Infected with mixidj V8

gulfstream2013 · April 15, 2013

DDS Notepad and Attach Notepad copied below as instructed:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2

Run by Clare Colthup at 10:08:55 on 2013-04-15

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1534.726 [GMT -4:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Antivirus *Disabled*

FW: Trend Micro Firewall Booster *Disabled*

.

============== Running Processes ================

.

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre7\bin\jqs.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.claresworld.us/

uSearch Bar = hxxp://www.bing.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mStart Page = hxxp://www.claresworld.us

uProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe

mRun: [statusClient] c:\program files\hewlett-packard\toolbox2.0\apache tomcat 4.0\webapps\toolbox\statusclient\StatusClient.exe /auto

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

uPolicies-Explorer: NoDriveTypeAutoRun = dword:221

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: &Search - http://tbedits.videodownloadconverter.com/one-toolbaredits/menusearch.jhtml?s=205320000&p2=^HJ^xdm017^YY^us&si=pconverter&a=9BB61B67-7936-48B6-9827-039A2621A2DC&n=2013041413&cv=2

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 192.168.254.254

TCP: Interfaces\{FA1DC0A0-681F-42D6-A7E9-CCF8B4727FD2} : DHCPNameServer = 192.168.254.254

Notify: igfxcui - igfxsrvc.dll

Notify: LMIinit - LMIinit.dll

AppInit_DLLs= c:\docume~1\alluse~1\applic~1\browse~1\25986~1.67\{c16c1~1\browse~1.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\25.0.1364.172\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

.

============= SERVICES / DRIVERS ===============

.

R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-3-18 49248]

R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2012-10-12 20624]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-6-6 765736]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-6-6 368176]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-6-6 29816]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-3-18 66336]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-6-6 45248]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-9-29 374704]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2011-9-16 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2012-12-19 47640]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-12-14 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-12-14 701512]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 22856]

S0 Lbd;Lbd; [x]

S3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-3-18 164736]

S3 esgiguard;esgiguard; [x]

S3 Lavasoft Kernexplorer;Lavasoft helper driver; [x]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== File Associations ===============

.

ShellExec: FRONTPG.EXE: edit=c:\progra~1\micros~4\office\FRONTPG.EXE

ShellExec: switch.exe: open="c:\program files\nch software\switch\switch" "%L"

.

=============== Created Last 30 ================

.

2013-04-14 22:21:09 -------- dc----w- c:\documents and settings\clare colthup\application data\Xilisoft

2013-04-14 21:16:12 -------- dc----w- c:\program files\Conduit

2013-04-14 21:13:16 -------- dc----w- c:\documents and settings\clare colthup\local settings\application data\CRE

2013-04-14 20:46:10 -------- dc----w- C:\Multimedia Files

2013-04-14 20:45:48 -------- dc----w- c:\program files\Microsoft Image Composer

2013-04-14 17:51:46 -------- dc----w- c:\documents and settings\clare colthup\local settings\application data\IAC

2013-04-14 16:20:09 26840 -c--a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2013-04-14 16:19:00 -------- dc----w- c:\program files\iPod

2013-04-14 16:18:51 -------- dc----w- c:\documents and settings\all users\application data\188F1432-103A-4ffb-80F1-36B633C5C9E1

2013-04-14 16:18:50 -------- dc----w- c:\program files\iTunes

2013-04-14 16:17:43 6112864 -c--a-w- c:\windows\system32\usbaaplrc.dll

2013-04-14 16:17:43 45056 -c--a-w- c:\windows\system32\drivers\usbaapl.sys

2013-04-13 19:00:52 -------- dc----w- c:\documents and settings\clare colthup\local settings\application data\Apple Computer

2013-04-13 18:57:47 -------- dc----w- c:\documents and settings\clare colthup\local settings\application data\Apple

2013-04-13 18:56:09 -------- dc----w- c:\program files\Bonjour

2013-04-13 18:14:24 -------- dc----w- c:\program files\NCH Software

2013-04-13 18:14:21 -------- dc----w- c:\documents and settings\clare colthup\application data\NCH Software

2013-04-11 11:57:08 -------- dc----w- c:\program files\Microsoft Games

2013-04-10 14:41:36 -------- dc----w- c:\documents and settings\clare colthup\application data\FixCleaner

2013-03-29 15:55:34 -------- dc----w- c:\documents and settings\clare colthup\application data\1&1

2013-03-18 15:52:03 164736 -c--a-w- c:\windows\system32\drivers\aswVmm.sys

2013-03-18 15:52:01 49248 -c--a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-03-18 15:52:00 66336 -c--a-w- c:\windows\system32\drivers\aswMonFlt.sys

.

==================== Find3M ====================

.

2013-04-11 20:59:00 71048 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-11 20:59:00 691592 -c--a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-04 18:50:32 22856 -c--a-w- c:\windows\system32\drivers\mbam.sys

2013-03-08 08:36:22 293376 -c--a-w- c:\windows\system32\winsrv.dll

2013-03-07 01:28:24 2193408 -c--a-w- c:\windows\system32\ntoskrnl.exe

2013-03-07 00:50:28 2070016 -c--a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-06 22:33:24 765736 -c--a-w- c:\windows\system32\drivers\aswSnx.sys

2013-03-06 22:32:51 41664 -c--a-w- c:\windows\avastSS.scr

2013-03-02 02:06:31 916480 -c--a-w- c:\windows\system32\wininet.dll

2013-03-02 02:06:30 43520 -c----w- c:\windows\system32\licmgr10.dll

2013-03-02 02:06:30 1469440 -c----w- c:\windows\system32\inetcpl.cpl

2013-03-02 01:25:02 1867264 -c--a-w- c:\windows\system32\win32k.sys

2013-03-02 01:08:47 385024 -c----w- c:\windows\system32\html.iec

2013-02-27 07:56:51 2067456 -c--a-w- c:\windows\system32\mstscax.dll

2013-02-12 00:32:23 12928 -c--a-w- c:\windows\system32\drivers\usb8023.sys

2013-02-12 00:32:23 12928 -c----w- c:\windows\system32\drivers\usb8023x.sys

2013-01-26 03:55:44 552448 -c--a-w- c:\windows\system32\oleaut32.dll

2013-01-15 09:27:04 2174976 -c--a-w- c:\program files\common files\atimpenc.dll

.

