Do I have Tab Virus?

aryama · March 14, 2013

Hi there, its Simi again.Facing this issue for last couple of days.

Mozilla Firefox is opening multiple tabs on its own.There is even problem with IE.Specially when I open Facebook and my mouse is over any link/pic..it opens up as a new tab,very irritating.A point comes when tabs keep closing on its own.I have run Malawarebytes Anti Rootkit Beta and it shows sometimes 'AppInit_Dll rootkit activity',scans the system but finds no malicious program.For a couple of minitues everything is fine,then again this tab virus appears.I have also run Malwarebytes Anti-Malware,it finds nothing.Presently system is getting hanged sometimes. I am attaching DDS.txt and Attach.txt logs.

DDS.txt

----------

aDDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 6.0.2900.2180

Run by abc at 23:35:19 on 2013-03-14

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3007.2369 [GMT 5.5:30]

.

AV: Kaspersky PURE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky PURE *Disabled*

.

============== Running Processes ================

.

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe

C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

.

============== Pseudo HJT Report ===============

.

uProxyOverride = <local>

BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll

BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - c:\program files\kaspersky lab\kaspersky pure\ievkbd.dll

BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - c:\program files\kaspersky lab\kaspersky pure\klwtbbho.dll

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [AVP] "c:\program files\kaspersky lab\kaspersky pure\avp.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:351

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky pure\ie_banner_deny.htm

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky pure\klwtbbho.dll

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky pure\klwtbbho.dll

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{2BC31B98-0C5C-4962-B48E-9B35E39C4A07} : DHCPNameServer = 192.168.1.1

Notify: klogon - c:\windows\system32\klogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\abc\application data\mozilla\firefox\profiles\fspdqyga.default\

FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll

.

============= SERVICES / DRIVERS ===============

.

R0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\drivers\CSCrySec.sys [2013-1-13 88632]

R0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]

R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\drivers\CSVirtualDiskDrv.sys [2013-1-13 39352]

R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]

R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2013-2-11 315408]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2012-7-12 116608]

R2 AVP;Kaspersky PURE;c:\program files\kaspersky lab\kaspersky pure\avp.exe [2010-10-1 348760]

R2 CSObjectsSrv;CryptoStorage control service;c:\program files\common files\infowatch\cryptostorage\ProtectedObjectsSrv.exe [2009-12-21 743992]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]

S2 liluavs;Security Task;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]

.

=============== Created Last 30 ================

.

2013-03-10 12:45:48 -------- d-----w- c:\windows\system32\RTCOM

2013-03-10 12:43:09 77824 ----a-w- c:\windows\SOUNDMAN.EXE

2013-03-10 12:43:09 290816 ----a-w- c:\windows\vncutil.exe

2013-03-10 12:43:08 1826816 ----a-w- c:\windows\SkyTel.exe

2013-03-10 12:43:06 266240 ----a-w- c:\windows\system32\RTSndMgr.CPL

2013-03-10 12:43:06 1200128 ----a-w- c:\windows\RtlUpd.exe

2013-03-10 12:43:06 104992 ----a-w- c:\windows\RtkAudioService.exe

2013-03-10 12:43:04 9715200 ----a-w- c:\windows\RTLCPL.EXE

2013-03-10 12:43:00 4959232 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys

2013-03-10 12:42:51 18063872 ----a-w- c:\windows\RTHDCPL.EXE

2013-03-10 12:42:44 1389056 ----a-w- c:\windows\system32\drivers\Monfilt.sys

2013-03-10 12:42:43 2168320 ----a-w- c:\windows\MicCal.exe

2013-03-10 12:42:40 57344 ----a-w- c:\windows\ALCMTR.EXE

2013-03-10 12:42:39 2808832 ----a-w- c:\windows\ALCWZRD.EXE

2013-03-10 12:42:36 1684736 ----a-w- c:\windows\system32\drivers\Ambfilt.sys

2013-03-10 12:42:35 278528 ----a-w- c:\windows\system32\ALSNDMGR.CPL

2013-03-10 12:42:35 -------- d-----w- c:\program files\Realtek

2013-03-10 12:42:30 528384 ------r- c:\windows\RtlExUpd.dll

2013-02-21 14:25:38 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL

2013-02-21 14:25:38 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX

2013-02-21 14:25:38 -------- d-----w- c:\program files\SpywareBlaster

2013-02-19 17:54:35 -------- d-----w- c:\documents and settings\all users.windows\application data\HitmanPro

2013-02-17 13:37:46 -------- d-----w- c:\documents and settings\abc\application data\SUPERAntiSpyware.com

2013-02-17 13:37:31 -------- d-----w- c:\program files\SUPERAntiSpyware

2013-02-17 13:37:31 -------- d-----w- c:\documents and settings\all users.windows\application data\SUPERAntiSpyware.com

2013-02-15 19:36:51 -------- d-----w- C:\found.000

.

