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Alternate Data Streams ==========@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2< End of report > Link to post Share on other sites More sharing options...
berryski Posted December 18, 2011 Author ID:506128 Share Posted December 18, 2011 OTL Extras logfile created on: 12/17/2011 9:12:28 PM - Run 1OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Garvin\Downloads64bit- Professional (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 2.78 Gb Available Physical Memory | 69.57% Memory free8.00 Gb Paging File | 6.65 Gb Available in Paging File | 83.22% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.07 Gb Total Space | 251.22 Gb Free Space | 55.69% Space Free | Partition Type: NTFSComputer Name: GARVIN-PC | User Name: Garvin | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (SafeList) ==================== File Associations ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.).url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation).html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)[HKEY_USERS\S-1-5-21-3026362431-2087246934-3751454797-1001\SOFTWARE\Classes\<extension>].html [@ = htmlfile] -- Reg Error: Key error. File not found========== Shell Spawning ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 0"FirewallDisableNotify" = 0"AntiVirusDisableNotify" = 0"UpdatesDisableNotify" = 064bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirewallDisableNotify" = 0"AntiVirusDisableNotify" = 0"UpdatesDisableNotify" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]========== System Restore Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0========== Firewall Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"DisableNotifications" = 0"EnableFirewall" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"DisableNotifications" = 0"EnableFirewall" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"DisableNotifications" = 0"EnableFirewall" = 0========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]========== HKEY_LOCAL_MACHINE Uninstall List ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{26A24AE4-039D-4CA4-87B4-2F86416017FF}" = Java 6 Update 17 (64-bit)"{3C5E60F1-0821-4B07-97EA-84EB5A927CF6}" = MobileMe Control Panel"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 280.26"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 280.26"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 280.26"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 280.19"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.10.0514"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.4.28"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components"{D66F0C3C-24F2-4463-9E2F-4381E5C40A26}" = iTunes"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit"HDMI" = Intel® Graphics Media Accelerator Driver[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java 6 Update 30"{28FA3609-B6E2-4BCA-B089-F5122AC417C5}" = Belkin N Wireless USB Adapter Setup"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support"{351DE0AB-7787-4497-9A7A-4AA9E3A4E290}" = Dell Communications (Support Software)"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4EE9A620-46A0-4BCF-82AC-950D2BBED982}" = Belkin N Wireless USB Adapter Setup"{5454085C-840F-4070-8FAA-441000038301}" = BioShock 2"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail"{67635FB6-2F63-4FFB-830B-D4C01597EBA4}" = Microsoft Office Suite Activation Assistant"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime"{7C3C895B-AE02-4F30-8A6A-051D37A38DD0}" = Final Draft"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack"{9DE4E17F-0C99-4A57-8F7D-5B69CC95D7A9}" = NHL Eastside Hockey Manager 2007"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software"{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}" = Wizard101"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.2"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver"{F47C37A4-7189-430A-B81D-739FF8A7A554}" = Consumer In-Home Service Agreement"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022"Google Chrome" = Google Chrome"HOMESTUDENTR" = Microsoft Office Home and Student 2007"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300"Mozilla Firefox 8.0 (x86 en-US)" = Mozilla Firefox 8.0 (x86 en-US)"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver"PunkBusterSvc" = PunkBuster Services"Steam App 10500" = Empire: Total War"Steam App 108210" = Memoir '44 Online"Steam App 17470" = Dead Space"Steam App 19900" = Far Cry 2"Steam App 21690" = Resident Evil 5"Steam App 21980" = Call of Juarez: Bound in