============= FINISH: 10:10:37.07 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 3/11/2004 7:47:29 PM

System Uptime: 4/14/2013 5:31:00 PM (17 hours ago)

.

Motherboard: Dell Computer Corp. | | 0G1548

Processor: Intel® Celeron® CPU 2.40GHz | Microprocessor | 2393/400mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 74 GiB total, 53.837 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is Removable

G: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: ROOT\LEGACY_SASKUTIL\0000

Manufacturer:

Name:

PNP Device ID: ROOT\LEGACY_SASKUTIL\0000

Service:

.

==== System Restore Points ===================

.

RP1438: 1/4/2013 3:00:19 AM - Software Distribution Service 3.0

RP1439: 2/17/2013 3:00:56 AM - Software Distribution Service 3.0

RP1440: 3/13/2013 3:00:34 AM - Software Distribution Service 3.0

RP1441: 3/22/2013 3:00:19 AM - Software Distribution Service 3.0

RP1442: 4/9/2013 8:54:07 PM - Software Distribution Service 3.0

RP1443: 4/10/2013 11:14:09 AM - Removed FixCleaner

RP1444: 4/10/2013 11:26:26 AM - Created by Wise Care 365

RP1445: 4/11/2013 9:42:26 AM - Software Distribution Service 3.0

RP1446: 4/12/2013 3:20:19 PM - Installed Microsoft FrontPage 2000

RP1447: 4/13/2013 2:58:15 PM - Installed iTunes

RP1448: 4/13/2013 5:44:51 PM - Installed QuickTime

RP1449: 4/14/2013 7:51:55 AM - Removed QuickTime

RP1450: 4/14/2013 7:56:40 AM - Removed Apple Application Support

RP1451: 4/14/2013 8:05:12 AM - Removed Apple Mobile Device Support

RP1452: 4/14/2013 8:53:31 AM - Removed iTunes

RP1453: 4/14/2013 12:18:24 PM - Installed iTunes

RP1454: 4/14/2013 5:35:49 PM - Removed Modem Helper

.

==== Installed Programs ======================

.

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader XI (11.0.02)

Adobe Shockwave Player 11.6

Apple Application Support

Apple Mobile Device Support

Apple Software Update

avast! Free Antivirus

AVG 2011

Banctec Service Agreement

BCM V.92 56K Modem

Bonjour

Broadcom Management Programs

CCleaner

Compatibility Pack for the 2007 Office system

Defraggler

Dell Digital Jukebox Driver

Dell Networking Guide

Dell Support

EarthLink MDAC

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

Google Updater

Help and Support Customization

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2756822)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB954550-v5)

hp LaserJet 1010 Series

Intel® Extreme Graphics Driver

Internet Explorer Default Page

iTunes

Java 7 Update 9

Java Auto Updater

LogMeIn

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Age of Empires II

Microsoft Age of Empires II: The Conquerors Expansion

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Encarta Encyclopedia Standard 2004

Microsoft FrontPage 2000

Microsoft Image Composer 1.5

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Money 2004

Microsoft Money 2004 System Pack

Microsoft National Language Support Downlevel APIs

Microsoft Office File Validation Add-In

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft Train Simulator

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft XML Parser

MSSoap

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Roxio Creator Audio

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Express Labeler 3

Roxio Update Manager

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 7 (KB2183461)

Security Update for Windows Internet Explorer 7 (KB2360131)

Security Update for Windows Internet Explorer 7 (KB2416400)

Security Update for Windows Internet Explorer 7 (KB938127)

Security Update for Windows Internet Explorer 7 (KB942615)

Security Update for Windows Internet Explorer 7 (KB944533)

Security Update for Windows Internet Explorer 7 (KB958215)

Security Update for Windows Internet Explorer 7 (KB960714)

Security Update for Windows Internet Explorer 7 (KB961260)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Internet Explorer 7 (KB969897)

Security Update for Windows Internet Explorer 7 (KB972260)

Security Update for Windows Internet Explorer 7 (KB974455)

Security Update for Windows Internet Explorer 7 (KB978207)

Security Update for Windows Internet Explorer 7 (KB982381)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB2675157)

Security Update for Windows Internet Explorer 8 (KB2699988)

Security Update for Windows Internet Explorer 8 (KB2722913)

Security Update for Windows Internet Explorer 8 (KB2744842)

Security Update for Windows Internet Explorer 8 (KB2761465)

Security Update for Windows Internet Explorer 8 (KB2792100)

Security Update for Windows Internet Explorer 8 (KB2797052)

Security Update for Windows Internet Explorer 8 (KB2809289)

Security Update for Windows Internet Explorer 8 (KB2817183)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2724197)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2753842)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2761226)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2778344)

Security Update for Windows XP (KB2779030)

Security Update for Windows XP (KB2780091)

Security Update for Windows XP (KB2799494)

Security Update for Windows XP (KB2802968)

Security Update for Windows XP (KB2807986)

Security Update for Windows XP (KB2808735)

Security Update for Windows XP (KB2813170)

Security Update for Windows XP (KB2813345)

Security Update for Windows XP (KB2820917)

Security Update for Windows XP (KB923789)

Shockwave

Switch Sound File Converter

swMSM

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 7 (KB976749)

Update for Windows Internet Explorer 7 (KB980182)

Update for Windows Internet Explorer 8 (KB2447568)

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows Internet Explorer 8 (KB2632503)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2661254-v2)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB2749655)

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

WavePad Sound Editor

WebFldrs XP

Windows Internet Explorer 8

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

WordPerfect Office 11

.