==================== Find3M ====================

.

2013-03-12 19:38:18 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-12 19:38:18 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-03-10 12:41:37 16608 ----a-w- c:\windows\gdrv.sys

2012-12-15 00:49:28 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

.

============= FINISH: 23:35:36.34 ===============

Attach.txt

------------

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 1/13/2013 3:35:48 AM

System Uptime: 3/14/2013 10:02:26 PM (1 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | M61PME-S2P

Processor: AMD Athlon X2 240 Processor | Socket M2 | 2812/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 49 GiB total, 43.526 GiB free.

D: is FIXED (NTFS) - 49 GiB total, 7.944 GiB free.

E: is FIXED (NTFS) - 39 GiB total, 1.241 GiB free.

F: is FIXED (NTFS) - 29 GiB total, 3.174 GiB free.

G: is FIXED (NTFS) - 32 GiB total, 3.096 GiB free.

H: is FIXED (NTFS) - 26 GiB total, 0.426 GiB free.

I: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

µTorrent

Adobe Flash Player 11 Plugin

Adobe Reader 6.0.1

AMD Processor Driver

CPUID HWMonitor 1.21

High Definition Audio Driver Package - KB888111

Hotfix for Windows XP (KB926239)

K-Lite Codec Pack 3.3.0 Full

Kaspersky PURE

Mozilla Firefox 19.0.2 (x86 en-US)

NVIDIA Drivers

NWZ-B170 WALKMAN Guide

Realtek High Definition Audio Driver

SpywareBlaster 4.6

SUPERAntiSpyware

VLC media player 2.0.5

WebFldrs XP

Winamp

Winamp Detector Plug-in

Windows Media Format 11 runtime

WinRAR 4.20 (32-bit)

.

==== Event Viewer Messages From Past Week ========

.

3/9/2013 9:49:04 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ARIJIT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2BC31B98-0C5C-4962. The master browser is stopping or an election is being forced.

3/8/2013 10:22:22 PM, error: Dhcp [1002] - The IP address lease 192.168.1.60 for the Network Card with network address 00241D6D0484 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

3/14/2013 9:40:47 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdPPM CSVirtualDiskDrv Fips IPSec kl1 KLIF MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL Tcpip WS2IFSL

3/14/2013 9:40:47 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

3/14/2013 9:40:47 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.

3/14/2013 9:40:47 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

3/14/2013 9:40:47 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

3/14/2013 9:39:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

3/14/2013 12:13:25 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdPPM CSVirtualDiskDrv Fips kl1 KLIF SASDIFSV SASKUTIL

3/14/2013 12:12:12 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

3/13/2013 11:25:12 PM, error: Dhcp [1002] - The IP address lease 192.168.1.7 for the Network Card with network address 00241D6D0484 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

3/12/2013 12:07:09 AM, error: Service Control Manager [7023] - The Security Task service terminated with the following error: The system cannot find the file specified.

3/12/2013 10:40:31 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.

3/10/2013 12:19:19 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer PRIYAM-A87D0BA8 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{2BC31B98-0C5. The master browser is stopping or an election is being forced.

3/10/2013 1:32:07 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

.

==== End Of File ===========================

gringo_pr · March 14, 2013

Hello aryama

Welcome to The Forums!!

Around here they call me Gringo and I'll be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

aryama · March 15, 2013

Hi Gringo

Thanks for helping me out.Please find the logs below.As for my PC,the tabs keep opening up,redirecting me to other sites,Apart from this I found PC is getting stuck up at times,double click is not working sometimes,when opening Notepad,mouse cursor is changing.

The first time I ran Security Check,I hadn't saved the log,hence I ran it again and the log posted is from second run.