Blood"Steam App 23490" = Tropico 3 - Steam Special Edition"Steam App 35140" = Batman: Arkham Asylum GOTY Edition"Steam App 38830" = Crimecraft: BLEEDOUT "Steam App 42120" = Lead and Gold - Gangs of the Wild West"Steam App 42680" = Call of Duty: Modern Warfare 3"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer"Steam App 46290" = Theatre of War"Steam App 46340" = Theatre of War 2: Africa 1943"Steam App 46360" = Theatre of War 2: Kursk 1943 "Steam App 47780" = Dead Space 2"Steam App 57600" = Tropico 3: Absolute Power"Steam App 57650" = DUNGEONS - Steam Special Edition"Steam App 630" = Alien Swarm"Steam App 71270" = Football Manager 2012"Steam App 7830" = Men of War"Steam App 8930" = Sid Meier's Civilization V"WinLiveSuite_Wave3" = Windows Live Essentials========== Last 10 Event Log Errors ==========[ Application Events ]Error - 12/14/2011 3:40:42 AM | Computer Name = Garvin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. .Error - 12/14/2011 4:18:39 AM | Computer Name = Garvin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. .Error - 12/14/2011 4:32:07 AM | Computer Name = Garvin-PC | Source = ESENT | ID = 488Description = wlmail (5204) WindowsLiveMail0: An attempt to create the file "C:\Users\Garvin\AppData\Local\Microsoft\Windows Live Mail\Mail.pat" failed with system error 5 (0x00000005): "Access is denied. ". The create file operation will fail with error -1032 (0xfffffbf8).Error - 12/14/2011 4:32:07 AM | Computer Name = Garvin-PC | Source = ESENT | ID = 217Description = wlmail (5204) WindowsLiveMail0: Error (-1032) during backup of a database (file C:\Users\Garvin\AppData\Local\Microsoft\Windows Live Mail\Mail.MSMessageStore). The database will be unable to restore.Error - 12/14/2011 4:32:07 AM | Computer Name = Garvin-PC | Source = ESENT | ID = 215Description = wlmail (5204) WindowsLiveMail0: The backup has been stopped because it was halted by the client or the connection with the client failed.Error - 12/15/2011 12:12:43 AM | Computer Name = Garvin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. .Error - 12/15/2011 12:32:27 AM | Computer Name = Garvin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. .Error - 12/15/2011 6:05:58 AM | Computer Name = Garvin-PC | Source = Wininit | ID = 1015Description = A critical system process, C:\Windows\system32\lsm.exe, failed with status code 1. The machine must now be restarted.Error - 12/15/2011 6:06:10 AM | Computer Name = Garvin-PC | Source = Wininit | ID = 1015Description = A critical system process, C:\Windows\system32\lsass.exe, failed with status code 1. The machine must now be restarted.Error - 12/15/2011 6:06:37 AM | Computer Name = Garvin-PC | Source = Microsoft-Windows-CAPI2 | ID = 512Description = The Cryptographic Services service failed to initialize the VSS backup "System Writer" object. Details: Could not query the status of the EventSystem service.System Error: The remote procedure call failed. .[ System Events ]Error - 8/4/2011 9:07:49 PM | Computer Name = Garvin-PC | Source = VDS Basic Provider | ID = 33554433Description = Error - 8/4/2011 9:16:11 PM | Computer Name = Garvin-PC | Source = bowser | ID = 8003Description = Error - 8/4/2011 11:03:17 PM | Computer Name = Garvin-PC | Source = bowser | ID = 8003Description = Error - 8/6/2011 1:57:44 AM | Computer Name = Garvin-PC | Source = bowser | ID = 8003Description = Error - 8/6/2011 6:18:41 PM | Computer Name = Garvin-PC | Source = VDS Basic Provider | ID = 33554433Description = Error - 8/6/2011 6:18:41 PM | Computer Name = Garvin-PC | Source = VDS Basic Provider | ID = 33554433Description = Error - 8/7/2011 2:13:09 PM | Computer Name = Garvin-PC | Source = bowser | ID = 8003Description = Error - 8/9/2011 12:06:53 PM | Computer Name = Garvin-PC | Source = VDS Basic Provider | ID = 33554433Description = Error - 8/9/2011 12:06:53 PM | Computer Name = Garvin-PC | Source = VDS Basic Provider | ID = 33554433Description = Error - 8/9/2011 7:16:38 PM | Computer Name = Garvin-PC | Source = bowser | ID = 8003Description = < End of report > Link to post Share on other sites More sharing options...
berryski Posted December 18, 2011 Author ID:506165 Share Posted December 18, 2011 Additional note - my system is clearly still infected. It will disable Malwarebytes' protection and send the above error. Whoever made this virus should be in prison. Link to post Share on other sites More sharing options...
berryski Posted December 19, 2011 Author ID:506435 Share Posted December 19, 2011 Anyone with any ideas on how i can beat this? Link to post Share on other sites More sharing options...