==== Event Viewer Messages From Past Week ========

.

4/9/2013 5:54:18 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service gusvc with arguments "" in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}

4/9/2013 12:35:49 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.

4/8/2013 10:25:32 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

4/8/2013 10:25:31 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.

4/8/2013 10:22:57 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd

4/14/2013 2:06:32 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

4/14/2013 2:06:31 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.

4/14/2013 2:06:14 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}

4/14/2013 2:04:55 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the LogMeIn service to connect.

.

==== End Of File ===========================

gringo_pr · April 15, 2013

Hello gulfstream2013

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

gulfstream2013 · April 17, 2013

Results of screen317's Security Check version 0.99.62

Windows XP Service Pack 3 x86

Internet Explorer 8

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Enabled!

avast! Free Antivirus

AVG 2011

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

CCleaner

Java 7 Update 9

Java version out of Date!

Adobe Reader XI

Google Chrome 25.0.1364.172

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

Anvisoft Anvi Smart Defender toolbox adblocker\ADBlockerSrv.exe

Anvisoft Anvi Smart Defender ASDSrv.exe

Anvisoft Anvi Smart Defender ASDTray.exe

AVAST Software Avast AvastSvc.exe

AVAST Software Avast avastUI.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 5%

````````````````````End of Log``````````````````````

# AdwCleaner v2.200 - Logfile created 04/16/2013 at 19:54:53

# Updated 02/04/2013 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : Clare Colthup - CLARE

# Boot Mode : Normal

# Running from : C:\Documents and Settings\Clare Colthup\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\Babylon

Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint

Folder Deleted : C:\Documents and Settings\Clare Colthup\Application Data\Babylon

Folder Deleted : C:\Documents and Settings\Clare Colthup\Application Data\PriceGong

Folder Deleted : C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Conduit

Folder Deleted : C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\PackageAware

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AVG Security Toolbar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\DataMngr

Key Deleted : HKCU\Software\e55d6d8b63fbf41

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{312F84FB-8970-4FD3-BDDB-7012EAC4AFC9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C547C6C2-561B-4169-A2A5-20BA771CA93B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{312F84FB-8970-4FD3-BDDB-7012EAC4AFC9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C547C6C2-561B-4169-A2A5-20BA771CA93B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\PriceGong

Key Deleted : HKCU\Software\SmartBar

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287822

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\Software\TENCENT

Key Deleted : HKLM\Software\Viewpoint

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Google Chrome v25.0.1364.172

File : C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

Deleted [l.1] : icon_url ={"browser":{"last_known_google_url":"hxxps://www.google.com/","last_prompted_google_url":"hxxps://ww[...]

*************************

AdwCleaner[s1].txt - [4714 octets] - [16/04/2013 19:54:53]

########## EOF - C:\AdwCleaner[s1].txt - [4774 octets] ##########

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Clare Colthup [Admin rights]

Mode : Scan -- Date : 04/16/2013 20:24:52

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[APPINIT][sUSP PATH] HKLM\[...]\Windows : AppInit_DLLs (c:\docume~1\alluse~1\applic~1\browse~1\25986~1.67\{c16c1~1\browse~1.dll) [x] -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

127.0.0.1 www.007guard.com

127.0.0.1 007guard.com

127.0.0.1 008i.com

127.0.0.1 www.008k.com

127.0.0.1 008k.com

127.0.0.1 www.00hq.com

127.0.0.1 00hq.com

127.0.0.1 010402.com

127.0.0.1 www.032439.com

127.0.0.1 032439.com

127.0.0.1 www.0scan.com

127.0.0.1 0scan.com

127.0.0.1 1000gratisproben.com

127.0.0.1 www.1000gratisproben.com

127.0.0.1 www.1001namen.com

127.0.0.1 1001namen.com

127.0.0.1 www.100888290cs.com

127.0.0.1 100888290cs.com

127.0.0.1 www.100sexlinks.com

[...]

¤¤¤ MBR Check: ¤¤¤

gringo_pr · April 17, 2013

Hello gulfstream2013

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

gulfstream2013 · April 17, 2013

Gringo, I'm not sure if my ComboFix log got posted?

gulfstream2013 · April 17, 2013

No problems running ComboFix. Computer seems to be running well...perhaps a bit faster. Bing continues to dominate search instead of Google. "MixiDJ V8 Customized Web Search" shows in search box top right of browser. I never asked for Bing or mixiDJ. I previously tried deleting MixiDJ in search provider management, but there's no option to remove, only for Google. Now I don't see search engine manager under browser tools at all?

Here's the log - thanks Gringo for your help:

ComboFix 13-04-17.01 - Clare Colthup 04/17/2013 6:33.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1534.962 [GMT -4:00]

Running from: c:\documents and settings\Clare Colthup\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Antivirus *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: Trend Micro Firewall Booster *Disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\fad.sys

c:\windows\system32\SET104.tmp

c:\windows\system32\SET109.tmp

c:\windows\system32\setb4.tmp

c:\windows\system32\SETB5.tmp

c:\windows\system32\SETC1.tmp

c:\windows\system32\SETCE.tmp

c:\windows\wininit.ini

.

((((((((((((((((((((((((( Files Created from 2013-03-17 to 2013-04-17 )))))))))))))))))))))))))))))))

.

2013-04-16 23:37 . 2013-04-16 23:37 -------- dc----w- c:\program files\Common Files\Java

2013-04-16 23:32 . 2013-04-16 23:31 144896 -c--a-w- c:\windows\system32\javacpl.cpl

2013-04-16 23:32 . 2013-04-16 23:32 94112 -c--a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-04-16 11:28 . 2013-04-16 11:28 -------- dc----w- c:\documents and settings\Clare Colthup\Application Data\Anvisoft

2013-04-16 11:25 . 2012-11-07 07:16 22864 -c--a-w- c:\windows\system32\drivers\asdrs.sys

2013-04-16 11:25 . 2012-11-07 07:16 14160 -c--a-w- c:\windows\system32\drivers\asdws.sys

2013-04-16 11:25 . 2012-11-07 07:16 16208 -c--a-w- c:\windows\system32\drivers\asdrm.sys

2013-04-16 11:25 . 2013-04-16 11:25 -------- dc----w- c:\documents and settings\All Users\Application Data\Anvisoft

2013-04-16 11:25 . 2013-04-16 11:25 -------- dc----w- c:\program files\Anvisoft

2013-04-14 22:21 . 2013-04-14 22:21 -------- dc----w- c:\documents and settings\Clare Colthup\Application Data\Xilisoft

2013-04-14 21:13 . 2013-04-14 21:13 -------- dc----w- c:\documents and settings\Clare Colthup\Local Settings\Application Data\CRE

2013-04-14 20:46 . 2013-04-14 20:46 -------- dc----w- C:\Multimedia Files

2013-04-14 20:45 . 2013-04-14 20:46 -------- dc----w- c:\program files\Microsoft Image Composer

2013-04-14 17:51 . 2013-04-14 17:51 -------- dc----w- c:\documents and settings\Clare Colthup\Local Settings\Application Data\IAC

2013-04-14 16:20 . 2012-08-21 17:01 26840 -c--a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2013-04-14 16:19 . 2013-04-14 16:19 -------- dc----w- c:\program files\iPod

2013-04-13 18:55 . 2013-04-13 18:57 -------- dc----w- c:\documents and settings\All Users\Application Data\Apple

2013-04-13 18:14 . 2013-04-13 18:14 -------- dc----w- c:\documents and settings\All Users\Application Data\NCH Software

2013-04-13 18:14 . 2013-04-13 18:18 -------- dc----w- c:\program files\NCH Software

2013-04-13 18:14 . 2013-04-13 18:14 -------- dc----w- c:\documents and settings\Clare Colthup\Application Data\NCH Software

2013-04-12 19:20 . 2013-04-12 19:20 -------- dc----w- c:\documents and settings\Clare Colthup\Application Data\Microsoft Web Folders

2013-04-11 11:57 . 2013-04-14 16:40 -------- dc----w- c:\program files\Microsoft Games

2013-04-10 14:41 . 2013-04-10 14:58 -------- dc----w- c:\documents and settings\Clare Colthup\Application Data\FixCleaner

2013-03-29 15:55 . 2013-03-29 15:55 -------- dc----w- c:\documents and settings\Clare Colthup\Application Data\1&1

2013-03-18 15:52 . 2013-03-06 22:33 164736 -c--a-w- c:\windows\system32\drivers\aswVmm.sys

2013-03-18 15:52 . 2013-03-06 22:33 49248 -c--a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-03-18 15:52 . 2013-03-06 22:33 66336 -c--a-w- c:\windows\system32\drivers\aswMonFlt.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-04-16 23:31 . 2012-12-17 19:42 866720 -c--a-w- c:\windows\system32\npDeployJava1.dll

2013-04-16 23:31 . 2012-12-17 19:42 788896 -c--a-w- c:\windows\system32\deployJava1.dll

2013-04-11 20:59 . 2012-12-17 19:45 691592 -c--a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-11 20:59 . 2011-08-04 21:45 71048 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-04 18:50 . 2012-12-14 15:28 22856 -c--a-w- c:\windows\system32\drivers\mbam.sys

2013-03-08 08:36 . 2002-08-29 11:00 293376 -c--a-w- c:\windows\system32\winsrv.dll

2013-03-07 01:28 . 1980-01-01 06:00 2193408 -c--a-w- c:\windows\system32\ntoskrnl.exe

2013-03-07 00:50 . 1980-01-01 06:00 2070016 -c--a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-06 22:33 . 2012-06-06 22:18 368176 -c--a-w- c:\windows\system32\drivers\aswSP.sys

2013-03-06 22:33 . 2012-06-06 22:18 62376 -c--a-w- c:\windows\system32\drivers\aswTdi.sys

2013-03-06 22:33 . 2012-06-06 22:18 49760 -c--a-w- c:\windows\system32\drivers\aswRdr.sys

2013-03-06 22:33 . 2012-06-06 22:18 765736 -c--a-w- c:\windows\system32\drivers\aswSnx.sys

2013-03-06 22:33 . 2012-06-06 22:18 29816 -c--a-w- c:\windows\system32\drivers\aswFsBlk.sys

2013-03-06 22:32 . 2012-06-06 22:17 41664 -c--a-w- c:\windows\avastSS.scr

2013-03-06 22:32 . 2012-06-06 22:17 228600 -c--a-w- c:\windows\system32\aswBoot.exe

2013-03-02 02:06 . 2004-08-24 01:32 916480 -c--a-w- c:\windows\system32\wininet.dll

2013-03-02 02:06 . 2002-08-29 11:00 43520 -c----w- c:\windows\system32\licmgr10.dll

2013-03-02 02:06 . 2002-08-29 11:00 1469440 -c----w- c:\windows\system32\inetcpl.cpl

2013-03-02 01:25 . 2002-08-29 11:00 1867264 -c--a-w- c:\windows\system32\win32k.sys

2013-03-02 01:08 . 2004-08-04 05:59 385024 -c----w- c:\windows\system32\html.iec

2013-02-27 07:56 . 2002-08-29 11:00 2067456 -c--a-w- c:\windows\system32\mstscax.dll

2013-02-12 00:32 . 2004-08-04 06:04 12928 -c----w- c:\windows\system32\drivers\usb8023x.sys

2013-02-12 00:32 . 2002-08-29 11:00 12928 -c--a-w- c:\windows\system32\drivers\usb8023.sys

2013-01-26 03:55 . 2002-08-29 11:00 552448 -c--a-w- c:\windows\system32\oleaut32.dll

2013-01-15 09:27 . 2013-01-15 09:27 2174976 -c--a-w- c:\program files\Common Files\atimpenc.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-03-06 22:32 121968 -c--a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-24 68856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-03 188416]

"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]

"ADBlocker"="c:\program files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerTray.exe" [2012-12-21 979816]

"Anvi Smart Defender"="c:\program files\Anvisoft\Anvi Smart Defender\ASDTray.exe" [2012-12-21 1434984]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2012-12-19 18:37 92072 -c--a-w- c:\windows\SYSTEM32\LMIinit.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\SYSTEM32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2008-01-24 02:30 68856 -c--a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup]

2003-03-31 23:28 155648 -c--a-w- c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=3 (0x3)

"ose"=3 (0x3)

"LVPrcSrv"=2 (0x2)

"IDriverT"=3 (0x3)

"gusvc"=3 (0x3)

"gupdatem"=3 (0x3)

"gupdate"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.

R0 aswRvrt;aswRvrt;c:\windows\SYSTEM32\DRIVERS\aswRvrt.sys [3/18/2013 11:52 AM 49248]

R1 asdnet;asdnet;c:\program files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\sys\x86\asdnet.sys [4/16/2013 7:25 AM 15696]

R1 asdrm;asdrm;c:\windows\SYSTEM32\DRIVERS\asdrm.sys [4/16/2013 7:25 AM 16208]

R1 aswKbd;aswKbd;c:\windows\SYSTEM32\DRIVERS\aswKbd.sys [10/12/2012 11:43 AM 20624]

R1 aswSnx;aswSnx;c:\windows\SYSTEM32\DRIVERS\aswSnx.sys [6/6/2012 6:18 PM 765736]

R1 aswSP;aswSP;c:\windows\SYSTEM32\DRIVERS\aswSP.sys [6/6/2012 6:18 PM 368176]

R2 ADBlockerSrv;AD Blocker Service;c:\program files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe [4/16/2013 7:25 AM 279368]

R2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:\windows\SYSTEM32\DRIVERS\asdrs.sys [4/16/2013 7:25 AM 22864]

R2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:\program files\Anvisoft\Anvi Smart Defender\ASDSrv.exe [12/20/2012 10:43 PM 735592]

R2 asdws;AnviSmartDefender Web Guard;c:\windows\SYSTEM32\DRIVERS\asdws.sys [4/16/2013 7:25 AM 14160]

R2 aswFsBlk;aswFsBlk;c:\windows\SYSTEM32\DRIVERS\aswFsBlk.sys [6/6/2012 6:18 PM 29816]

R2 aswMonFlt;aswMonFlt;c:\windows\SYSTEM32\DRIVERS\aswMonFlt.sys [3/18/2013 11:52 AM 66336]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [9/29/2010 9:34 PM 374704]

S0 Lbd;Lbd; [x]

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/16/2011 3:10 PM 12856]

S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [12/14/2012 11:28 AM 418376]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/14/2012 11:28 AM 701512]

S3 aswVmm;aswVmm;c:\windows\SYSTEM32\DRIVERS\aswVmm.sys [3/18/2013 11:52 AM 164736]

S3 esgiguard;esgiguard; [x]

S3 Lavasoft Kernexplorer;Lavasoft helper driver; [x]

S3 MBAMProtector;MBAMProtector;c:\windows\SYSTEM32\DRIVERS\mbam.sys [12/14/2012 11:28 AM 22856]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - TRUESIGHT

*Deregistered* - TrueSight

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-19 14:10 1629648 -c--a-w- c:\program files\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-04-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-17 20:59]

.

2013-04-16 c:\windows\Tasks\AnviQuickScan.job

- c:\program files\Anvisoft\Anvi Smart Defender\PopupScan.exe [2012-12-21 02:43]

.

2013-03-18 c:\windows\Tasks\avast! Emergency Update.job

- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-15 22:32]

.

2013-04-13 c:\windows\Tasks\SwitchReminder.job

- c:\program files\NCH Software\Switch\switch.exe [2013-04-13 20:41]

.

2012-12-20 c:\windows\Tasks\User_Feed_Synchronization-{79105A1A-C2D8-48BC-B1E9-CD0FE252C4C6}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://www.claresworld.us/

mStart Page = hxxp://www.claresworld.us

uInternet Settings,ProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

TCP: DhcpNameServer = 192.168.254.254

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-Google Update - c:\documents and settings\Clare Colthup\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-04-17 06:49

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(676)

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

.

Completion time: 2013-04-17 06:55:09

ComboFix-quarantined-files.txt 2013-04-17 10:55

ComboFix2.txt 2011-10-20 18:02

.

Pre-Run: 58,981,756,928 bytes free

Post-Run: 59,045,793,792 bytes free

.

- - End Of File - - F8E0BF6B095B9F3D996466D195F7964C

gringo_pr · April 17, 2013

Hello gulfstream2013

Lets get a deeper look into the system and lets see if something shows up.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.

Double click on OTL.exe to run it.
Under Output, ensure that Minimal Output is selected.
Under Extra Registry section, select Use SafeList.
Click the Scan All Users checkbox.
Click on Run Scan at the top left hand corner.
When done, two Notepad files will open.
- OTL.txt <-- Will be opened and the that I need posted back here
- Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
[*]Please post the contents of OTL.txt in your next reply.

Gringo

gulfstream2013 · April 18, 2013

Hi Gringo, OTL run successfully. OTL.txt:

OTL logfile created on: 4/18/2013 7:19:59 AM - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Clare Colthup\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.79 Gb Available Physical Memory | 52.50% Memory free

2.29 Gb Paging File | 1.71 Gb Available in Paging File | 74.64% Paging File free

Paging file location(s): C:\pagefile.sys 957 957 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.47 Gb Total Space | 54.85 Gb Free Space | 73.65% Space Free | Partition Type: NTFS

Computer Name: CLARE | User Name: Clare Colthup | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Clare Colthup\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)

PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

PRC - C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerTray.exe ()

PRC - C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe (Anvisoft)

PRC - C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe (Anvisoft)

PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)

PRC - C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe ()

PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)

PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)

PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13041701\algo.dll ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerTray.exe ()

MOD - C:\Program Files\Anvisoft\Anvi Smart Defender\sqlite3.dll ()

MOD - C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe ()

MOD - C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\sqlite3.dll ()

MOD - C:\WINDOWS\SYSTEM32\HPBHEALR.DLL ()

========== Services (SafeList) ==========

SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found

SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found

SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\SYSTEM32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

SRV - (asdsrv) -- C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe (Anvisoft)

SRV - (LMIMaint) -- C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)

SRV - (ADBlockerSrv) -- C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe ()

SRV - (LMIGuardianSvc) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)

SRV - (LogMeIn) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)

SRV - (Pml Driver HPZ12) -- C:\WINDOWS\SYSTEM32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found

DRV - (wanatw) -- File not found

DRV - (PDRFRAME) -- File not found

DRV - (PDRELI) -- File not found

DRV - (PDFRAME) -- File not found

DRV - (PDCOMP) -- File not found

DRV - (PCIDump) -- File not found

DRV - (MRESP50a64) -- File not found

DRV - (MRESP50) -- File not found

DRV - (MRENDIS5) -- File not found

DRV - (MREMPR5) -- File not found

DRV - (MREMP50a64) -- File not found

DRV - (MREMP50) -- File not found

DRV - (lbrtfdc) -- File not found

DRV - (Lbd) -- File not found

DRV - (Lavasoft Kernexplorer) -- File not found

DRV - (iAimTV2) -- File not found

DRV - (FilterService) -- File not found

DRV - (esgiguard) -- File not found

DRV - (Changer) -- File not found

DRV - (catchme) -- C:\DOCUME~1\CLAREC~1\LOCALS~1\Temp\catchme.sys File not found

DRV - (MBAMProtector) -- C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys (Malwarebytes Corporation)

DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)

DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)

DRV - (aswVmm) -- C:\WINDOWS\System32\drivers\aswVmm.sys ()

DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)

DRV - (AswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)

DRV - (aswRvrt) -- C:\WINDOWS\System32\drivers\aswRvrt.sys ()

DRV - (aswMonFlt) -- C:\WINDOWS\SYSTEM32\DRIVERS\aswMonFlt.sys (AVAST Software)

DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)