Rogue Killer Report

RogueKiller V8.5.3 [Mar 13 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version

Started in : Normal mode

User : abc [Admin rights]

Mode : Remove -- Date : 03/15/2013 22:30:09

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> DELETED

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED

[HJ] HKLM\[...]\SystemRestore : DisableSR (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1600BB-00GUC0 +++++

--- User ---

[MBR] f616b8dbde08688c24180a6d83ae8171

[bSP] 731f730ad18a8e99185a88ab168ed96b : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 49999 Mo

1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 102398310 | Size: 102618 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: ST3808110AS +++++

--- User ---

[MBR] 1800be6e1324a76910ff054c18cfd933

[bSP] c16417babe696a4950e60b8c1d8eceee : Windows XP MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 49999 Mo

1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 102398310 | Size: 26309 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[2]_D_03152013_02d2230.txt >>

RKreport[1]_S_03152013_02d2229.txt ; RKreport[2]_D_03152013_02d2230.txt

AdwCleaner

# AdwCleaner v2.114 - Logfile created 03/15/2013 at 22:24:13

# Updated 05/03/2013 by Xplode

# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)

# User : abc - ABC-3B1295B6860

# Boot Mode : Normal

# Running from : C:\Documents and Settings\abc\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3220468

***** [internet Browsers] *****

-\\ Internet Explorer v6.0.2900.2180

[OK] Registry is clean.

-\\ Mozilla Firefox v19.0.2 (en-US)

File : C:\Documents and Settings\abc\Application Data\Mozilla\Firefox\Profiles\fspdqyga.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [1042 octets] - [15/03/2013 22:24:13]

########## EOF - C:\AdwCleaner[s1].txt - [1102 octets] ##########

checkup.txt

Results of screen317's Security Check version 0.99.61

Windows XP Service Pack 2 x86

Out of date service pack!!

Internet Explorer 6 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

Kaspersky PURE

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

SpywareBlaster 4.6

SUPERAntiSpyware

Adobe Flash Player 11.6.602.180

Adobe Reader 6 Adobe Reader out of Date!

Mozilla Firefox (19.0.2)

````````Process Check: objlist.exe by Laurent````````

Kaspersky Lab Kaspersky PURE avp.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 3%

````````````````````End of Log``````````````````````

gringo_pr · March 15, 2013

Hello aryama

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

aryama · March 16, 2013

ComboFix 13-03-16.01 - abc 03/16/2013 16:08:28.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3007.2462 [GMT 5.5:30]

Running from: c:\documents and settings\abc\Desktop\ComboFix.exe

AV: Kaspersky PURE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky PURE *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users.WINDOWS\Application Data\TEMP

.

((((((((((((((((((((((((( Files Created from 2013-02-16 to 2013-03-16 )))))))))))))))))))))))))))))))

.

2013-03-10 12:45 . 2013-03-10 12:45 -------- d-----w- c:\windows\system32\RTCOM

2013-03-10 12:43 . 2008-10-01 06:29 290816 ----a-w- c:\windows\vncutil.exe

2013-03-10 12:43 . 2008-08-19 05:26 77824 ----a-w- c:\windows\SOUNDMAN.EXE

2013-03-10 12:43 . 2007-11-20 10:15 1826816 ----a-w- c:\windows\SkyTel.exe

2013-03-10 12:43 . 2008-09-19 09:48 1200128 ----a-w- c:\windows\RtlUpd.exe

2013-03-10 12:43 . 2008-06-24 06:46 104992 ----a-w- c:\windows\RtkAudioService.exe

2013-03-10 12:43 . 2008-03-13 06:52 266240 ----a-w- c:\windows\system32\RTSndMgr.CPL

2013-03-10 12:43 . 2008-06-19 08:27 9715200 ----a-w- c:\windows\RTLCPL.EXE

2013-03-10 12:43 . 2008-12-11 09:24 4959232 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys

2013-03-10 12:42 . 2008-12-09 06:23 18063872 ----a-w- c:\windows\RTHDCPL.EXE

2013-03-10 12:42 . 2006-01-04 07:41 1389056 ----a-w- c:\windows\system32\drivers\Monfilt.sys

2013-03-10 12:42 . 2008-09-30 08:38 2168320 ----a-w- c:\windows\MicCal.exe

2013-03-10 12:42 . 2008-06-19 08:20 57344 ----a-w- c:\windows\ALCMTR.EXE

2013-03-10 12:42 . 2008-06-19 08:42 2808832 ----a-w- c:\windows\ALCWZRD.EXE

2013-03-10 12:42 . 2008-08-05 12:10 1684736 ----a-w- c:\windows\system32\drivers\Ambfilt.sys