Staff screen317 Posted December 19, 2011 Staff ID:506489 Share Posted December 19, 2011 Hi and welcome to Malwarebytes. Please update MBAM, run a Quick Scan, and post its log. Next, download DDS by sUBs and save it to your Desktop. Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply. Link to post Share on other sites More sharing options...
berryski Posted December 20, 2011 Author ID:506812 Share Posted December 20, 2011 MBAM First:Malwarebytes' Anti-Malware 1.51.2.1300www.malwarebytes.orgDatabase version: 8383Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.1638512/19/2011 4:56:34 PMmbam-log-2011-12-19 (16-56-34).txtScan type: Quick scanObjects scanned: 195133Time elapsed: 1 minute(s), 33 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 2Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\Windows\temp\uulpdq\setup.exe (Trojan.Downloader.BH) -> Quarantined and deleted successfully.c:\Windows\temp\_ex-68.exe (Trojan.Dropper) -> Quarantined and deleted successfully.I cleaned the selected files Link to post Share on other sites More sharing options...
berryski Posted December 20, 2011 Author ID:506813 Share Posted December 20, 2011 Next up - DDS.DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORKInternet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_30Run by Garvin at 17:00:01 on 2011-12-19Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.4095.2979 [GMT -8:00].AV: Trend Micro Internet Security *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}SP: Trend Micro Internet Security *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}FW: Trend Micro Personal Firewall *Enabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\Explorer.EXEC:\Windows\system32\ctfmon.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\REGSVR32.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.yahoo.com/mStart Page = about:blankBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dllBHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dlluRun: [steam] "c:\program files (x86)\steam\steam.exe" -silentmRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exemRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscriptuPolicies-explorer: HideSCAHealth = 1 (0x1)mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableLUA = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)mPolicies-system: PromptOnSecureDesktop = 0 (0x0)LSP: mswsock.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cabTCP: DhcpNameServer = 68.87.76.182 68.87.78.134TCP: Interfaces\{8F8A9854-E404-4FD5-906A-CC1187F4A887} : DhcpNameServer = 68.87.76.182 68.87.78.134Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLLHandler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1066\TmIEPlg32.dllBHO-X64: Trend Micro NSC BHO - No FileBHO-X64: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO-X64: SkypeIEPluginBHO - No FileBHO-X64: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.0.1081\7.0.1081\TmBpIe32.dllBHO-X64: TmBpIeBHO - No FileTB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllmRun-x64: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"mRun-x64: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exemRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscriptHosts: 66.197.194.231 www.google-analytics.com.Hosts: 66.197.194.231 ad-emea.doubleclick.net.Hosts: 66.197.194.231 www.statcounter.com.Hosts: 69.72.252.254 www.google-analytics.com.Hosts: 69.72.252.254 ad-emea.doubleclick.net..Note: multiple HOSTS entries found. Please refer to Attach.txt.================= FIREFOX ===================.FF - ProfilePath - C:\Users\Garvin\AppData\Roaming\Mozilla\Firefox\Profiles\519tvsst.default\FF - prefs.js: browser.startup.homepage - www.yahoo.comFF - prefs.js: network.proxy.type - 4FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dllFF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dllFF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll.---- FIREFOX POLICIES ----FF - user.js: yahoo.homepage.dontask - true.