DRV - (LVUVC) -- C:\WINDOWS\System32\drivers\lvuvc.hs ()

DRV - (LMIRfsClientNP) -- C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)

DRV - (asdrs) -- C:\WINDOWS\SYSTEM32\DRIVERS\asdrs.sys (Anvisoft)

DRV - (asdws) -- C:\WINDOWS\SYSTEM32\DRIVERS\asdws.sys ()

DRV - (asdrm) -- C:\WINDOWS\SYSTEM32\DRIVERS\asdrm.sys (Anvisoft)

DRV - (aswKbd) -- C:\WINDOWS\System32\drivers\aswKbd.sys (AVAST Software)

DRV - (asdnet) -- C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\sys\x86\asdnet.sys ()

DRV - (LMIRfsDriver) -- C:\WINDOWS\SYSTEM32\DRIVERS\LMIRfsDriver.sys (LogMeIn, Inc.)

DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)

DRV - (hamachi) -- C:\WINDOWS\SYSTEM32\DRIVERS\hamachi.sys (LogMeIn, Inc.)

DRV - (iAimFP4) -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)

DRV - (iAimFP3) -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)

DRV - (iAimTV4) -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)

DRV - (iAimTV3) -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)

DRV - (iAimTV1) -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)

DRV - (iAimTV0) -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)

DRV - (iAimFP0) -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)

DRV - (iAimFP1) -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)

DRV - (iAimFP2) -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)

DRV - (i81x) -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)

DRV - (BCMModem) -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)

DRV - (bcm4sbxp) -- C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)

DRV - (omci) -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)

DRV - (EL90XBC) -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.claresworld.us

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\..\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^HJ^xdm017^YY^us&si=pconverter&ptb=9BB61B67-7936-48B6-9827-039A2621A2DC&ind=2013041413&n=77fc9305&psa=&st=sb&searchfor={searchTerms}

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.claresworld.us/

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes,DefaultScope = {57A6DD8A-5BB6-4FD0-A136-9045C35B994D}

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3287822&CUI=UN23365699186637288&UM=2

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{A81D283D-CA62-4A34-BBBC-B8302125AD5E}: "URL" =

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)

FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========== Chrome ==========

CHR - Extension: No name found = C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\

CHR - Extension: No name found = C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/04/17 06:49:31 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O4 - HKLM..\Run: [ADBlocker] C:\Program Files\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerTray.exe ()

O4 - HKLM..\Run: [Anvi Smart Defender] C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe (Anvisoft)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb07.exe (HP)

O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)

O4 - HKLM..\Run: [statusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1

O7 - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA1DC0A0-681F-42D6-A7E9-CCF8B4727FD2}: DhcpNameServer = 192.168.254.254

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)

O24 - Desktop WallPaper: C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2002/09/03 10:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/18 07:18:55 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Clare Colthup\Desktop\OTL.exe

[2013/04/17 08:45:56 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2013/04/16 20:23:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Desktop\RK_Quarantine

[2013/04/16 19:37:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2013/04/16 19:32:49 | 000,144,896 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl

[2013/04/16 19:32:48 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe

[2013/04/16 19:32:34 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe

[2013/04/16 19:32:34 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe

[2013/04/16 19:32:34 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll

[2013/04/16 07:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\Anvisoft

[2013/04/16 07:25:41 | 000,022,864 | ---- | C] (Anvisoft) -- C:\WINDOWS\System32\drivers\asdrs.sys

[2013/04/16 07:25:41 | 000,016,208 | ---- | C] (Anvisoft) -- C:\WINDOWS\System32\drivers\asdrm.sys

[2013/04/16 07:25:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\anvisoft

[2013/04/16 07:25:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Anvisoft

[2013/04/16 07:25:07 | 000,000,000 | ---D | C] -- C:\Program Files\Anvisoft

[2013/04/14 18:21:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\Xilisoft

[2013/04/14 17:13:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\CRE

[2013/04/14 16:46:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Start Menu\Programs\Microsoft Image Composer

[2013/04/14 16:46:10 | 000,000,000 | ---D | C] -- C:\Multimedia Files

[2013/04/14 16:45:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Image Composer

[2013/04/14 13:51:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\IAC

[2013/04/14 12:20:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes

[2013/04/14 12:19:00 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2013/04/14 12:18:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1

[2013/04/14 12:18:50 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2013/04/14 12:17:43 | 006,112,864 | ---- | C] (Apple, Inc.) -- C:\WINDOWS\System32\usbaaplrc.dll

[2013/04/14 09:18:52 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Clare Colthup\Recent

[2013/04/13 19:39:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Apple Computer

[2013/04/13 15:00:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Apple Computer

[2013/04/13 15:00:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\Apple Computer

[2013/04/13 14:58:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer

[2013/04/13 14:57:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\Apple

[2013/04/13 14:57:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Apple Computer

[2013/04/13 14:56:09 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour

[2013/04/13 14:55:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple

[2013/04/13 14:55:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple

[2013/04/13 14:15:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Start Menu\Programs\NCH Software Suite