2013-03-10 12:42 . 2013-03-10 12:42 -------- d-----w- c:\program files\Realtek

2013-03-10 12:42 . 2008-06-19 08:24 278528 ----a-w- c:\windows\system32\ALSNDMGR.CPL

2013-03-10 12:42 . 2008-08-25 08:17 528384 ------r- c:\windows\RtlExUpd.dll

2013-02-21 14:25 . 2013-02-21 14:37 -------- d-----w- c:\program files\SpywareBlaster

2013-02-21 14:25 . 2010-01-10 13:10 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL

2013-02-21 14:25 . 2010-01-10 13:10 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX

2013-02-19 17:54 . 2013-02-19 18:06 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\HitmanPro

2013-02-17 13:37 . 2013-02-17 13:37 -------- d-----w- c:\documents and settings\abc\Application Data\SUPERAntiSpyware.com

2013-02-17 13:37 . 2013-02-17 13:37 -------- d-----w- c:\program files\SUPERAntiSpyware

2013-02-17 13:37 . 2013-02-17 13:37 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com

2013-02-15 19:36 . 2013-02-15 19:36 -------- d-----w- C:\found.000

2013-02-14 20:37 . 2013-02-14 20:37 -------- d-----w- c:\documents and settings\abc\Application Data\Media Player Classic

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-12 19:38 . 2013-01-13 09:32 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-12 19:38 . 2013-01-13 09:32 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-03-10 12:41 . 2013-01-12 22:36 16608 ----a-w- c:\windows\gdrv.sys

2013-03-09 08:15 . 2013-03-09 08:14 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]

@="{dd230880-495a-11d1-b064-008048ec2fc5}"

[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]

2010-10-01 16:35 129624 ----a-w- c:\program files\Kaspersky Lab\Kaspersky PURE\shellex.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 4763008]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]

"nwiz"="nwiz.exe" [2006-10-31 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky PURE\avp.exe" [2010-10-01 348760]

"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"2946:TCP"= 2946:TCP:mauomnix

.

R0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\drivers\CSCrySec.sys [1/13/2013 3:59 AM 88632]

R0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [10/14/2009 9:18 PM 36880]

R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\drivers\CSVirtualDiskDrv.sys [1/13/2013 3:59 AM 39352]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 9:57 PM 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/13/2011 3:25 AM 67664]

R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/12/2012 12:24 AM 116608]

R2 CSObjectsSrv;CryptoStorage control service;c:\program files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [12/21/2009 5:34 PM 743992]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [9/14/2009 2:42 PM 32272]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [10/2/2009 7:39 PM 19472]

S2 liluavs;Security Task;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 12:56 AM 14336]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - cpuz136

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

liluavs

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-16 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-13 19:38]

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = <local>

IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm

FF - ProfilePath - c:\documents and settings\abc\Application Data\Mozilla\Firefox\Profiles\fspdqyga.default\

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-03-16 16:11

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3188)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2013-03-16 16:13:34

ComboFix-quarantined-files.txt 2013-03-16 10:43

.

Pre-Run: 46,641,909,760 bytes free

Post-Run: 46,723,284,992 bytes free

.

- - End Of File - - E10358F57DDEBC07FD8BE3D5CA46C4AD

Computer getting hanged sometimes now,tabs opening is not frequent but sometimes it is still there.

gringo_pr · March 16, 2013

Hello MarviaJones

I would like you to try and run these next.

TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it
If the forum still complains about it being to long send me everything that is at the end of the report after where it says
==================
Scan finished
==================

and I will see if I want to see the whole report

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit

2.Unzip the contents to a folder in a convenient location.

3.Open the folder where the contents were unzipped and run mbar.exe

4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6.Wait while the system shuts down and the cleanup process is performed.

7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

•Internet access
•Windows Update
•Windows Firewall

9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.

10.Verify that your system is now functioning normally.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and MBAR

Gringo

aryama · March 17, 2013

mbar log

Malwarebytes Anti-Rootkit BETA 1.01.0.1021

www.malwarebytes.org

Database version: v2013.03.17.07

Windows XP Service Pack 2 x86 NTFS

Internet Explorer 6.0.2900.2180

abc :: ABC-3B1295B6860 [administrator]

3/17/2013 7:32:11 PM

mbar-log-2013-03-17 (19-32-11).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 25400

Time elapsed: 4 minute(s), 32 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

aryama · March 17, 2013

Problem of opening of tabs persists.After scanning with mbar it stops for an hour then again recurs.Tabs keep on opening and closing on its own.

TDSSKiller.2.8.16.0_17.03.2013_13.11.37_log.txt

gringo_pr · March 17, 2013

Hello aryama

I want you to reset firefox back to defaults, this will remove everything from Firefox

I will let you keep your bookmarks so to do that you can go here - Export BookMarks

Now to reset firefox do the following.

At the top of the Firefox window, click the "Firefox" button,
go over to the "Help" sub-menu
- (on Windows XP, click the Help menu at the top of the Firefox window) and select "Troubleshooting Information".

[*]Click the "Reset Firefox" button in the upper-right corner of the Troubleshooting Information page.

[*]click "Reset Firefox" in the confirmation window that opens.

[*]Firefox will close and be reset. When it's done. Click "Finish" and Firefox will open.

restart the computer and check firefox for me now

Gringo

aryama · March 17, 2013

Hi Gringo

I did as you said,all was fine except the mouse icon is changing on its own on Firefox. Then as soon as I logged into Facebook nd clicked on 'Notifiction' icon, tabs kept opening up on its own.

gringo_pr · March 17, 2013

Hello

"all was fine except the mouse icon is changing on its own on Firefox" - I don't understand what you mean by this "mouse icon"

"Then as soon as I logged into Facebook nd clicked on 'Notifiction' icon, tabs kept opening up on its own. " - this is the only time this happens?

aryama · March 17, 2013

By Mouse Icon I meant the cursor,it keeps on changing.

When I posted the last statement tabs were opening only on Facebook but now it has started with other sites as well.

gringo_pr · March 17, 2013

Hello aryama

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

When you are complete please send me both reports

Gringo

aryama · March 17, 2013

aswMBR Log

Run date: 2013-03-18 02:16:13

-----------------------------

02:16:13.875 OS Version: Windows 5.1.2600 Service Pack 2

02:16:13.875 Number of processors: 2 586 0x602

02:16:13.875 ComputerName: ABC-3B1295B6860 UserName: abc

02:16:14.546 Initialize success

02:18:32.734 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3

02:18:32.734 Disk 0 Vendor: WDC_WD1600BB-00GUC0 08.02D08 Size: 152626MB BusType: 3

02:18:32.734 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000062

02:18:32.734 Disk 1 Vendor: ST3808110AS 3.AAE Size: 76319MB BusType: 3

02:18:32.765 Disk 0 MBR read successfully

02:18:32.765 Disk 0 MBR scan

02:18:32.765 Disk 0 Windows XP default MBR code

02:18:32.765 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 49999 MB offset 63

02:18:32.765 Disk 0 Partition - 00 0F Extended LBA 102618 MB offset 102398310

02:18:32.843 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 39997 MB offset 102398373

02:18:32.843 Disk 0 Partition - 00 05 Extended 29996 MB offset 184313745

02:18:32.890 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 29996 MB offset 184313808

02:18:32.890 Disk 0 Partition - 00 05 Extended 32624 MB offset 327661740

02:18:33.000 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 32624 MB offset 245746368

02:18:33.046 Disk 0 scanning sectors +312560640

02:18:33.234 Disk 0 scanning C:\WINDOWS\system32\drivers

02:18:45.031 Service scanning

02:18:55.437 Modules scanning

02:20:35.765 Disk 0 trace - called modules:

02:20:35.781 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS

02:20:35.781 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a331ab8]

02:20:35.781 3 CLASSPNP.SYS[ba8a905b] -> nt!IofCallDriver -> \Device\00000060[0x8a4503b8]

02:20:35.781 5 ACPI.sys[ba757620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-3[0x8a3f0940]

02:20:35.781 Scan finished successfully

02:26:28.359 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\abc\Desktop\MBR.dat"

02:26:28.359 The log file has been saved successfully to "C:\Documents and Settings\abc\Desktop\aswMBR.txt"

aryama · March 17, 2013

JRT Log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.7.2 (03.15.2013:1)

OS: Microsoft Windows XP x86

Ran by abc on Mon 03/18/2013 at 2:07:41.10

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 03/18/2013 at 2:15:38.84

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

gringo_pr · March 17, 2013

Hello aryama

Lets get a deeper look into the system and lets see if something shows up.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.

Double click on OTL.exe to run it.
Under Output, ensure that Minimal Output is selected.
Under Extra Registry section, select Use SafeList.
Click the Scan All Users checkbox.
Click on Run Scan at the top left hand corner.
When done, two Notepad files will open.
- OTL.txt <-- Will be opened and the that I need posted back here
- Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
[*]Please post the contents of OTL.txt in your next reply.