============= SERVICES / DRIVERS ===============.R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-5-20 92160]S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-2-5 136176]S2 LicCtrlService;LicCtrl Service;C:\Windows\Runservice.exe [2010-10-2 2560]S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-16 366152]S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-5-11 2255464]S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-5-5 206064]S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-8-3 379496]S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-2-5 136176]S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8192su.sys --> C:\Windows\system32\DRIVERS\RTL8192su.sys [?]S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]S4 0234541276116965mcinstcleanup;McAfee Application Installer Cleanup (0234541276116965);C:\Windows\TEMP\023454~1.EXE C:\PROGRA~2\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> C:\Windows\TEMP\023454~1.EXE C:\PROGRA~2\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]S4 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe --> C:\Program Files\Dell\DellDock\DockLogin.exe [?]S4 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-5-20 660800].=============== Created Last 30 ================.2011-12-19 10:11:45 -------- d-----w- C:\lN28300CfIkJ283002011-12-19 10:11:26 -------- d-----w- C:\ProgramData\nB28300HbLpO283002011-12-17 06:14:56 105744 ----a-w- C:\Windows\System32\drivers\tmtdi.sys2011-12-17 06:12:10 -------- d-----w- C:\Program Files\Trend Micro2011-12-17 04:41:28 -------- d-----w- C:\Users\Garvin\AppData\Roaming\Malwarebytes2011-12-17 04:41:19 -------- d-----w- C:\ProgramData\Malwarebytes2011-12-17 04:41:15 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2011-12-16 05:59:34 -------- d-----we C:\Windows\system642011-12-16 05:04:09 -------- d-sh--w- C:\$RECYCLE.BIN2011-12-15 21:08:19 56 ----a-w- C:\Windows\System32\SupportTool.exe.bat2011-12-15 21:07:04 -------- d-----w- C:\ProgramData\Trend Micro2011-12-15 21:05:22 -------- d-----w- C:\Program Files (x86)\Trend Micro2011-12-15 21:00:18 -------- d-----w- C:\Windows\System32\Interactive2011-12-15 20:55:07 -------- d-----w- C:\Windows\System32\log2011-12-15 09:54:38 -------- d-----w- C:\ProgramData\PC Tools2011-12-14 08:42:24 -------- d-----w- C:\Program Files\iPod2011-12-14 08:42:23 -------- d-----w- C:\Program Files\iTunes2011-12-14 08:42:23 -------- d-----w- C:\Program Files (x86)\iTunes2011-12-14 08:30:22 43520 ----a-w- C:\Windows\System32\csrsrv.dll2011-12-14 08:30:04 1197568 ----a-w- C:\Windows\System32\wininet.dll2011-12-14 08:30:02 981504 ----a-w- C:\Windows\SysWow64\wininet.dll2011-12-14 08:28:47 2048 ----a-w- C:\Windows\SysWow64\tzres.dll2011-12-14 08:28:47 2048 ----a-w- C:\Windows\System32\tzres.dll.==================== Find3M ====================.2011-12-20 00:34:56 841 --sha-w- C:\Windows\SysWow64\mmf.sys2011-12-17 05:53:58 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2011-11-24 05:00:47 3141632 ----a-w- C:\Windows\System32\win32k.sys2011-11-10 13:54:13 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll2011-11-05 05:23:10 57856 ----a-w- C:\Windows\System32\licmgr10.dll2011-11-05 04:34:15 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll2011-11-05 04:07:32 482816 ----a-w- C:\Windows\System32\html.iec2011-11-05 03:28:41 386048 ----a-w- C:\Windows\SysWow64\html.iec2011-11-05 03:25:44 1638912 ----a-w- C:\Windows\System32\mshtml.tlb2011-11-05 02:55:38 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb2011-10-24 21:29:02 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx2011-10-24 21:29:02 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts2011-10-15 06:25:12 723456 ----a-w- C:\Windows\System32\EncDec.dll2011-10-15 05:48:52 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll2011-09-29 16:24:44 1897328 ----a-w- C:\Windows\System32\drivers\tcpip.sys.============= FINISH: 17:10:05.88 =============== Link to post Share on other sites More sharing options...
Staff screen317 Posted December 24, 2011 Staff ID:509040 Share Posted December 24, 2011 Hi,Please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted February 22, 2012 Staff ID:529498 Share Posted February 22, 2012 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Staff screen317 Posted April 10, 2012 Staff ID:541529 Share Posted April 10, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts