Jump to content

FIrefox Pop-up Virus ..... can't seem to get rid of.


Recommended Posts

Hello All,

In the weirdest turn of events, I did a yahoo search last Friday to look for a story to show my brother (the exact words were "100 yr old millionaire") and clicked on one of the links. Then right before my eyes and my brother's eyes, we saw that the link I click was a rogue site that downloaded some kind of Firefox Pop-up Virus on my computer. McAfee can't it but it was too late. I had something similar last fall and running Malwarebytes was enough to remove it, but that is not working this time.

I have 2 accounts on my computer and it seems that the rogue software is only running on one of them. After running Malwarebytes, I don't get the firefox pop-ups but upon system start-up, I get a 2 pop-ups windows titled "RUN DLL" and it complained that a particular rogue file in the ....../All Users/Application Data folder is not found.

I followed the steps in the link above but as I was running GMER and got a blue screen on my computer stating Windows detected an error where a crucial process or thread to system operation had been terminated, so I don't think I'll should be running that again unless you guys have an idea of what the issue could be. It had been running for at least 1.5 hours and I just closed Firefox right before the blue screen appeared.. Here are the 2 Malwarebytes Logs and DDS Logs. FYI......... I don't have WinZip, but a WinRar file can be opened with WinZip.

Thanks for your help in advance.

##############################################################

Malwarebytes' Anti-Malware 1.44

Database version: 3830

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

3/6/2010 7:01:05 PM

mbam-log-2010-03-06 (19-01-05).txt

Scan type: Full Scan (C:\|) (Both accounts)

Objects scanned: 251608

Time elapsed: 3 hour(s), 21 minute(s), 11 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 2

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Documents and Settings\Limited\Application Data\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Limited\Local Settings\Application Data\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\All Users\Application Data\rojahope\rojahope.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP2656\A0301323.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

######################################################

Malwarebytes' Anti-Malware 1.44

Database version: 3839

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

3/10/2010 7:49:25 AM

mbam-log-2010-03-10 (07-49-25).txt

Scan type: Quick Scan (Infected Account)

Objects scanned: 111164

Time elapsed: 17 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wivumetejo (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

######################################################

DDS (Ver_09-12-01.01) - NTFSx86

Run by soulsis at 22:24:54.81 on Thu 03/11/2010

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_15

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.429 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\QuickTime\qttask.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

C:\Program Files\Supreme Office Suite3.0\program\soffice.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\SYSTEM32\FREECELL.EXE

C:\Documents and Settings\soulsis\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uWindow Title = Windows Internet Explorer provided by Comcast

mDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.comcast.net/

mWindow Title = Windows Internet Explorer provided by Comcast

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRunOnce: [DelayShred] "c:\program files\mcafee.com\shredder\shred32.exe" /q c:\windows\system32\ncompat.sh! c:\windows\system32\nvctrl.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\index.sh! c:\docume~1\soulsis\locals~1\temp\~dfa39c.sh! c:\docume~1\soulsis\locals~1\temp\~dff491.sh! c:\progra~1\securi~1.sh! c:\windows\system32\hp3918.sh! c:\windows\system32\hpf6ff.sh! c:\windows\system32\ld5c5a.sh! c:\windows\system32\hp5e2e.sh! c:\windows\system32\ldf76f.sh! c:\docume~1\soulsis\locals~1\temp\~df46ec.sh! c:\docume~1\soulsis\locals~1\temp\~df5a91.sh! c:\docume~1\soulsis\locals~1\temp\~df4040.sh! c:\docume~1\soulsis\locals~1\temp\~df39cf.sh! c:\docume~1\soulsis\locals~1\temp\~df5eaf.sh! c:\docume~1\soulsis\locals~1\temp\~dfb7a.sh! c:\docume~1\soulsis\locals~1\temp\~df237e.sh! c:\docume~1\soulsis\locals~1\temp\~df16a3.sh! c:\docume~1\soulsis\locals~1\temp\~dfec2a.sh! c:\docume~1\soulsis\locals~1\temp\~dfa74c.sh! c:\docume~1\soulsis\locals~1\temp\acr13.sh! c:\docume~1\soulsis\locals~1\temp\~df11c8.sh! c:\docume~1\soulsis\locals~1\temp\~dfb1f2.sh! c:\docume~1\soulsis\locals~1\temp\acr9.sh! c:\docume~1\soulsis\locals~1\temp\~df3e5b.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\iv2fytod.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\nuxwdvrn.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\od63k1i7.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\4pqvw56n.sh! c:\docume~1\soulsis\locals~1\temp\~df9c41.sh! c:\docume~1\soulsis\locals~1\temp\soffice.sh! c:\docume~1\soulsis\locals~1\temp\~dfb0c2.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\yko7yesk.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\yko7yesk\ec_mai~1.sh! c:\docume~1\soulsis\locals~1\temp\~dfe480.sh! c:\docume~1\soulsis\locals~1\temp\~df3f86.sh! c:\docume~1\soulsis\locals~1\temp\~df408e.sh! c:\docume~1\soulsis\locals~1\temp\~df650b.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\sh23c5q3.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\0x6zohmb.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\3ciyeztn.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\8r0n8dw3\vc_468~1.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\87e1irgp\619767~1.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\8r0n8dw3\619753~1.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\sn6vshqj\vc_468~1.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\sn6vshqj.sh! c:\docume~1\soulsis\locals~1\temp\~df4ee4.sh! c:\docume~1\soulsis\locals~1\temp\~df9f94.sh! c:\docume~1\soulsis\locals~1\temp\~dffd1.sh! c:\docume~1\soulsis\locals~1\temp\~dfb87c.sh! c:\docume~1\soulsis\locals~1\temp\~dfd5dd.sh! c:\docume~1\soulsis\locals~1\temp\~dff2f7.sh! c:\docume~1\soulsis\locals~1\temp\~df8865.sh! c:\docume~1\soulsis\locals~1\temp\~dfcb69.sh! c:\docume~1\soulsis\locals~1\temp\~df5ffe.sh! c:\docume~1\soulsis\locals~1\temp\~df89a3.sh! c:\docume~1\soulsis\locals~1\temp\~dfa666.sh! c:\docume~1\soulsis\locals~1\temp\~df8de.sh! c:\docume~1\soulsis\locals~1\temp\~df2042.sh! c:\docume~1\soulsis\locals~1\temp\~dfa40f.sh! c:\docume~1\soulsis\locals~1\temp\~df6429.sh! c:\docume~1\soulsis\locals~1\temp\~df99bb.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\auguf4od.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\auguf4od\ec_mai~1.sh! c:\docume~1\soulsis\locals~1\temp\~dff4a5.sh! c:\docume~1\soulsis\locals~1\temp\~df66f2.sh! c:\docume~1\soulsis\locals~1\temp\~dffa0c.sh! c:\docume~1\soulsis\locals~1\temp\~df2962.sh! c:\docume~1\soulsis\locals~1\temp\~df138f.sh! c:\docume~1\soulsis\locals~1\temp\~dfa3ac.sh! c:\docume~1\soulsis\locals~1\temp\acr1e.sh! c:\docume~1\soulsis\locals~1\temp\~df8de0.sh! c:\docume~1\soulsis\locals~1\temp\~df2426.sh! c:\docume~1\soulsis\locals~1\temp\~dff1ec.sh! c:\docume~1\soulsis\locals~1\temp\~df7d51.sh! c:\docume~1\soulsis\locals~1\temp\~df2407.sh! c:\docume~1\soulsis\locals~1\temp\~df6558.sh! c:\docume~1\soulsis\locals~1\temp\~dff694.sh! c:\docume~1\soulsis\locals~1\temp\~dfb5fd.sh! c:\docume~1\soulsis\locals~1\temp\~dfa57.sh! c:\docume~1\soulsis\locals~1\temp\~dfc1b5.sh! c:\docume~1\soulsis\locals~1\temp\acr22.sh! c:\docume~1\soulsis\locals~1\temp\~df27cc.sh! c:\docume~1\soulsis\locals~1\temp\~dfb831.sh! c:\docume~1\soulsis\locals~1\temp\~dfb343.sh! c:\docume~1\soulsis\locals~1\temp\~df7889.sh! c:\docume~1\soulsis\locals~1\temp\~dfddef.sh! c:\docume~1\soulsis\locals~1\temp\~df7e28.sh! c:\docume~1\soulsis\locals~1\temp\~df1767.sh! c:\docume~1\soulsis\locals~1\temp\~dfcc6d.sh! c:\docume~1\soulsis\locals~1\temp\~df5234.sh! c:\docume~1\soulsis\locals~1\temp\~dfca4a.sh! c:\docume~1\soulsis\cookies\index.sh! c:\docume~1\soulsis\locals~1\temp\~dfe727.sh! c:\docume~1\soulsis\locals~1\temp\~df2001.sh! c:\docume~1\soulsis\locals~1\temp\~dfb515.sh! c:\docume~1\soulsis\locals~1\temp\~dfbbb.sh! c:\docume~1\soulsis\locals~1\temp\~df23e2.sh! c:\docume~1\soulsis\locals~1\temp\~dfd6c4.sh! c:\docume~1\soulsis\locals~1\temp\~df157a.sh! c:\docume~1\soulsis\locals~1\temp\~df74c6.sh! c:\docume~1\soulsis\locals~1\temp\~df1fa0.sh! c:\docume~1\soulsis\locals~1\temp\~df4640.sh! c:\docume~1\soulsis\locals~1\temp\~df54c4.sh! c:\docume~1\soulsis\locals~1\temp\~dfaec5.sh! c:\docume~1\soulsis\locals~1\temp\~dfd245.sh! c:\docume~1\soulsis\locals~1\temp\~df1507.sh! c:\docume~1\soulsis\locals~1\temp\~dfc4e5.sh! c:\docume~1\soulsis\locals~1\temp\~df7b55.sh! c:\docume~1\soulsis\locals~1\temp\~df2109.sh! c:\docume~1\soulsis\locals~1\temp\~dfd31a.sh! c:\docume~1\soulsis\locals~1\temp\~dfd8f6.sh! c:\docume~1\soulsis\locals~1\temp\~dfe31.sh! c:\docume~1\soulsis\locals~1\temp\~df2626.sh! c:\docume~1\soulsis\locals~1\temp\~dfe11d.sh! c:\docume~1\soulsis\locals~1\temp\~dfbde7.sh! c:\docume~1\soulsis\locals~1\temp\~dfdf9f.sh! c:\docume~1\soulsis\locals~1\temp\~dfc69d.sh! c:\docume~1\soulsis\locals~1\temp\~df6316.sh! c:\docume~1\soulsis\locals~1\temp\~dfa345.sh! c:\docume~1\soulsis\locals~1\temp\~df585b.sh! c:\docume~1\soulsis\locals~1\temp\~dfb903.sh! c:\docume~1\soulsis\locals~1\temp\~dfec54.sh! c:\docume~1\soulsis\locals~1\temp\~df2f80.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\e1kbqt61.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\m3a34lc9.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\v584pjb1.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\vno239wf.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\0dz0q2xp.sh! c:\docume~1\soulsis\locals~1\tempor~1\content.ie5\6kpjni17.sh! c:\docume~1\soulsis\locals~1\temp\fla85.sh! c:\docume~1\soulsis\locals~1\temp\fla83.sh! c:\docume~1\soulsis\locals~1\temp\flab4.sh! c:\docume~1\soulsis\locals~1\temp\flab3.sh! c:\docume~1\soulsis\locals~1\temp\sqlite~1.sh! c:\docume~1\soulsis\locals~1\temp\fla74.sh! c:\docume~1\soulsis\locals~1\temp\fla8.SH!

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [bCMSMMSG] BCMSMMSG.exe

mRun: [diagent] "c:\program files\creative\sblive\diagnostics\diagent.exe" startup

mRun: [updReg] c:\windows\UpdReg.EXE

mRun: [DVDSentry] c:\windows\system32\DSentry.exe

mRun: [nwiz] nwiz.exe /install

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [AdaptecDirectCD] "c:\program files\roxio\easy cd creator 5\directcd\DirectCD.exe"

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe

mRun: [eTrustPPAP] "c:\program files\ca\etrust internet security suite\etrust pestpatrol anti-spyware\PPActiveDetection.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"

mRun: [indexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"

mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\11\config\ereg\Ereg.ini

mRun: [brMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN

mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun

dRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNotify.exe

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

dRunOnce: [sRUUninstall] "c:\windows\system32\msiexec.exe" /x {6AF90EF6-F7F9-466C-99F4-1774826FBB40} /qn REBOOT=ReallySuppress

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\soulsis\startm~1\programs\startup\suprem~1.lnk - c:\program files\supreme office suite3.0\program\quickstart.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\albumf~1.lnk - c:\program files\ulead systems\ulead photoimpact 6\ABMTSR.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

uPolicies-explorer: NoThemesTab = 0 (0x0)

uPolicies-system: NoColorChoice = 0 (0x0)

uPolicies-system: NoSizeChoice = 0 (0x0)

uPolicies-system: NoVisualStyleChoice = 0 (0x0)

uPolicies-system: NoDispSettingsPage = 0 (0x0)

uPolicies-system: NoDispAppearancePage = 0 (0x0)

mPolicies-explorer: <NO NAME> =

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: &Search - http://kb.bar.need2find.com/KB/menusearch.html?p=KB

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL

DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: ppctlcab - hxxp://ppupdates.ca.com/downloads/scanner/ppctlcab.cab

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab

DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} - hxxp://download.mcafee.com/molbin/Shared/MGBrwFld.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} - hxxps://ehelp.nelnet.net/netagent/objects/custappx3.CAB

DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} - hxxp://ppupdates.ca.com/downloads/scanner/axscanner.cab

DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,56/mcinsctl.cab

DPF: {4B48D5DF-9021-45F7-A240-60304302A215} - hxxp://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab

DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab

DPF: {56393399-041A-4650-94C7-13DFCB1F4665} - hxxp://www.my-etrust.com/Support/PestScanner/pestscan.cab

DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} - hxxp://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105193306109

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129601807465

DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} - hxxp://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab

DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab

DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://www.windowsecurity.com/trojanscan/axscan.cab

DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - hxxp://fdl.msn.com/zone/datafiles/heartbeat.cab

DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4524/mcfscan.cab

SSODL: SysTray.Exgr - {5368D1FC-4F5C-4f1b-B134-E67214FC78E9} - c:\windows\system32\qhqpdiof.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\soulsis\applic~1\mozilla\firefox\profiles\vu693bl9.default\

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-5 64160]

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-7-28 214664]

R2 kqemu;kqemu driver;c:\windows\system32\drivers\kqemu.sys [2007-2-6 123939]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456]

R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-7-28 359952]

R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-7-28 144704]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-7-28 606736]

R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-7-28 79816]

R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-7-28 35272]

R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-7-28 40552]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-23 135664]

S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-7-28 34248]

=============== Created Last 30 ================

2010-03-12 04:02:15 0 ----a-w- c:\documents and settings\soulsis\defogger_reenable

2010-03-10 01:57:08 3555328 ------w- c:\windows\system32\dllcache\moviemk.exe

2010-03-07 21:19:41 0 d-s---w- C:\ComboFix

==================== Find3M ====================

2010-02-24 15:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe

2009-12-31 16:14:12 352640 ------w- c:\windows\system32\dllcache\srv.sys

2009-12-16 12:58:04 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-16 12:58:04 343040 ------w- c:\windows\system32\dllcache\mspaint.exe

2009-12-16 12:57:07 18432 ------w- c:\windows\system32\dllcache\iedw.exe

2009-12-14 07:35:35 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-14 07:35:35 33280 ------w- c:\windows\system32\dllcache\csrsrv.dll

2003-11-28 05:33:29 267472 -c--a-w- c:\program files\NSSetup.exe

2003-08-23 04:28:23 5327648 -c--a-w- c:\program files\WindowsXP-KB821557-x86-ENU.exe

2003-08-13 18:25:39 1291040 ----a-w- c:\program files\WindowsXP-KB823980-x86-ENU.exe

2003-02-13 21:51:10 207759 -c--a-w- c:\program files\INSTALL.LOG

============= FINISH: 22:27:07.76 ===============

ATTACH.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 2/19/2003 10:07:13 PM

System Uptime: 3/11/2010 10:09:13 PM (0 hours ago)

Motherboard: Dell Computer Corp. | |

Processor: Intel® Pentium® 4 CPU 2.40GHz | Microprocessor | 2392/533mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 56 GiB total, 21.117 GiB free.

D: is CDROM ()

E: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP2599: 1/18/2010 12:07:56 AM - System Checkpoint

RP2600: 1/18/2010 9:34:37 PM - Software Distribution Service 3.0

RP2601: 1/19/2010 10:00:27 PM - Software Distribution Service 3.0

RP2602: 1/20/2010 11:02:22 PM - System Checkpoint

RP2603: 1/21/2010 9:46:37 AM - Software Distribution Service 3.0

RP2604: 1/22/2010 10:33:03 AM - System Checkpoint

RP2605: 1/22/2010 10:00:23 PM - Software Distribution Service 3.0

RP2606: 1/24/2010 8:34:03 AM - System Checkpoint

RP2607: 1/25/2010 9:23:08 AM - System Checkpoint

RP2608: 1/26/2010 9:24:16 AM - System Checkpoint

RP2609: 1/27/2010 1:37:57 AM - Software Distribution Service 3.0

RP2610: 1/28/2010 3:08:35 AM - System Checkpoint

RP2611: 1/28/2010 8:20:06 PM - Software Distribution Service 3.0

RP2612: 1/29/2010 9:17:24 PM - System Checkpoint

RP2613: 1/31/2010 2:11:07 AM - System Checkpoint

RP2614: 2/1/2010 3:59:06 AM - System Checkpoint

RP2615: 2/1/2010 8:24:55 PM - Software Distribution Service 3.0

RP2616: 2/2/2010 9:37:00 PM - System Checkpoint

RP2617: 2/3/2010 10:22:58 PM - System Checkpoint

RP2618: 2/4/2010 11:22:50 PM - System Checkpoint

RP2619: 2/5/2010 1:41:32 AM - Software Distribution Service 3.0

RP2620: 2/6/2010 3:07:39 AM - System Checkpoint

RP2621: 2/7/2010 3:20:22 AM - System Checkpoint

RP2622: 2/8/2010 6:01:56 AM - System Checkpoint

RP2623: 2/8/2010 11:02:40 AM - Software Distribution Service 3.0

RP2624: 2/9/2010 11:20:22 AM - System Checkpoint

RP2625: 2/10/2010 11:30:04 AM - System Checkpoint

RP2626: 2/10/2010 10:00:31 PM - Software Distribution Service 3.0

RP2627: 2/11/2010 5:09:03 PM - Software Distribution Service 3.0

RP2628: 2/12/2010 5:21:11 PM - System Checkpoint

RP2629: 2/13/2010 5:23:27 PM - System Checkpoint

RP2630: 2/14/2010 5:31:55 PM - System Checkpoint

RP2631: 2/15/2010 6:24:30 PM - System Checkpoint

RP2632: 2/15/2010 10:38:36 PM - Software Distribution Service 3.0

RP2633: 2/16/2010 11:23:25 PM - System Checkpoint

RP2634: 2/18/2010 12:23:04 AM - System Checkpoint

RP2635: 2/18/2010 10:07:56 AM - Software Distribution Service 3.0

RP2636: 2/19/2010 10:30:13 AM - System Checkpoint

RP2637: 2/20/2010 11:29:11 AM - System Checkpoint

RP2638: 2/21/2010 12:11:35 PM - System Checkpoint

RP2639: 2/22/2010 12:22:46 PM - System Checkpoint

RP2640: 2/22/2010 2:02:45 PM - Software Distribution Service 3.0

RP2641: 2/23/2010 2:53:34 PM - System Checkpoint

RP2642: 2/24/2010 5:20:23 PM - System Checkpoint

RP2643: 2/24/2010 10:00:21 PM - Software Distribution Service 3.0

RP2644: 2/25/2010 1:34:02 AM - Software Distribution Service 3.0

RP2645: 2/25/2010 2:04:53 AM - Windows Defender Checkpoint

RP2646: 2/25/2010 2:02:33 PM - Software Distribution Service 3.0

RP2647: 2/26/2010 3:09:50 PM - System Checkpoint

RP2648: 2/27/2010 5:03:32 PM - System Checkpoint

RP2649: 2/28/2010 5:32:44 PM - System Checkpoint

RP2650: 3/1/2010 7:28:35 PM - System Checkpoint

RP2651: 3/1/2010 7:38:40 PM - Software Distribution Service 3.0

RP2652: 3/2/2010 2:55:26 AM - Windows Defender Checkpoint

RP2653: 3/3/2010 3:06:22 AM - System Checkpoint

RP2654: 3/4/2010 3:57:20 AM - System Checkpoint

RP2655: 3/5/2010 1:25:50 AM - Software Distribution Service 3.0

RP2656: 3/6/2010 3:45:04 AM - System Checkpoint

RP2657: 3/7/2010 1:38:23 PM - System Checkpoint

RP2658: 3/8/2010 7:49:11 PM - Software Distribution Service 3.0

RP2659: 3/9/2010 8:28:29 PM - System Checkpoint

RP2660: 3/9/2010 10:00:37 PM - Software Distribution Service 3.0

RP2661: 3/10/2010 11:21:20 PM - System Checkpoint

RP2662: 3/11/2010 12:50:43 PM - Software Distribution Service 3.0

==== Installed Programs ======================

Ad-Aware

Adobe Acrobat 5.0

Adobe Flash Player 10 Plugin

Adobe Flash Player 9 ActiveX

Adobe Reader 9.1

BCM V.92 56K Modem

BodyMedia Activity Manager

Borland C++BuilderX

Britannica Ready Reference

Brother MFL-Pro Suite

CDex extraction audio

Classic PhoneTools

Comcast High-Speed Internet Install Wizard

Dell Modem-On-Hold

Dell Picture Studio - Dell Image Expert

Dell Solution Center

DellSupport

Digital Line Detect

Diskeeper 2008 Pro Premier

DVDSentry

Easy CD Creator 5 Basic

FaceFilter Studio Brother Edition

GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)

GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)

GnuCash 2.2.8

Google SketchUp 6

Google Toolbar for Internet Explorer

Google Update Helper

Help and Support Customization

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

InfraRecorder

Intel® PRO Ethernet Adapter and Software

Intel® PROSet II

IrfanView (remove only)

Java 6 Update 15

Java 6 Update 7

KODAK EASYSHARE Gallery Upload ActiveX Control

KODAK Gallery Upload Software

Learn2 Player (Uninstall Only)

LiveUpdate 2.5 (Symantec Corporation)

Macromedia Shockwave Player

Malwarebytes' Anti-Malware

McAfee SecurityCenter

Microsoft .NET Framework (English)

Microsoft .NET Framework (English) v1.0.3705

Microsoft .NET Framework 1.0 Hotfix (KB928367)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft MSDN 2005 Express Edition - ENU

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Excel MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Small Business 2007

Microsoft Office Small Business 2007 Trial

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)

Microsoft SQL Server 2005 Tools Express Edition

Microsoft SQL Server Native Client

Microsoft SQL Server Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft Visual C# 2005 Express Edition - ENU

Microsoft Visual C# 2005 Express Edition - ENU Service Pack 1 (KB926749)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Express Edition - ENU

Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework

Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32

Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries

Modem Helper

Mozilla Firefox (3.6)

MSDN Library for Microsoft Visual Studio 2008 Express Editions

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6 Service Pack 2 (KB973686)

MUSICMATCH

Edited by Maurice Naggar
ATTACH.txt placed In-line
Link to post
Share on other sites

Hello picqhaw.

I will be helping you to remove this malware infection. Please follow my guidance.

You will want to print out or copy these instructions to Notepad for offline reference!

eusa_hand.gif

If you are a casual viewer, do NOT try this on your system!

If you are not picqhaw and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

icon_arrow.gif Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 3

Download TFC by OldTimer to your desktop

  • Please double-click TFC.exe to run it. (Note: If you are running on Vista or Windows 7, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  • IF prompted to Reboot, reply "Yes".

Step 4

Download & SAVE OTL by OldTimer to your desktop from one of the following links: Link1 or

Link2

  • Close all open windows on the Task Bar. Double click on OTL (for Vista, right click the icon and Run as Administrator) to start the program.
  • In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
  • Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
  • It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
  • Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
  • Exit OTL by clicking the X at top right.

Step 5

Download Security Check by screen317 and save it to your Desktop: here or here

  • Run Security Check
  • Follow the onscreen instructions inside of the command window.
  • A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

eusa_hand.gifIf one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Step 6

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

Double-click gmer.exe. The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

  • Click Yes.
  • Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  • Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

  • Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  • Save it where you can easily find it, such as your desktop.

Then copy/paste the following into your post (in order):

  • the contents of OTL.txt
  • the contents of Extras.txt
  • the contents of checkup.txt
  • the contents of GMER.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Link to post
Share on other sites

Again, GMER did not run succesfully and I ended up with a blue screen. I don't want to take a chance and ruin my desktop until I hear back from you. I did close all applications, but I wonder if McAfee is doing something in the background.

##################################

the contents of OTL.txt

OTL logfile created on: 3/19/2010 10:29:42 PM - Run 1

OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\soulsis\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 331.00 Mb Available Physical Memory | 32.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 60.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 55.84 Gb Total Space | 21.41 Gb Free Space | 38.34% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Unable to calculate disk information.

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: SOULSISTAH

Current User Name: soulsis

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/19 22:09:50 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

PRC - [2010/03/01 23:41:24 | 001,029,456 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

PRC - [2009/10/29 07:54:44 | 001,218,008 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe

PRC - [2009/10/27 12:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe

PRC - [2009/09/16 10:22:08 | 000,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe

PRC - [2009/09/16 09:28:38 | 000,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe

PRC - [2009/07/10 00:26:20 | 000,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe

PRC - [2009/07/08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe

PRC - [2009/07/07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe

PRC - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

PRC - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

PRC - [2008/11/24 22:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

PRC - [2008/04/04 15:56:18 | 001,123,608 | ---- | M] (Diskeeper Corporation) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

PRC - [2007/08/22 09:45:11 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

PRC - [2007/06/13 05:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/03/23 13:14:52 | 000,663,552 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

PRC - [2007/03/06 19:20:00 | 000,536,576 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe

PRC - [2007/03/02 16:56:52 | 000,077,824 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

PRC - [2007/01/29 21:12:14 | 000,030,248 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

PRC - [2006/11/03 19:20:12 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe

PRC - [2005/02/05 22:40:35 | 000,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2002/08/14 19:22:52 | 000,028,672 | R--- | M] (Dell - Advanced Desktop Engineering) -- C:\WINDOWS\SYSTEM32\DSentry.exe

PRC - [2002/07/04 07:00:00 | 000,303,104 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Supreme Office Suite3.0\program\soffice.exe

PRC - [2002/04/10 16:44:04 | 000,679,936 | ---- | M] (Roxio) -- C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

PRC - [2002/02/15 11:31:42 | 000,045,056 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe

========== Modules (SafeList) ==========

MOD - [2010/03/19 22:09:50 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

MOD - [2006/08/25 10:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/03/01 23:41:24 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2009/10/27 12:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)

SRV - [2009/09/16 11:23:32 | 000,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)

SRV - [2009/09/16 10:22:08 | 000,144,704 | ---- | M] (McAfee, Inc.) [unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)

SRV - [2009/09/16 09:28:38 | 000,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)

SRV - [2009/07/10 00:26:20 | 000,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)

SRV - [2009/07/08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)

SRV - [2009/07/07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)

SRV - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS)

SRV - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)

SRV - [2008/11/24 22:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)

SRV - [2008/11/24 22:31:08 | 000,045,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)

SRV - [2008/04/04 15:56:18 | 001,123,608 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe -- (Diskeeper)

SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)

SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV - [2002/05/03 12:29:42 | 001,118,208 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\NMSSvc.Exe -- (NMSSvc) Intel®

========== Driver Services (SafeList) ==========

DRV - [2009/09/16 10:22:48 | 000,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfehidk.sys -- (mfehidk)

DRV - [2009/09/16 10:22:48 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys -- (mfeavfk)

DRV - [2009/09/16 10:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys -- (mfesmfk)

DRV - [2009/09/16 10:22:48 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys -- (mfebopk)

DRV - [2009/09/16 10:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys -- (mferkdk)

DRV - [2009/07/16 12:32:26 | 000,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Mpfp.sys -- (MPFP)

DRV - [2009/07/15 11:13:00 | 000,071,488 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ftser2k.sys -- (FTSER2K)

DRV - [2009/07/15 11:13:00 | 000,053,184 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ftdibus.sys -- (FTDIBUS)

DRV - [2009/07/03 09:49:08 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)

DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys -- (dsunidrv)

DRV - [2007/02/06 16:02:00 | 000,123,939 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\kqemu.sys -- (kqemu)

DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)

DRV - [2005/07/26 22:41:18 | 000,059,440 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cdr4_xp.sys -- (Cdr4_xp)

DRV - [2005/07/26 22:41:18 | 000,023,724 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cdralw2k.sys -- (Cdralw2k)

DRV - [2004/12/20 19:58:18 | 000,110,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)

DRV - [2004/08/04 01:08:21 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)

DRV - [2004/08/04 01:07:42 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)

DRV - [2004/08/04 01:07:42 | 000,041,088 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)

DRV - [2004/08/04 00:29:49 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)

DRV - [2004/08/04 00:29:47 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)

DRV - [2004/08/04 00:29:45 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)

DRV - [2004/08/04 00:29:43 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)

DRV - [2004/08/04 00:29:42 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)

DRV - [2004/08/04 00:29:41 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)

DRV - [2004/08/04 00:29:37 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)

DRV - [2004/08/04 00:29:37 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)

DRV - [2004/08/04 00:29:37 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)

DRV - [2004/08/04 00:29:36 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)

DRV - [2004/03/22 23:23:31 | 000,028,276 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\MxlW2k.sys -- (MxlW2k)

DRV - [2003/10/06 15:16:00 | 001,550,043 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)

DRV - [2003/08/29 04:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)

DRV - [2002/08/30 17:29:02 | 001,293,440 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\P16X.sys -- (P16X) Creative SB Live! Series (WDM)

DRV - [2002/07/19 11:22:08 | 000,017,153 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)

DRV - [2002/05/03 12:30:08 | 000,009,868 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NMSCFG.SYS -- (NMSCFG)

DRV - [2002/04/10 17:01:12 | 000,024,554 | ---- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\Dvd_2k.sys -- (dvd_2K)

DRV - [2002/04/10 17:01:00 | 000,029,638 | ---- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Mmc_2k.sys -- (mmc_2K)

DRV - [2002/04/10 17:00:44 | 000,117,898 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\pwd_2K.sys -- (pwd_2k)

DRV - [2002/04/10 16:48:04 | 000,236,032 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cdudf_xp.sys -- (cdudf_xp)

DRV - [2002/04/10 16:45:16 | 000,206,336 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\udfreadr_xp.sys -- (UdfReadr_xp)

DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow)

DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3)

DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi)

DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx)

DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810)

DRV - [2001/08/17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\MODEMCSA.sys -- (MODEMCSA)

DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra)

DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160)

DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080)

DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280)

DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k)

DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x)

DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc)

DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550)

DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde)

DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde)

DRV - [2001/08/17 13:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)

DRV - [1999/12/17 02:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\PFMODNT.SYS -- (PfModNT)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/11 23:06:54 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/11 23:06:53 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2006/08/15 21:18:49 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2010/03/12 02:10:00 | 000,000,000 | ---D | M]

[2009/03/31 23:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\Mozilla\Extensions

[2010/03/19 11:37:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\Mozilla\Firefox\Profiles\vu693bl9.default\extensions

[2009/09/05 11:56:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\soulsis\Application Data\Mozilla\Firefox\Profiles\vu693bl9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/03/19 11:37:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2004/01/27 17:35:01 | 000,000,734 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..\Toolbar\ShellBrowser: (no name) - {0494D0D9-F8E0-41AD-92A3-14154ECE70AC} - No CLSID value found.

O3 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)

O4 - HKLM..\Run: [brMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [diagent] C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)

O4 - HKLM..\Run: [eTrustPPAP] C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe File not found

O4 - HKLM..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [sSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [updReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\.DEFAULT..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE (Symantec Corporation)

O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)

O4 - HKU\S-1-5-18..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE (Symantec Corporation)

O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)

O4 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005..\RunOnce: [DelayShred] c:\program files\mcafee.com\shredder\SHRED32.EXE (McAfee, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Album Fast Start.lnk = C:\Program Files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE (Ulead Systems, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

O4 - Startup: C:\Documents and Settings\Limited\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe File not found

O4 - Startup: C:\Documents and Settings\soulsis\Start Menu\Programs\Startup\Supreme Office Suite 3.0.lnk = C:\Program Files\Supreme Office Suite3.0\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = _ [binary data]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThemesTab = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoColorChoice = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoSizeChoice = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoVisualStyleChoice = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0

O7 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)

O15 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..Trusted Domains: ([]msn in My Computer)

O15 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} http://download.mcafee.com/molbin/Shared/MGBrwFld.cab (BrowseFolderPopup Class)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)

O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://ehelp.nelnet.net/netagent/objects/custappx3.CAB (eAssist NetAgent Customer ActiveX Control version 3)

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} http://ppupdates.ca.com/downloads/scanner/axscanner.cab (PPSDKActiveXScanner.MainScreen)

O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} http://download.mcafee.com/molbin/shared/m...56/mcinsctl.cab (McAfee.com Download+Installer Class)

O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} http://download.microsoft.com/download/b/d.../WebCleaner.cab (Malicious Software Removal Tool)

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...84/mcinsctl.cab (McAfee.com Operating System Class)

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} http://www.my-etrust.com/Support/PestScanner/pestscan.cab (PSFormX Control)

O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} http://www.amiuptodate.com/vsc/bin/1,0,0,8...pdatePortal.cab (McUpdatePortalFactory Class)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co...b?1105193306109 (WUWebControl Class)

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab (Symantec RuFSI Utility Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1129601807465 (MUWebControl Class)

O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} http://cdn2.zone.msn.com/binframework/v10/...gr.cab31267.cab (ZoneAxRcMgr Class)

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...ro.cab55579.cab (MSN Games - Installer)

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://www.windowsecurity.com/trojanscan/axscan.cab (ASquaredScanForm Element)

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/m...,21/mcgdmgr.cab (DwnldGroupMgr Class)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} http://fdl.msn.com/zone/datafiles/heartbeat.cab (HeartbeatCtl Class)

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/...524/mcfscan.cab (McFreeScan Class)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O16 - DPF: ppctlcab http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.20.1

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/html - No CLSID value found

O18 - Protocol\Filter\text/plain - No CLSID value found

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O21 - SSODL: SysTray.Exgr - {5368D1FC-4F5C-4f1b-B134-E67214FC78E9} - C:\WINDOWS\System32\qhqpdiof.dll File not found

O24 - Desktop WallPaper: C:\Documents and Settings\soulsis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\soulsis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2002/09/03 14:36:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{52664c08-1db1-11dc-afd0-0007e9d3ac51}\Shell\AutoRun\command - "" = F:\wd_windows_tools\setup.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/19 22:09:45 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

[2010/03/19 22:09:00 | 000,444,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\TFC.exe

[2010/03/19 14:55:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

[2010/03/19 12:03:35 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2010/03/19 11:51:40 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\soulsis\Desktop\erunt-setup.exe

[2010/03/19 09:46:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW

[2010/03/19 09:46:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR

[2010/03/19 09:46:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE

[2010/03/19 09:46:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK

[2010/03/19 09:46:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA

[2010/03/12 02:10:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

[2010/03/12 02:10:08 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010/03/12 02:10:02 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010/03/12 02:10:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010/03/12 02:10:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010/03/11 23:23:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\soulsis\My Documents\Downloads

[2010/03/09 20:57:08 | 003,555,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe

[2010/03/09 01:40:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real

[2010/03/07 16:19:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/03/07 16:19:41 | 000,000,000 | --SD | C] -- C:\ComboFix

[2010/03/07 16:14:42 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/02/23 15:37:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google

[2010/02/23 15:33:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google

[2010/01/01 15:21:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe

[2009/12/19 07:05:15 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

[2009/12/19 07:05:15 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

[2009/12/19 06:59:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

[2009/12/19 06:59:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

[2008/07/06 10:52:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla

[2008/07/06 10:52:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla

[2008/02/18 10:09:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Google

[2006/12/17 02:59:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth

[2005/02/03 00:18:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia

[2005/01/09 12:39:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Symantec

[2003/08/22 23:28:23 | 005,327,648 | ---- | C] (Microsoft Corporation) -- C:\Program Files\WindowsXP-KB821557-x86-ENU.exe

[2003/08/13 13:25:39 | 001,291,040 | ---- | C] (Microsoft Corporation) -- C:\Program Files\WindowsXP-KB823980-x86-ENU.exe

[2003/02/13 16:43:21 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll

========== Files - Modified Within 30 Days ==========

[2010/03/19 22:48:07 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/03/19 22:28:58 | 000,025,237 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF

[2010/03/19 22:27:46 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job

[2010/03/19 22:27:37 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL

[2010/03/19 22:25:33 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job

[2010/03/19 22:25:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/03/19 22:24:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/03/19 22:24:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT

[2010/03/19 22:24:08 | 1072,766,976 | -HS- | M] () -- C:\hiberfil.sys

[2010/03/19 22:23:10 | 007,864,320 | ---- | M] () -- C:\Documents and Settings\soulsis\ntuser.dat

[2010/03/19 22:23:10 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\soulsis\NTUSER.INI

[2010/03/19 22:13:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\gmer.zip

[2010/03/19 22:11:06 | 000,843,187 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\SecurityCheck.exe

[2010/03/19 22:09:50 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

[2010/03/19 22:09:04 | 000,444,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\TFC.exe

[2010/03/19 22:08:03 | 000,000,439 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\Shortcut to Shared Documents.lnk

[2010/03/19 22:00:00 | 000,000,382 | ---- | M] () -- C:\WINDOWS\tasks\gspsvdho.job

[2010/03/19 22:00:00 | 000,000,382 | ---- | M] () -- C:\WINDOWS\tasks\gchejtpe.job

[2010/03/19 11:52:11 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\soulsis\Desktop\erunt-setup.exe

[2010/03/17 22:41:38 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2010/03/17 15:03:13 | 000,483,160 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT

[2010/03/17 15:03:12 | 000,086,608 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT

[2010/03/17 15:03:09 | 000,580,614 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/03/15 01:00:00 | 000,000,344 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job

[2010/03/12 09:25:35 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn

[2010/03/12 01:27:49 | 000,050,113 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\MS_windows_error.JPG

[2010/03/11 23:30:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\l0gpyk1r.exe

[2010/03/11 23:28:42 | 000,004,806 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\Attach.rar

[2010/03/11 23:23:37 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\dds.scr

[2010/03/11 23:02:15 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\soulsis\defogger_reenable

[2010/03/11 23:01:37 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\Defogger.exe

[2010/03/10 08:19:43 | 000,027,797 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\pop-up.JPG

[2010/03/09 01:43:39 | 000,004,654 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI

[2010/03/07 06:00:16 | 000,006,456 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\sugahono

[2010/03/06 03:47:11 | 000,078,137 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\rogue_site.JPG

[2010/03/01 02:00:00 | 000,000,336 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job

[2010/02/24 23:00:57 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/02/24 10:16:06 | 000,181,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe

========== Files Created - No Company Name ==========

[2010/03/19 22:13:08 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\gmer.zip

[2010/03/19 22:11:03 | 000,843,187 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\SecurityCheck.exe

[2010/03/12 01:27:49 | 000,050,113 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\MS_windows_error.JPG

[2010/03/11 23:30:15 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\l0gpyk1r.exe

[2010/03/11 23:28:42 | 000,004,806 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\Attach.rar

[2010/03/11 23:23:32 | 000,524,288 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\dds.scr

[2010/03/11 23:02:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\soulsis\defogger_reenable

[2010/03/11 23:01:33 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\Defogger.exe

[2010/03/10 08:19:43 | 000,027,797 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\pop-up.JPG

[2010/03/07 18:08:20 | 1072,766,976 | -HS- | C] () -- C:\hiberfil.sys

[2010/03/06 03:47:11 | 000,078,137 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\rogue_site.JPG

[2010/03/05 23:43:08 | 000,000,382 | ---- | C] () -- C:\WINDOWS\tasks\gchejtpe.job

[2010/02/24 03:28:31 | 000,000,382 | ---- | C] () -- C:\WINDOWS\tasks\gspsvdho.job

[2010/02/23 15:32:57 | 000,000,886 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/02/23 15:32:52 | 000,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2009/10/14 09:42:06 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2009/10/14 09:42:06 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2009/10/14 09:41:22 | 000,001,134 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini

[2009/10/14 09:41:22 | 000,000,180 | ---- | C] () -- C:\WINDOWS\brpcfx.ini

[2009/10/14 09:39:03 | 000,000,086 | ---- | C] () -- C:\WINDOWS\Brfaxrx.ini

[2009/10/14 09:39:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll

[2009/10/14 09:28:07 | 000,031,567 | ---- | C] () -- C:\WINDOWS\maxlink.ini

[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/05/01 03:29:51 | 000,006,456 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\sugahono

[2008/07/04 13:55:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QFN.ini

[2008/07/04 13:55:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QDQICK.ini

[2007/09/15 17:00:01 | 000,001,486 | ---- | C] () -- C:\WINDOWS\NETG.INI

[2007/08/12 14:28:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007/05/13 18:15:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pestpatrol5.INI

[2007/02/06 16:02:00 | 000,123,939 | ---- | C] () -- C:\WINDOWS\System32\drivers\kqemu.sys

[2006/01/02 16:18:43 | 000,000,030 | ---- | C] () -- C:\WINDOWS\iedit.INI

[2005/12/01 01:48:27 | 000,004,654 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI

[2005/01/10 22:55:20 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\soulsis\Local Settings\Application Data\fusioncache.dat

[2004/01/27 17:30:22 | 000,000,024 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2004/01/27 17:29:59 | 000,000,006 | ---- | C] () -- C:\WINDOWS\msoffice.ini

[2003/11/28 00:33:28 | 000,267,472 | ---- | C] () -- C:\Program Files\NSSetup.exe

[2003/10/06 15:16:00 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\nvcod.dll

[2003/09/13 23:07:11 | 000,056,320 | ---- | C] () -- C:\Documents and Settings\soulsis\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2003/06/07 21:51:37 | 000,000,536 | ---- | C] () -- C:\WINDOWS\_delis32.ini

[2003/05/28 12:15:07 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\ctavp4.dll

[2003/03/20 01:10:04 | 000,002,048 | ---- | C] () -- C:\Documents and Settings\soulsis\Application Data\user60.rdb

[2003/03/20 01:08:01 | 000,000,095 | ---- | C] () -- C:\Documents and Settings\soulsis\Application Data\sversion.ini

[2003/03/11 23:54:49 | 000,017,493 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2003/02/20 23:03:19 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\soulsis\Application Data\PFP100JPR.{PB

[2003/02/20 23:03:18 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\soulsis\Application Data\PFP100JCM.{PB

[2003/02/13 16:57:21 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2003/02/13 16:51:08 | 000,207,759 | ---- | C] () -- C:\Program Files\INSTALL.LOG

[2003/02/13 16:46:47 | 000,000,185 | ---- | C] () -- C:\WINDOWS\intuprof.ini

[2003/02/13 16:46:45 | 000,000,793 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI

[2003/02/13 16:43:47 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI

[2003/02/13 16:43:21 | 000,039,936 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll

[2003/02/13 16:43:21 | 000,002,092 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini

[2003/02/13 16:43:21 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini

[2003/02/13 16:43:20 | 000,006,175 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI

[2003/02/13 16:43:20 | 000,005,917 | ---- | C] () -- C:\WINDOWS\SBMIXDEF.INI

[2003/02/13 16:43:20 | 000,000,064 | ---- | C] () -- C:\WINDOWS\P16x.ini

[2003/02/13 16:42:38 | 000,000,245 | ---- | C] () -- C:\WINDOWS\SBWIN.INI

[2003/02/13 16:38:29 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2003/02/13 16:17:18 | 000,000,550 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2002/02/06 10:04:14 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\NMSInst.dll

[2002/01/21 16:17:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PROInst.dll

========== LOP Check ==========

[2003/02/13 16:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software

[2007/05/13 18:10:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA

[2008/11/21 01:30:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation

[2009/08/05 23:11:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations

[2007/09/30 14:58:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft

[2004/06/26 01:21:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pixelStorm

[2005/03/20 03:19:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap

[2009/10/14 09:28:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft

[2004/12/11 11:21:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2007/01/08 12:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip

[2009/08/05 22:20:21 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}

[2007/12/06 00:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Limited\Application Data\InfraRecorder

[2007/03/06 06:42:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Limited\Application Data\Learn2.com

[2009/06/27 11:19:13 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Limited\Application Data\lowsec

[2009/12/12 16:04:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Limited\Application Data\PC-FAX TX

[2009/12/23 16:40:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Limited\Application Data\ScanSoft

[2007/01/31 01:23:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Limited\Application Data\Viewpoint

[2010/01/03 01:44:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\GetRightToGo

[2010/01/05 04:47:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\gtk-2.0

[2007/11/07 01:03:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\InfraRecorder

[2003/02/20 01:30:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\InterTrust

[2009/12/12 16:33:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\PC-FAX TX

[2007/08/22 10:07:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\SecondLife

[2007/04/14 00:25:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\Viewpoint

[2010/03/17 22:41:38 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

[2010/03/19 22:00:00 | 000,000,382 | ---- | M] () -- C:\WINDOWS\Tasks\gchejtpe.job

[2010/03/19 22:00:00 | 000,000,382 | ---- | M] () -- C:\WINDOWS\Tasks\gspsvdho.job

[2010/03/15 01:00:00 | 000,000,344 | ---- | M] () -- C:\WINDOWS\Tasks\McDefragTask.job

[2010/03/01 02:00:00 | 000,000,336 | ---- | M] () -- C:\WINDOWS\Tasks\McQcTask.job

[2010/03/19 22:27:46 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

[2010/03/19 22:25:33 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

< End of report >

##################################

the contents of Extras.txt

OTL Extras logfile created on: 3/19/2010 10:29:42 PM - Run 1

OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\soulsis\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 331.00 Mb Available Physical Memory | 32.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 60.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 55.84 Gb Total Space | 21.41 Gb Free Space | 38.34% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Unable to calculate disk information.

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: SOULSISTAH

Current User Name: soulsis

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Supreme Office Suite3.0\program\soffice.exe" "%1" (Sun Microsystems, Inc.)

http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2 -- File not found

"C:\Program Files\Kazaa\kazaa.exe" = C:\Program Files\Kazaa\kazaa.exe:*:Enabled:Kazaa -- File not found

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- File not found

"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- File not found

"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- File not found

"C:\Program Files\gnucash\bin\gnucash-bin.exe" = C:\Program Files\gnucash\bin\gnucash-bin.exe:*:Enabled:GnuCash Free Finance Manager -- ()

"C:\Program Files\gnucash\bin\gconfd-2.exe" = C:\Program Files\gnucash\bin\gconfd-2.exe:*:Enabled:GConf Settings Manager -- ()

"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent -- (McAfee, Inc.)

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{01A4AEDE-F219-49A2-B855-16A016EAF9A4}" = Intel® PROSet II

"{07FCBED5-94C3-4F94-B9D3-360FA27C7B06}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32

"{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center

"{151C555A-A9E7-4A2E-B6D7-165D04A3C956}" = Dell Picture Studio - Dell Image Expert

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{23E5C72C-CC08-4EE0-9CC2-D925B232B331}" = Microsoft MSDN 2005 Express Edition - ENU

"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java 6 Update 18

"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition

"{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Office 2002

"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3BCC5640-5360-11D4-A44A-0000E86D2305}" = Ulead Drop Spot 1.0

"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Dell Modem-On-Hold

"{45893FEB-30FD-4034-8661-3BA4238FE67A}" = Britannica Ready Reference

"{45EBDA59-D33B-433A-956E-B2F236468B56}" = MUSICMATCH

Link to post
Share on other sites

Hello picghaw.

You will want to print out or copy these instructions to Notepad for offline reference!

eusa_hand.gifIf you are a casual viewer, do NOT try this on your system!

If you are not picghaw and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

icon_arrow.gif Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Step 1

Open McAfee Security Center

  • Under Common Tasks click on Home
  • Click Computer Files
  • Click Configure
  • Make sure the following are disabled by ticking the "Off" button.
    Virus protection
    Spyware protection
    System Guards Protection
    Script Scanning Protection (you may have to scroll down to see it)
  • Next, select never for "When to re-enable real time scanning"
  • and click OK.

Step 2

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

  • Double-click FixPolicies.exe.
  • Click the "Install" button on the bottom toolbar of the box that will open.
  • The program will create a new Folder called FixPolicies.
  • Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
  • A black box will briefly appear and then close.
  • This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.

Step 3

  • Please double-click OTL.com otlDesktopIcon.png to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy all the lines in between the **** stars lines **** below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    *****************************************************************
    :OTL
    O3 - HKU\S-1-5-21-1143873491-3534893803-2643926262-1005\..\Toolbar\ShellBrowser: (no name) - {0494D0D9-F8E0-41AD-92A3-14154ECE70AC} - No CLSID value found.
    :files
    C:\recycler
    D:\recycler
    e:\recycler
    f:\recycler
    g:\recycler
    h:\recycler
    :reg
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52664c08-1db1-11dc-afd0-0007e9d3ac51}]
    :Commands
    [purity]
    [emptytemp]
    [CREATERESTOREPOINT]
    *****************************************************************
  • Return to OTL. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
  • Close any browser(s) windows that may be open.
  • Using your mouse, click on the red-lettered button Run Fix.
  • Once you see a message box "Fix complete! Click OK to open the fix log."
    Click the OK button
  • The log will open in Notepad (your default text editor).
  • Save the log. Post a copy of that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.

If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Step 4

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1

Link 2

Link 3

CF_download_FF.gif

CF_download_rename.gif

* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop

If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Double click on Combo-Fix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

whatnext.png

Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

-------------------------------------------------------

A caution - Do not run Combofix more than once.

Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.

If this occurs, please reboot to restore the desktop.

RE-Enable your AntiVirus and AntiSpyware applications.

Step 5

Reply with copy of OTL MovedFiles log

and C:\Combofix.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Link to post
Share on other sites

FYI: I missed the part that said to watch ComboFix while it runs, I made sure I waited until the MicroSoft Console Recovery was install and ComboFix started then I left to run errands, so I don't know if I missed anything

#############################

copy of OTL MovedFiles log : It did require a reboot

All processes killed

========== OTL ==========

Registry value HKEY_USERS\S-1-5-21-1143873491-3534893803-2643926262-1005\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}\ not found.

File KEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52664c08-1db1-11dc-afd0-0007e9d3ac51}] not found.

File rity] not found.

File ptytemp] not found.

File EATERESTOREPOINT] not found.

OTL by OldTimer - Version 3.1.37.3 log created on 03202010_111412

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#############################

ComboFix.txt

ComboFix 10-03-19.08 - soulsis 03/20/2010 11:44:58.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.564 [GMT -5:00]

Running from: c:\documents and settings\soulsis\Desktop\ComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\INSTALL.LOG

c:\recycler\NPROTECT

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\Downloaded Program Files\Quarantine

c:\windows\Fonts\acrsec.fon

c:\windows\Readme.txt

c:\windows\system32\cache329

c:\windows\system32\cache329\B_329_0_0_106800.htm

c:\windows\system32\cache329\B_329_0_0_107400.htm

c:\windows\system32\cache329\B_329_0_0_446800.htm

c:\windows\system32\cache329\B_329_0_0_446900.htm

c:\windows\system32\cache329\B_329_1_0_449200.gif

c:\windows\system32\cache329\B_329_1_0_449200.htm

c:\windows\system32\cache329\B_329_1_0_449600.htm

c:\windows\system32\cache329\B_329_1_0_454300.gif

c:\windows\system32\cache329\B_329_1_0_454300.htm

c:\windows\system32\cache329\B_329_2_0_106800.htm

c:\windows\system32\cache329\B_329_2_0_107400.htm

c:\windows\system32\cache329\B_329_2_0_446800.htm

c:\windows\system32\cache329\B_329_2_0_446900.htm

c:\windows\system32\cache329\B_329_3_0_106800.htm

c:\windows\system32\cache329\B_329_3_0_107400.htm

c:\windows\system32\cache329\B_329_3_0_446800.htm

c:\windows\system32\cache329\B_329_3_0_446900.htm

c:\windows\system32\cache329\B_329_4_0_111600.htm

c:\windows\system32\cache329\B_329_4_0_152400.htm

c:\windows\system32\cache329\B_329_4_0_155300.htm

c:\windows\system32\cache329\B_329_4_0_164100.htm

c:\windows\system32\cache329\t_B_329_0_0_106800.htm

c:\windows\system32\cache329\t_B_329_0_0_107400.htm

c:\windows\system32\cache329\t_B_329_0_0_446700.htm

c:\windows\system32\cache329\t_B_329_0_0_446800.htm

c:\windows\system32\cache329\t_B_329_0_0_446900.htm

c:\windows\system32\cache329\t_B_329_1_0_449200.htm

c:\windows\system32\cache329\t_B_329_1_0_449600.htm

c:\windows\system32\cache329\t_B_329_1_0_454300.htm

c:\windows\system32\cache329\t_B_329_2_0_106800.htm

c:\windows\system32\cache329\t_B_329_2_0_107400.htm

c:\windows\system32\cache329\t_B_329_2_0_446700.htm

c:\windows\system32\cache329\t_B_329_2_0_446800.htm

c:\windows\system32\cache329\t_B_329_2_0_446900.htm

c:\windows\system32\cache329\t_B_329_3_0_106800.htm

c:\windows\system32\cache329\t_B_329_3_0_107400.htm

c:\windows\system32\cache329\t_B_329_3_0_446700.htm

c:\windows\system32\cache329\t_B_329_3_0_446800.htm

c:\windows\system32\cache329\t_B_329_3_0_446900.htm

c:\windows\system32\cache329\t_B_329_4_0_111600.htm

c:\windows\system32\cache329\t_B_329_4_0_152400.htm

c:\windows\system32\cache329\t_B_329_4_0_155300.htm

c:\windows\system32\cache329\t_B_329_4_0_164100.htm

c:\windows\Tasks\gchejtpe.job

c:\windows\Tasks\gspsvdho.job

.

((((((((((((((((((((((((( Files Created from 2010-02-20 to 2010-03-20 )))))))))))))))))))))))))))))))

.

2010-03-20 16:14 . 2010-03-20 16:14 -------- d-----w- C:\_OTL

2010-03-20 03:06 . 2010-03-20 03:06 20846064 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe

2010-03-20 03:06 . 2010-03-20 03:06 8405312 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe

2010-03-20 03:05 . 2010-03-20 03:05 149000 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe

2010-03-20 03:05 . 2010-03-20 03:05 10309448 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe

2010-03-20 03:05 . 2010-03-20 03:05 181768 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\carb\LaunchHelper.exe

2010-03-20 03:05 . 2010-03-20 03:05 283280 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\carb\CarboniteSetupLiteRealPreinstaller.exe

2010-03-20 03:05 . 2010-03-20 03:05 79368 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\RUP\vista.exe

2010-03-20 03:05 . 2010-03-20 03:05 52288 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll

2010-03-20 03:04 . 2010-03-20 03:04 64000 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll

2010-03-20 03:04 . 2010-03-20 03:04 50688 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll

2010-03-20 03:04 . 2010-03-20 03:04 49152 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll

2010-03-20 03:04 . 2010-03-20 03:04 118784 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll

2010-03-19 19:55 . 2010-03-19 19:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage

2010-03-19 17:03 . 2010-03-19 17:03 -------- d-----w- c:\program files\ERUNT

2010-03-19 14:45 . 2010-03-19 14:45 439816 ----a-w- c:\documents and settings\soulsis\Application Data\Real\Update\setup3.10\setup.exe

2010-03-13 20:03 . 2010-03-13 20:03 664 ----a-w- c:\documents and settings\Limited\Local Settings\Application Data\d3d9caps.dat

2010-03-12 08:18 . 2010-03-12 08:18 348160 ----a-w- c:\documents and settings\Limited\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1d0e6296-n\msvcr71.dll

2010-03-12 08:18 . 2010-03-12 08:18 503808 ----a-w- c:\documents and settings\Limited\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1d0e6296-n\msvcp71.dll

2010-03-12 08:18 . 2010-03-12 08:18 61440 ----a-w- c:\documents and settings\Limited\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-59d4f46c-n\decora-sse.dll

2010-03-12 08:18 . 2010-03-12 08:18 499712 ----a-w- c:\documents and settings\Limited\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1d0e6296-n\jmc.dll

2010-03-12 08:18 . 2010-03-12 08:18 12800 ----a-w- c:\documents and settings\Limited\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-59d4f46c-n\decora-d3d.dll

2010-03-12 07:10 . 2010-03-12 07:10 61440 ----a-w- c:\documents and settings\soulsis\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-67842eb8-n\decora-sse.dll

2010-03-12 07:10 . 2010-03-12 07:10 503808 ----a-w- c:\documents and settings\soulsis\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7b9961f5-n\msvcp71.dll

2010-03-12 07:10 . 2010-03-12 07:10 499712 ----a-w- c:\documents and settings\soulsis\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7b9961f5-n\jmc.dll

2010-03-12 07:10 . 2010-03-12 07:10 348160 ----a-w- c:\documents and settings\soulsis\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7b9961f5-n\msvcr71.dll

2010-03-12 07:10 . 2010-03-12 07:10 12800 ----a-w- c:\documents and settings\soulsis\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-67842eb8-n\decora-d3d.dll

2010-03-10 01:57 . 2009-10-23 14:27 3555328 ------w- c:\windows\system32\dllcache\moviemk.exe

2010-03-07 21:25 . 2010-03-07 21:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-03-06 20:53 . 2010-03-06 20:53 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-02-26 11:37 . 2010-03-18 01:43 -------- d-----w- c:\documents and settings\Limited\Local Settings\Application Data\Temp

2010-02-23 20:37 . 2010-02-23 20:37 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-12 07:10 . 2009-08-30 08:10 -------- d-----w- c:\program files\Common Files\Java

2010-03-12 07:09 . 2007-10-03 06:08 -------- d-----w- c:\program files\Java

2010-03-10 04:14 . 2007-01-30 05:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-03-06 20:59 . 2009-08-08 20:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-24 15:16 . 2009-10-03 04:17 181632 ------w- c:\windows\system32\MpSigStub.exe

2010-02-23 20:32 . 2004-05-18 08:40 -------- d-----w- c:\program files\Google

2010-02-21 17:54 . 2005-03-13 08:42 -------- d-----w- c:\program files\McAfee

2010-01-28 21:13 . 2010-01-28 21:13 -------- d-----w- c:\program files\IrfanView

2010-01-23 04:18 . 2008-06-08 18:20 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-09 19:21 . 2010-01-09 19:21 54 ----a-w- c:\windows\system32\rp_stats.dat

2010-01-09 19:21 . 2010-01-09 19:21 39 ----a-w- c:\windows\system32\rp_rules.dat

2010-01-07 22:07 . 2009-08-08 20:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 22:07 . 2009-08-08 20:32 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-05 15:54 . 2006-01-03 22:20 107816 -c--a-w- c:\documents and settings\Limited\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-05 05:45 . 2003-02-13 21:40 107816 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-31 16:14 . 2002-08-29 11:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-22 05:42 . 2004-08-24 01:32 662016 ----a-w- c:\windows\system32\wininet.dll

2009-12-22 05:42 . 2004-08-04 07:56 81920 ------w- c:\windows\system32\ieencode.dll

2003-11-28 05:33 . 2003-11-28 05:33 267472 -c--a-w- c:\program files\NSSetup.exe

2003-08-23 04:28 . 2003-08-23 04:28 5327648 -c--a-w- c:\program files\WindowsXP-KB821557-x86-ENU.exe

2003-08-13 18:25 . 2003-08-13 18:25 1291040 ----a-w- c:\program files\WindowsXP-KB823980-x86-ENU.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 68856]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"DelayShred"="c:\program files\mcafee.com\shredder\SHRED32.EXE" [2005-07-15 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]

"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]

"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-15 28672]

"nwiz"="nwiz.exe" [2003-10-06 741376]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-12-11 98304]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-02-06 180269]

"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-05-20 53248]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 30248]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-30 46632]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-23 663552]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2004-07-19 263320]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"SRUUninstall"="c:\windows\System32\msiexec.exe" [2005-03-21 78848]

"RunNarrator"="Narrator.exe" [2006-10-04 53760]

c:\documents and settings\soulsis\Start Menu\Programs\Startup\

Supreme Office Suite 3.0.lnk - c:\program files\Supreme Office Suite3.0\program\quickstart.exe [2002-7-4 24576]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Album Fast Start.lnk - c:\program files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE [2005-12-1 36864]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2003-2-13 45056]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\gnucash\\bin\\gnucash-bin.exe"=

"c:\\Program Files\\gnucash\\bin\\gconfd-2.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [8/5/2009 10:42 PM 64160]

R2 kqemu;kqemu driver;c:\windows\SYSTEM32\DRIVERS\kqemu.sys [2/6/2007 4:02 PM 123939]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/23/2010 3:32 PM 135664]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 9:49 AM 1029456]

.

Contents of the 'Scheduled Tasks' folder

2010-03-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 04:41]

2010-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 20:32]

2010-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 20:32]

2010-03-15 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-28 17:22]

2010-03-01 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-28 17:22]

2010-03-20 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2005-06-11 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-06-11 22:26]

2010-03-20 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-04-01 03:18]

.

.

------- Supplementary Scan -------

.

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mStart Page = hxxp://www.comcast.net/

mWindow Title = Windows Internet Explorer provided by Comcast

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\soulsis\Application Data\Mozilla\Firefox\Profiles\vu693bl9.default\

FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-eTrustPPAP - c:\program files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe

SafeBoot-AVG Anti-Spyware Driver

SafeBoot-AVG Anti-Spyware Guard

AddRemove-ComcastHSI - c:\program files\support.com\uninstall\chsi_uninstaller.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-20 11:53

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2010-03-20 11:58:37

ComboFix-quarantined-files.txt 2010-03-20 16:58

Pre-Run: 22,817,857,536 bytes free

Post-Run: 22,796,496,896 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 15BA50959C65956C0DB97E85597074F8

###############################################

Thanks again

Link to post
Share on other sites

Hey Maurice,

I just noticed that all this cleaning got rid of the java jre that I need, so I'm going to re-install it as I need it to do a task that has to be done at this point. I hope I'm not causing more harm than good (this task has been postponed for 3 weeks now since computer was infected on 2/26).

Let me know. Thanks.

Link to post
Share on other sites

Nevermind, Ignore Previous Post. It worked without an re-install.

Hey Maurice,

I just noticed that all this cleaning got rid of the java jre that I need, so I'm going to re-install it as I need it to do a task that has to be done at this point. I hope I'm not causing more harm than good (this task has been postponed for 3 weeks now since computer was infected on 2/26).

Let me know. Thanks.

Link to post
Share on other sites

Step 1

Please download Rkill by Grinler and save it to your desktop.

Link 2
Link 3
Link 4

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • If the tool does not run from any of the links provided, please let me know.

Step 2

Download RootRepeal from one of these links:

>> Link 1<<

or >>Link 2<<

or >>Link 3<<

  • SAVE the zip download to your Desktop.
  • Extract the archive to a folder you create such as C:\RootRepeal
  • Double-click RootRepeal.exe to launch the program (Vista users should right-click and select "Run as Administrator).
  • Click the "File" tab (located at the bottom of the RootRepeal screen)
  • Click the "Scan" button
  • In the popup dialog, check the drives to be scanned - making sure to check your primary operating system drive - normally C:
  • Click OK and the file scan will begin
  • When the scan is done, there will be files listed, but most if not all of them will be legitimate
  • Click the "Save Report" Button
  • Save the log file to your Documents folder
  • Post the content of the RootRepeal file scan log in your next reply.

Step 3

Download the latest version of HijackThis Installer

Save the HJT Installer to your desktop or the folder of your choice, then navigate to that folder and double-click the file to start the installation.

When the Trend Micro HJT install box appears, click Install.

HijackThis (HJT) will be installed in the C:\Program Files\Trend Micro\HijackThis folder by default and a desktop shortcut will be created.

Then, using My Computer {Windows Explorer} locate your hijackthis.exe

The default setup goes into this folder C:\Program Files\Trend Micro\HijackThis

RIGHT-click on hijackthis.exe and select Rename, and rename it to BRAVO.exe

Start Bravo.exe, do a Scan and Save log

Reply with copy of Rootrepeal log and

HijackThis log

and tell me, How is your system now ?

Link to post
Share on other sites

Hey Maurice,

I have to head to work and won't be able to run until ~8hrs from now.......... that's okay right? I won't have to re-run the steps from the previous posts? If so, I can request that my other user not touch the computer while I'm gone.

Thanks again.

Link to post
Share on other sites

#######################################

RootRepeal file scan log

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/03/22 07:56

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP2

==================================================

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys

Status: Locked to the Windows API!

#######################################

HijackThis log

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 8:01:32 AM, on 3/22/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\MsPMSPSv.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

C:\WINDOWS\system32\cidaemon.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\TrendMicro\HiJackThis\BRAVO.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.

*

* If you make changes to this file while the browser is running,

* the changes will be overwritten when the browser exits.

*

* To make a manual change to preferences, you can visit the URL about:config

* For more information, see http://www.mozilla.org/unix/customizing.html#prefs

*/

user_pref("browser.activation.checkedNNFlag", true);

user_pref("browser.bookmarks.added_static_root", true);

user_pref("browser.cache.disk.parent_directory", "C:\\DOCUMENTS AND SETTINGS\\SOULSIS\\APPLICATION DATA\\Mozilla\\Profiles\\default\\34yscgug.slt");

user_pref("browser.download.dir", "C:\\Documents and Settings\\soulsis\\Desktop");

user_pref("browser.history.grouping", "none");

user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");

user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html");

user_pref("browser.startup.homepage_override.mston

N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.

*

* If you make changes to this file while the browser is running,

* the changes will be overwritten when the browser exits.

*

* To make a manual change to preferences, you can visit the URL about:config

* For more information, see http://www.mozilla.org/unix/customizing.html#prefs

*/

user_pref("browser.activation.checkedNNFlag", true);

user_pref("browser.bookmarks.added_static_root", true);

user_pref("browser.cache.disk.parent_directory", "C:\\DOCUMENTS AND SETTINGS\\SOULSIS\\APPLICATION DATA\\Mozilla\\Profiles\\default\\34yscgug.slt");

user_pref("browser.download.dir", "C:\\Documents and Settings\\soulsis\\Desktop");

user_pref("browser.history.grouping", "none");

user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");

user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html");

user_pref("browser.startup.homepage_override.mston

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [indexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini

O4 - HKLM\..\Run: [brMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\RunOnce: [DelayShred] "c:\program files\mcafee.com\shredder\SHRED32.EXE" /q C:\WINDOWS\SYSTEM32\ncompat.SH! C:\WINDOWS\SYSTEM32\nvctrl.SH! C:\DOCUME~1\soulsis\LOCALS~1\TEMPOR~1\Content.SH! C:\DOCUME~1\soulsis\LOCALS~1\TEMPOR~1\Content.IE5\index.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DFA39C.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DFF491.SH! C:\PROGRA~1\SECURI~1.SH! C:\WINDOWS\SYSTEM32\hp3918.SH! C:\WINDOWS\SYSTEM32\hpF6FF.SH! C:\WINDOWS\SYSTEM32\ld5C5A.SH! C:\WINDOWS\SYSTEM32\hp5E2E.SH! C:\WINDOWS\SYSTEM32\ldF76F.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF46EC.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF5A91.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF4040.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF39CF.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF5EAF.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DFB7A.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF237E.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DF16A3.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DFEC2A.SH! C:\DOCUME~1\soulsis\LOCALS~1\Temp\~DFA74C.SH! C:\DOCUME~1\soulsis\LOCALS~1\Te

O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [sRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /x {6AF90EF6-F7F9-466C-99F4-1774826FBB40} /qn REBOOT=ReallySuppress (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [sRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /x {6AF90EF6-F7F9-466C-99F4-1774826FBB40} /qn REBOOT=ReallySuppress (User 'Default user')

O4 - Startup: Supreme Office Suite 3.0.lnk = C:\Program Files\Supreme Office Suite3.0\program\quickstart.exe

O4 - Global Startup: Album Fast Start.lnk = C:\Program Files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

O4 - Global Startup: Digital Line Detect.lnk = ?

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab

O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (eAssist NetAgent Customer ActiveX Control version 3) - https://ehelp.nelnet.net/netagent/objects/custappx3.CAB

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab

O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) - http://download.mcafee.com/molbin/shared/m...56/mcinsctl.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...84/mcinsctl.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab

O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8...pdatePortal.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1105193306109

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1129601807465

O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/...gr.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab55579.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,21/mcgdmgr.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...524/mcfscan.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--

End of file - 15179 bytes

#######################################

Status of system : I am still getting the Run DLL pop up that states that "c:\DOCUME~1\ALLUSE~1\APPLIC~1\sajuyaya\sajuyaya.dll is not found", so while the malware can't locate its program files, its still present on the computer. This is only any issue on one user (non-admin) account. I just did a quick scan of Malwarebytes and its did not find anything .. odd.

Link to post
Share on other sites

  • 2 weeks later...

The info-message on that rogue dll may just be a leftover reference. Let's get a fresh report.

Delete the prior copy you had of OTL.com.

Download & SAVE OTL by OldTimer to your desktop from one of the following links: Link1 or

Link2

Double-click OTL otlDesktopIcon.png to start it.

Look at the upper left of window. Press the pink color Quick Scan button.

Have patience while it runs.

It will produce a new log. Save it.

Copy and paste back here a copy of the new OTL.txt

Link to post
Share on other sites

  • 1 month later...
The info-message on that rogue dll may just be a leftover reference. Let's get a fresh report.

Delete the prior copy you had of OTL.com.

Download & SAVE OTL by OldTimer to your desktop from one of the following links: Link1 or

Link2

Double-click OTL otlDesktopIcon.png to start it.

Look at the upper left of window. Press the pink color Quick Scan button.

Have patience while it runs.

It will produce a new log. Save it.

Copy and paste back here a copy of the new OTL.txt

Hey Maurice,

Its been a while. I'm still getting that pop-up, but since you mentioned it was harmless, I went ahead and started using the computer again. Anyway, here is the new OTL log

##############################

OTL logfile created on: 5/22/2010 1:58:01 PM - Run 2

OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\soulsis\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 485.00 Mb Available Physical Memory | 47.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 64.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 55.84 Gb Total Space | 22.65 Gb Free Space | 40.56% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: SOULSISTAH

Current User Name: soulsis

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/05/22 10:44:58 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

PRC - [2010/04/27 17:16:24 | 000,188,136 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

PRC - [2010/04/27 17:16:24 | 000,141,792 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe

PRC - [2010/04/01 23:05:04 | 001,180,976 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe

PRC - [2010/03/01 23:41:24 | 001,029,456 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

PRC - [2010/02/18 12:43:20 | 000,490,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe

PRC - [2010/01/05 18:04:02 | 000,170,144 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

PRC - [2009/12/14 21:08:40 | 000,271,480 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

PRC - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

PRC - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

PRC - [2008/11/24 22:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

PRC - [2008/04/04 15:56:18 | 001,123,608 | ---- | M] (Diskeeper Corporation) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

PRC - [2007/08/22 09:45:11 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

PRC - [2007/06/13 05:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/03/23 13:14:52 | 000,663,552 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

PRC - [2007/03/06 19:20:00 | 000,536,576 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe

PRC - [2007/03/02 16:56:52 | 000,077,824 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

PRC - [2007/01/29 21:12:14 | 000,030,248 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

PRC - [2006/11/03 19:20:12 | 000,866,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MsMpEng.exe

PRC - [2005/02/05 22:40:35 | 000,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2002/08/14 19:22:52 | 000,028,672 | R--- | M] (Dell - Advanced Desktop Engineering) -- C:\WINDOWS\SYSTEM32\DSentry.exe

PRC - [2002/07/04 07:00:00 | 000,303,104 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Supreme Office Suite3.0\program\soffice.exe

PRC - [2002/04/10 16:44:04 | 000,679,936 | ---- | M] (Roxio) -- C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

PRC - [2002/02/15 11:31:42 | 000,045,056 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe

PRC - [2000/08/05 20:08:30 | 000,036,864 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE

========== Modules (SafeList) ==========

MOD - [2010/05/22 10:44:58 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

MOD - [2008/07/25 11:17:20 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll

MOD - [2008/07/25 11:17:20 | 000,558,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll

MOD - [2006/11/03 19:20:00 | 000,083,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MpShHook.dll

MOD - [2006/08/25 10:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

MOD - [2004/08/04 01:01:17 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\msscript.ocx

MOD - [2004/08/04 00:31:43 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\rsaenh.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/04/27 17:16:24 | 000,188,136 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire)

SRV - [2010/04/27 17:16:24 | 000,141,792 | ---- | M] (McAfee, Inc.) [unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe -- (mfevtp)

SRV - [2010/03/10 11:16:56 | 000,364,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)