Gringo

aryama · March 18, 2013

OTL Log

OTL logfile created on: 3/18/2013 11:33:46 PM - Run 2

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\abc\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.94 Gb Total Physical Memory | 2.35 Gb Available Physical Memory | 79.91% Memory free

4.19 Gb Paging File | 3.49 Gb Available in Paging File | 83.44% Paging File free

Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 48.83 Gb Total Space | 43.73 Gb Free Space | 89.57% Space Free | Partition Type: NTFS

Drive D: | 48.83 Gb Total Space | 7.94 Gb Free Space | 16.27% Space Free | Partition Type: NTFS

Drive E: | 39.06 Gb Total Space | 1.25 Gb Free Space | 3.19% Space Free | Partition Type: NTFS

Drive F: | 29.29 Gb Total Space | 3.17 Gb Free Space | 10.84% Space Free | Partition Type: NTFS

Drive G: | 31.86 Gb Total Space | 3.10 Gb Free Space | 9.72% Space Free | Partition Type: NTFS

Drive H: | 25.69 Gb Total Space | 0.43 Gb Free Space | 1.66% Space Free | Partition Type: NTFS

Computer Name: ABC-3B1295B6860 | User Name: abc | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\abc\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

PRC - C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

PRC - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe (Kaspersky Lab)

PRC - C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe (Infowatch)

PRC - C:\WINDOWS\system32\spider.exe (Microsoft Corporation)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()

MOD - C:\Program Files\Kaspersky Lab\Kaspersky PURE\QtGui4.dll ()

MOD - C:\Program Files\Kaspersky Lab\Kaspersky PURE\QtCore4.dll ()

MOD - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avzkrnl.dll ()

MOD - C:\Program Files\Kaspersky Lab\Kaspersky PURE\localization_manager.dll ()

MOD - C:\Program Files\Kaspersky Lab\Kaspersky PURE\imageformats\qgif4.dll ()

MOD - C:\Program Files\Kaspersky Lab\Kaspersky PURE\dblite.dll ()

MOD - C:\WINDOWS\system32\nvshell.dll ()

MOD - C:\WINDOWS\system32\nvapi.dll ()

MOD - C:\WINDOWS\system32\msdmo.dll ()

========== Services (SafeList) ==========

SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)

SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe (Kaspersky Lab)

SRV - (CSObjectsSrv) -- C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe (Infowatch)

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found

DRV - (PDRFRAME) -- File not found

DRV - (PDRELI) -- File not found

DRV - (PDFRAME) -- File not found

DRV - (PDCOMP) -- File not found

DRV - (PCIDump) -- File not found

DRV - (lbrtfdc) -- File not found

DRV - (i2omgmt) -- File not found

DRV - (Changer) -- File not found

DRV - (catchme) -- C:\DOCUME~1\abc\LOCALS~1\Temp\catchme.sys File not found

DRV - (gdrv) -- C:\WINDOWS\gdrv.sys (Windows ® 2000 DDK provider)

DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)

DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (CSCrySec) -- C:\WINDOWS\system32\drivers\CSCrySec.sys (Infowatch)

DRV - (CSVirtualDiskDrv) -- C:\WINDOWS\system32\drivers\CSVirtualDiskDrv.sys (Infowatch)

DRV - (KLBG) -- C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)

DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)

DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)

DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)

DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)

DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)

DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)

DRV - (nvata) -- C:\WINDOWS\system32\drivers\nvata.sys (NVIDIA Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-776561741-220523388-1801674531-1003\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-776561741-220523388-1801674531-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-776561741-220523388-1801674531-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-776561741-220523388-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/03/09 13:45:02 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/03/09 13:44:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky PURE\THBExt [2013/02/11 22:17:55 | 000,000,000 | ---D | M]

[2013/01/20 22:44:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\abc\Application Data\Mozilla\Extensions

[2013/03/09 13:44:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2013/03/09 13:44:49 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru

[2013/03/09 13:45:02 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012/06/28 21:12:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

[2013/01/17 01:40:30 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2013/02/20 14:01:11 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/02/17 18:53:25 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ievkbd.dll (Kaspersky Lab)

O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab)

O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe (Kaspersky Lab)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKU\S-1-5-21-776561741-220523388-1801674531-1003..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-776561741-220523388-1801674531-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-776561741-220523388-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-776561741-220523388-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-776561741-220523388-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm ()