[2013/04/13 14:15:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Start Menu\Programs\Audio Related Programs

[2013/04/13 14:14:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Software

[2013/04/13 14:14:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\NCH Software Suite

[2013/04/13 14:14:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Audio Related Programs

[2013/04/13 14:14:24 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software

[2013/04/13 14:14:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\NCH Software

[2013/04/12 15:31:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\My Documents\My Webs

[2013/04/12 15:23:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools

[2013/04/12 15:20:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft Web Folders

[2013/04/11 08:10:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Games

[2013/04/11 07:57:08 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Games

[2013/04/10 10:41:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\FixCleaner

[2013/04/10 10:41:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Downloaded Installers

[2013/04/10 09:21:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\My Documents\Pete

[2013/04/10 09:02:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\My Documents\Clare's Book

[2013/04/01 12:48:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\1&1

[2013/03/29 11:55:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Clare Colthup\Application Data\1&1

[2013/03/19 10:15:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome

[2013/01/15 05:27:04 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files\Common Files\atimpenc.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/18 07:19:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Clare Colthup\Desktop\OTL.exe

[2013/04/18 07:06:35 | 000,002,513 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk

[2013/04/17 11:50:16 | 000,000,560 | ---- | M] () -- C:\WINDOWS\tasks\AnviUpdate.job

[2013/04/17 11:50:16 | 000,000,312 | ---- | M] () -- C:\WINDOWS\tasks\AnviQuickScan.job

[2013/04/17 11:09:33 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Desktop\email.lnk

[2013/04/17 10:11:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT

[2013/04/17 09:38:49 | 000,000,000 | ---- | M] () -- C:\FileOut.Cns

[2013/04/17 09:38:49 | 000,000,000 | ---- | M] () -- C:\FileIn.Cns

[2013/04/17 06:49:31 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts

[2013/04/16 19:38:02 | 000,001,109 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Anvi AD Blocker.lnk

[2013/04/16 19:38:02 | 000,000,837 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Anvi Smart Defender.lnk

[2013/04/16 19:32:05 | 000,094,112 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll

[2013/04/16 19:31:56 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe

[2013/04/16 19:31:56 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe

[2013/04/16 19:31:55 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe

[2013/04/16 19:31:55 | 000,144,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl

[2013/04/16 19:31:53 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll

[2013/04/16 19:31:52 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll

[2013/04/15 11:37:53 | 000,002,467 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft FrontPage.lnk

[2013/04/15 08:03:29 | 000,001,701 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\avast! Free Antivirus.lnk

[2013/04/14 17:35:51 | 000,395,160 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2013/04/14 12:45:22 | 000,001,717 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\The Conquerors.lnk

[2013/04/14 12:20:16 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2013/04/14 06:47:22 | 000,000,787 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Switch Sound File Converter.lnk

[2013/04/13 17:21:52 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\SwitchReminder.job

[2013/04/12 15:30:08 | 000,000,377 | ---- | M] () -- C:\WINDOWS\ODBC.INI

[2013/04/12 15:23:47 | 000,001,725 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

[2013/04/11 16:59:03 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2013/04/11 16:59:00 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2013/04/11 16:59:00 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2013/04/11 08:10:07 | 000,001,819 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Train Simulator.lnk

[2013/04/10 11:36:43 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk

[2013/04/10 10:07:52 | 000,000,796 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware (2).lnk

[2013/04/10 10:03:07 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL

[2013/04/10 09:03:30 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Desktop\Microsoft Office Excel 2003.lnk

[2013/04/10 08:55:26 | 000,003,584 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/04/10 08:50:43 | 000,437,068 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT

[2013/04/10 08:50:43 | 000,069,294 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT

[2013/04/10 07:23:01 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk

[2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2013/04/01 12:48:28 | 000,001,722 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\1&1 WebMail.lnk

[2013/03/20 08:47:33 | 000,001,831 | ---- | M] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2013/03/19 10:15:33 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/17 11:44:37 | 000,000,560 | ---- | C] () -- C:\WINDOWS\tasks\AnviUpdate.job

[2013/04/16 19:38:02 | 000,001,109 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Anvi AD Blocker.lnk

[2013/04/16 19:38:02 | 000,000,837 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Anvi Smart Defender.lnk

[2013/04/16 14:30:56 | 000,000,312 | ---- | C] () -- C:\WINDOWS\tasks\AnviQuickScan.job

[2013/04/16 07:25:41 | 000,014,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\asdws.sys

[2013/04/15 08:03:29 | 000,001,701 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\avast! Free Antivirus.lnk

[2013/04/14 12:45:22 | 000,001,717 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\The Conquerors.lnk

[2013/04/14 12:20:16 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2013/04/14 06:47:22 | 000,000,787 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Switch Sound File Converter.lnk

[2013/04/14 06:47:09 | 000,002,467 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft FrontPage.lnk

[2013/04/13 17:21:52 | 000,000,288 | ---- | C] () -- C:\WINDOWS\tasks\SwitchReminder.job

[2013/04/13 14:57:40 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk

[2013/04/13 14:15:26 | 000,000,789 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\WavePad Sound Editor.lnk

[2013/04/13 14:14:25 | 000,000,793 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Switch Sound File Converter.lnk

[2013/04/12 15:23:47 | 000,001,725 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

[2013/04/12 15:23:46 | 000,001,998 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft FrontPage.lnk

[2013/04/11 08:32:05 | 000,000,000 | ---- | C] () -- C:\FileOut.Cns

[2013/04/11 08:32:05 | 000,000,000 | ---- | C] () -- C:\FileIn.Cns

[2013/04/11 08:10:03 | 000,001,819 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Train Simulator.lnk

[2013/04/10 12:48:54 | 000,002,513 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk

[2013/04/10 11:36:43 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk

[2013/04/10 10:07:52 | 000,000,796 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware (2).lnk

[2013/04/10 08:55:26 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/04/01 12:48:28 | 000,001,722 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\1&1 WebMail.lnk

[2013/03/19 10:15:34 | 000,001,831 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2013/03/19 10:15:29 | 000,001,813 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

[2013/03/18 11:52:03 | 000,164,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys

[2013/03/18 11:52:01 | 000,049,248 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys

[2012/03/19 14:21:54 | 000,016,954 | ---- | C] () -- C:\WINDOWS\hplj1010.ini

[2011/10/20 13:43:51 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/10/20 13:43:51 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/10/20 13:43:51 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/10/20 13:43:51 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/08/04 20:33:13 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Brother

[2011/08/04 20:33:13 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Bass

[2010/04/08 18:59:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\Bubble Noise

[2010/04/08 18:59:31 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT

[2007/01/31 23:20:24 | 000,003,622 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\resetlog.txp

[2004/03/19 12:45:34 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\PFP110JPR.{PB

[2004/03/19 12:45:34 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Clare Colthup\Application Data\PFP110JCM.{PB

========== ZeroAccess Check ==========

[2004/03/06 02:37:43 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 20:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >

gringo_pr · April 18, 2013

Hello gulfstream2013

I would like you to run this custom script for me now and when it is complete please give me the report and a status update for the computer.

Run OTL Script

Double-click OTL.exe to start the program.

Copy and Paste the following code into the

text box.


:OTL
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: File not found
IE - HKLM\..\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}: "URL" = http://search.mywebs...or={searchTerms}
IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}: "URL" = http://search.condui...9186637288&UM=2
IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}: "URL" = http://search.condui...9186637288&UM=2
IE - HKU\S-1-5-21-1819532754-2096334853-3671780774-1007\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

:Files
ipconfig /flushdns /c

:Commands
[PURITY]
[emptyjava]
[EMPTYFLASH]
[reboot]

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.
Note** if the report does not popup after the computer reboots you can find it here in this folder - C:\_OTL\MovedFiles
It will be named - mmddyyyy_hhmmss.log
Where mmddyyyy_hhmmss - are numbers representing the date and time the fix was run.

Let me know How things are doing

Gringo

gulfstream2013 · April 18, 2013

Gringo, computer takes a while to boot up, as if a scan is running? Browser also took a while to open completely, but mixiDJ and Bing seem to be gone. Manage add-ons opened by itself. I deleted "Live Search" which was listed as 'unavailable'.

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@radialpoint.com/SPA,version=1\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}\ not found.

Registry key HKEY_USERS\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Microsoft\Internet Explorer\SearchScopes\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}\ not found.

Registry key HKEY_USERS\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Microsoft\Internet Explorer\SearchScopes\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57A6DD8A-5BB6-4FD0-A136-9045C35B994D}\ not found.

Registry key HKEY_USERS\S-1-5-21-1819532754-2096334853-3671780774-1007\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\Clare Colthup\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\Clare Colthup\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYJAVA]

User: Administrator

User: All Users

User: BB443B11-7D12-450c-9F85-2D32804655F9

User: Clare Colthup

->Java cache emptied: 0 bytes

User: Default User

User: LocalService

User: LogMeInRemoteUser

User: LogMeInRemoteUser.CLARE

User: NetworkService

User: Rosie for Grandpa

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: BB443B11-7D12-450c-9F85-2D32804655F9

User: Clare Colthup

->Flash cache emptied: 57983 bytes

User: Default User

->Flash cache emptied: 57472 bytes

User: LocalService

User: LogMeInRemoteUser

User: LogMeInRemoteUser.CLARE

->Flash cache emptied: 56502 bytes

User: NetworkService

User: Rosie for Grandpa

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 04182013_152247

gringo_pr · April 18, 2013

Hello gulfstream2013

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

gulfstream2013 · April 19, 2013

Hello Gringo

No problems running Combofix. The computer is running very well now. Browser seems to be fixed. Computer and browser speeds are good.

ComboFix 13-04-18.03 - Clare Colthup 04/18/2013 19:28:31.3.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1534.983 [GMT -4:00]

Running from: c:\documents and settings\Clare Colthup\Desktop\Virus Programs\ComboFix.exe

Command switches used :: c:\documents and settings\Clare Colthup\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Antivirus *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: Trend Micro Firewall Booster *Disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2013-03-18 to 2013-04-18 )))))))))))))))))))))))))))))))

.

2013-04-18 19:21 . 2013-04-18 19:21 -------- dc----w- C:\_OTL