O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab)

O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{283623E3-FE97-4B66-8A18-D86E4F615C25}: NameServer = 203.147.91.2 203.147.88.2

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BC31B98-0C5C-4962-B48E-9B35E39C4A07}: DhcpNameServer = 192.168.1.1

O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky PURE\kloehk.dll (Kaspersky Lab)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)

O24 - Desktop WallPaper: C:\Documents and Settings\abc\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\abc\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2013/01/13 03:33:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/03/18 23:26:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\abc\Desktop\OTL.exe

[2013/03/18 02:07:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT

[2013/03/18 02:07:22 | 000,000,000 | ---D | C] -- C:\JRT

[2013/03/18 00:44:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Desktop\Old Firefox Data

[2013/03/17 18:48:23 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2013/03/17 13:08:06 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\abc\Desktop\tdsskiller.exe

[2013/03/16 16:13:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2013/03/16 16:06:46 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2013/03/16 16:06:46 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2013/03/16 16:06:46 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2013/03/16 16:06:46 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2013/03/16 16:06:19 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013/03/16 16:05:24 | 005,039,994 | R--- | C] (Swearware) -- C:\Documents and Settings\abc\Desktop\ComboFix.exe

[2013/03/15 22:27:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Desktop\RK_Quarantine

[2013/03/10 18:15:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM

[2013/03/10 18:13:09 | 000,290,816 | ---- | C] (Realtek Semiconductor Crop.) -- C:\WINDOWS\vncutil.exe

[2013/03/10 18:13:09 | 000,077,824 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

[2013/03/10 18:13:06 | 001,200,128 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RtlUpd.exe

[2013/03/10 18:13:06 | 000,266,240 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\RTSndMgr.CPL

[2013/03/10 18:13:06 | 000,104,992 | ---- | C] (Realtek Semiconductor) -- C:\WINDOWS\RtkAudioService.exe

[2013/03/10 18:13:04 | 009,715,200 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTLCPL.EXE

[2013/03/10 18:13:00 | 004,959,232 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys

[2013/03/10 18:12:44 | 001,389,056 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\Monfilt.sys

[2013/03/10 18:12:43 | 002,168,320 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\MicCal.exe

[2013/03/10 18:12:40 | 000,057,344 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCMTR.EXE

[2013/03/10 18:12:39 | 002,808,832 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE

[2013/03/10 18:12:36 | 001,684,736 | ---- | C] (Creative) -- C:\WINDOWS\System32\drivers\Ambfilt.sys

[2013/03/10 18:12:35 | 000,278,528 | ---- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\ALSNDMGR.CPL

[2013/03/10 18:12:35 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek

[2013/03/10 18:12:30 | 000,528,384 | R--- | C] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RtlExUpd.dll

[2013/03/09 13:44:49 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2013/02/21 19:55:38 | 001,071,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSCOMCTL.OCX

[2013/02/21 19:55:38 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSSTDFMT.DLL

[2013/02/21 19:55:38 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster

[2013/02/21 19:55:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SpywareBlaster

[2013/02/19 23:24:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\HitmanPro

[2013/02/17 19:07:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\abc\Application Data\SUPERAntiSpyware.com

[2013/02/17 19:07:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SUPERAntiSpyware

[2013/02/17 19:07:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com

[2013/02/17 19:07:31 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

========== Files - Modified Within 30 Days ==========

[2013/03/18 23:26:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\abc\Desktop\OTL.exe

[2013/03/18 23:14:07 | 000,081,496 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2013/03/18 23:13:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2013/03/18 23:13:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2013/03/18 02:26:28 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\MBR.dat

[2013/03/18 01:58:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2013/03/18 01:09:08 | 007,599,723 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\05 - Agneepath - Abhi Mujh Mein Kahin [www.DJMaza.Com].mp3

[2013/03/18 00:43:52 | 000,009,043 | ---- | M] () -- C:\Documents and Settings\abc\My Documents\bookmarks.html

[2013/03/17 22:20:10 | 004,040,902 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\DesiWEB.net_(Manja).mp3

[2013/03/17 19:49:33 | 013,106,137 | ---- | M] () -- C:\Documents and Settings\abc\My Documents\mbar-1.01.0.1021(1).zip

[2013/03/17 10:29:30 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\abc\Desktop\tdsskiller.exe

[2013/03/16 12:26:34 | 005,039,994 | R--- | M] (Swearware) -- C:\Documents and Settings\abc\Desktop\ComboFix.exe

[2013/03/15 21:57:52 | 000,815,616 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\RogueKiller.exe

[2013/03/15 21:57:42 | 000,597,667 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\adwcleaner.exe

[2013/03/15 21:57:35 | 000,890,798 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\SecurityCheck.exe

[2013/03/13 01:08:18 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2013/03/13 01:08:18 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2013/03/12 00:40:06 | 000,018,944 | ---- | M] () -- C:\Documents and Settings\abc\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/03/10 18:11:37 | 000,016,608 | ---- | M] (Windows ® 2000 DDK provider) -- C:\WINDOWS\gdrv.sys

[2013/03/03 14:41:08 | 005,113,729 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\[songs.PK] Kai Po Che - 03 - Meethi Boliyaan.mp3

[2013/03/03 14:33:34 | 004,253,703 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\[songs.PK] Kai Po Che - 02 - Shubhaarambh.mp3

[2013/02/21 23:39:12 | 000,096,864 | ---- | M] () -- C:\Documents and Settings\abc\Desktop\269285_499006583476182_374393897_n.jpg

[2013/02/21 19:47:42 | 000,090,296 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2013/02/19 06:24:52 | 000,000,154 | ---- | M] () -- C:\KasperskyRescueDisk10

[2013/02/17 19:07:35 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\SUPERAntiSpyware Free Edition.lnk

[2013/02/17 18:53:25 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

========== Files Created - No Company Name ==========

[2013/03/18 02:26:28 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\MBR.dat

[2013/03/18 01:05:57 | 007,599,723 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\05 - Agneepath - Abhi Mujh Mein Kahin [www.DJMaza.Com].mp3

[2013/03/18 00:43:52 | 000,009,043 | ---- | C] () -- C:\Documents and Settings\abc\My Documents\bookmarks.html

[2013/03/17 22:18:36 | 004,040,902 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\DesiWEB.net_(Manja).mp3

[2013/03/17 18:48:26 | 013,106,137 | ---- | C] () -- C:\Documents and Settings\abc\My Documents\mbar-1.01.0.1021(1).zip

[2013/03/16 16:06:46 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2013/03/16 16:06:46 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2013/03/16 16:06:46 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2013/03/16 16:06:46 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2013/03/16 16:06:46 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2013/03/15 21:58:06 | 000,890,798 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\SecurityCheck.exe

[2013/03/15 21:58:06 | 000,815,616 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\RogueKiller.exe

[2013/03/15 21:58:06 | 000,597,667 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\adwcleaner.exe

[2013/03/10 18:13:12 | 000,000,553 | R--- | C] () -- C:\WINDOWS\USetup.iss

[2013/03/03 14:18:08 | 005,113,729 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\[songs.PK] Kai Po Che - 03 - Meethi Boliyaan.mp3

[2013/03/03 14:17:48 | 004,253,703 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\[songs.PK] Kai Po Che - 02 - Shubhaarambh.mp3

[2013/02/21 23:39:11 | 000,096,864 | ---- | C] () -- C:\Documents and Settings\abc\Desktop\269285_499006583476182_374393897_n.jpg

[2013/02/19 06:24:52 | 000,000,154 | ---- | C] () -- C:\KasperskyRescueDisk10

[2013/02/17 19:07:35 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\SUPERAntiSpyware Free Edition.lnk

[2013/02/12 21:41:32 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2013/02/12 21:41:31 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2013/02/12 21:41:31 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2013/02/12 21:41:30 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2013/02/12 21:41:30 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2013/02/11 22:20:28 | 000,116,189 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat

[2013/02/11 22:20:28 | 000,098,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat

[2013/01/21 02:23:03 | 000,000,005 | ---- | C] () -- C:\Documents and Settings\abc\Application Data\mbam.context.scan

[2013/01/13 04:07:02 | 000,001,732 | ---- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin

[2013/01/13 03:35:51 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2013/01/13 03:30:51 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2013/01/12 19:24:26 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2013/01/12 19:23:20 | 000,090,296 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2013/01/12 16:24:07 | 000,018,944 | ---- | C] () -- C:\Documents and Settings\abc\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2004/08/04 00:56:46 | 001,483,264 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2004/08/04 00:56:44 | 000,472,064 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2004/08/04 00:56:48 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

< End of report >

Extras.txt

OTL Extras logfile created on: 3/18/2013 11:33:46 PM - Run 2