SRV - [2010/03/01 23:41:24 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2010/01/05 18:04:02 | 000,170,144 | ---- | M] () [unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)

SRV - [2009/12/14 21:08:40 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)

SRV - [2009/12/14 21:08:40 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)

SRV - [2009/12/14 21:08:40 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)

SRV - [2009/12/14 21:08:40 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)

SRV - [2009/12/14 21:08:40 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)

SRV - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS)

SRV - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)

SRV - [2008/11/24 22:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)

SRV - [2008/11/24 22:31:08 | 000,045,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)

SRV - [2008/04/04 15:56:18 | 001,123,608 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe -- (Diskeeper)

SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)

SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV - [2002/05/03 12:29:42 | 001,118,208 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\NMSSvc.Exe -- (NMSSvc) Intel®

========== Driver Services (SafeList) ==========

DRV - [2010/04/27 17:16:24 | 000,385,880 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)

DRV - [2010/04/27 17:16:24 | 000,312,616 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfefirek.sys -- (mfefirek)

DRV - [2010/04/27 17:16:24 | 000,152,320 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys -- (mfeavfk)

DRV - [2010/04/27 17:16:24 | 000,095,568 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfeapfk.sys -- (mfeapfk)

DRV - [2010/04/27 17:16:24 | 000,088,480 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfendisk.sys -- (mfendiskmp)

DRV - [2010/04/27 17:16:24 | 000,088,480 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfendisk.sys -- (mfendisk)

DRV - [2010/04/27 17:16:24 | 000,083,496 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mferkdet.sys -- (mferkdet)

DRV - [2010/04/27 17:16:24 | 000,082,952 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfetdi2k.sys -- (mfetdi2k)

DRV - [2010/04/27 17:16:24 | 000,055,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cfwids.sys -- (cfwids)

DRV - [2010/04/27 17:16:24 | 000,051,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys -- (mfebopk)

DRV - [2009/09/16 10:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys -- (mfesmfk)

DRV - [2009/09/16 10:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys -- (mferkdk)

DRV - [2009/07/15 11:13:00 | 000,071,488 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ftser2k.sys -- (FTSER2K)

DRV - [2009/07/15 11:13:00 | 000,053,184 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ftdibus.sys -- (FTDIBUS)

DRV - [2009/07/03 09:49:08 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)

DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys -- (dsunidrv)

DRV - [2007/02/06 16:02:00 | 000,123,939 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\kqemu.sys -- (kqemu)

DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)

DRV - [2005/07/26 22:41:18 | 000,059,440 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cdr4_xp.sys -- (Cdr4_xp)

DRV - [2005/07/26 22:41:18 | 000,023,724 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cdralw2k.sys -- (Cdralw2k)

DRV - [2004/12/20 19:58:18 | 000,110,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)

DRV - [2004/08/04 01:08:21 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)

DRV - [2004/08/04 01:07:42 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)

DRV - [2004/08/04 01:07:42 | 000,041,088 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)

DRV - [2004/08/04 00:29:49 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)

DRV - [2004/08/04 00:29:47 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)

DRV - [2004/08/04 00:29:45 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)

DRV - [2004/08/04 00:29:43 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)

DRV - [2004/08/04 00:29:42 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)

DRV - [2004/08/04 00:29:41 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)

DRV - [2004/08/04 00:29:37 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)

DRV - [2004/08/04 00:29:37 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)

DRV - [2004/08/04 00:29:37 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)

DRV - [2004/08/04 00:29:36 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)

DRV - [2004/03/22 23:23:31 | 000,028,276 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\MxlW2k.sys -- (MxlW2k)

DRV - [2003/10/06 15:16:00 | 001,550,043 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)

DRV - [2003/08/29 04:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)

DRV - [2002/08/30 17:29:02 | 001,293,440 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\P16X.sys -- (P16X) Creative SB Live! Series (WDM)

DRV - [2002/07/19 11:22:08 | 000,017,153 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)

DRV - [2002/05/03 12:30:08 | 000,009,868 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NMSCFG.SYS -- (NMSCFG)

DRV - [2002/04/10 17:01:12 | 000,024,554 | ---- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\Dvd_2k.sys -- (dvd_2K)

DRV - [2002/04/10 17:01:00 | 000,029,638 | ---- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Mmc_2k.sys -- (mmc_2K)

DRV - [2002/04/10 17:00:44 | 000,117,898 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\pwd_2K.sys -- (pwd_2k)

DRV - [2002/04/10 16:48:04 | 000,236,032 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cdudf_xp.sys -- (cdudf_xp)

DRV - [2002/04/10 16:45:16 | 000,206,336 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\udfreadr_xp.sys -- (UdfReadr_xp)

DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow)

DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3)

DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi)

DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx)

DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810)

DRV - [2001/08/17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\MODEMCSA.sys -- (MODEMCSA)

DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra)

DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160)

DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080)

DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280)

DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k)

DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x)

DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc)

DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550)

DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde)

DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde)

DRV - [2001/08/17 13:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)

DRV - [1999/12/17 02:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\PFMODNT.SYS -- (PfModNT)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/22 10:28:48 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/22 05:41:53 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2006/08/15 21:18:49 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2010/05/22 05:41:53 | 000,000,000 | ---D | M]

[2009/03/31 23:55:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\Mozilla\Extensions

[2010/05/22 10:39:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\Mozilla\Firefox\Profiles\vu693bl9.default\extensions

[2009/09/05 11:56:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\soulsis\Application Data\Mozilla\Firefox\Profiles\vu693bl9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/05/22 10:39:15 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/04/27 17:16:24 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2004/01/27 17:35:01 | 000,000,734 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100518040942.dll (McAfee, Inc.)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)

O4 - HKLM..\Run: [brMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [diagent] C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)

O4 - HKLM..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [sSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [updReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - HKCU..\RunOnce: [DelayShred] c:\program files\mcafee.com\shredder\SHRED32.EXE (McAfee, Inc.)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\NPSWF32_FlashUtil.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Album Fast Start.lnk = C:\Program Files\Ulead Systems\Ulead PhotoImpact 6\ABMTSR.EXE (Ulead Systems, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

O4 - Startup: C:\Documents and Settings\soulsis\Start Menu\Programs\Startup\Supreme Office Suite 3.0.lnk = C:\Program Files\Supreme Office Suite3.0\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)

O15 - HKCU\..Trusted Domains: ([]msn in My Computer)

O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Reg Error: Key error.)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)

O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} http://download.mcafee.com/molbin/Shared/MGBrwFld.cab (BrowseFolderPopup Class)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)

O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://ehelp.nelnet.net/netagent/objects/custappx3.CAB (eAssist NetAgent Customer ActiveX Control version 3)

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} http://ppupdates.ca.com/downloads/scanner/axscanner.cab (PPSDKActiveXScanner.MainScreen)

O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} http://download.mcafee.com/molbin/shared/m...56/mcinsctl.cab (McAfee.com Download+Installer Class)

O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} http://download.microsoft.com/download/b/d.../WebCleaner.cab (Malicious Software Removal Tool)

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...84/mcinsctl.cab (McAfee.com Operating System Class)

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} http://www.my-etrust.com/Support/PestScanner/pestscan.cab (PSFormX Control)

O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} http://www.amiuptodate.com/vsc/bin/1,0,0,8...pdatePortal.cab (McUpdatePortalFactory Class)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co...b?1105193306109 (WUWebControl Class)

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab (Symantec RuFSI Utility Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1129601807465 (MUWebControl Class)

O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} http://cdn2.zone.msn.com/binframework/v10/...gr.cab31267.cab (ZoneAxRcMgr Class)

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...ro.cab55579.cab (MSN Games - Installer)

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://www.windowsecurity.com/trojanscan/axscan.cab (ASquaredScanForm Element)

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/m...,21/mcgdmgr.cab (DwnldGroupMgr Class)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} http://fdl.msn.com/zone/datafiles/heartbeat.cab (HeartbeatCtl Class)

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/...524/mcfscan.cab (McFreeScan Class)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O16 - DPF: ppctlcab http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.20.1

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\soulsis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\soulsis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2002/09/03 14:36:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/05/22 10:44:25 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

[2010/05/22 10:30:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2010/04/14 02:48:37 | 000,009,344 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfeclnk.sys

[2010/04/14 02:48:16 | 000,312,616 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfefirek.sys

[2010/04/14 02:48:16 | 000,095,568 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfeapfk.sys

[2010/04/14 02:48:16 | 000,088,480 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfendisk.sys

[2010/04/14 02:48:16 | 000,083,496 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mferkdet.sys

[2010/04/14 02:48:16 | 000,082,952 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfetdi2k.sys

[2010/04/14 02:48:16 | 000,055,456 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\cfwids.sys

[2010/03/22 07:58:08 | 000,000,000 | ---D | C] -- C:\Program Files\TrendMicro

[2010/03/20 13:07:51 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010/03/20 11:39:07 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010/03/20 11:37:36 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/03/20 11:37:36 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/03/20 11:37:36 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/03/20 11:37:36 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010/03/20 11:37:21 | 000,000,000 | ---D | C] -- C:\ComboFix

[2010/03/20 11:14:13 | 000,000,000 | ---D | C] -- C:\_OTL

[2010/03/20 11:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\soulsis\Desktop\FixPolicies

[2010/03/19 22:09:00 | 000,444,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\TFC.exe

[2010/03/19 14:55:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

[2010/03/19 12:03:35 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2010/03/19 11:51:40 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\soulsis\Desktop\erunt-setup.exe

[2010/03/19 09:46:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW

[2010/03/19 09:46:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO

[2010/03/19 09:46:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES

[2010/03/19 09:46:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR

[2010/03/19 09:46:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE

[2010/03/19 09:46:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK

[2010/03/19 09:46:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA

[2010/03/12 02:10:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

[2010/03/11 23:23:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\soulsis\My Documents\Downloads

[2010/03/09 01:40:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Real

[2010/03/07 16:19:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/03/07 16:14:42 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/02/23 15:37:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google

[2003/02/13 16:43:21 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll

========== Files - Modified Within 90 Days ==========

[2010/05/22 13:48:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/05/22 12:20:32 | 000,000,218 | ---- | M] () -- C:\Documents and Settings\soulsis\.recently-used.xbel

[2010/05/22 10:48:29 | 000,003,192 | ---- | M] () -- C:\Documents and Settings\soulsis\2010_YTD

[2010/05/22 10:44:58 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\OTL.com

[2010/05/22 10:24:17 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job

[2010/05/22 10:24:09 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL

[2010/05/22 10:24:09 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/05/22 09:15:11 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job

[2010/05/22 09:11:02 | 000,001,595 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Center.lnk

[2010/05/22 09:10:44 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/05/22 09:10:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT

[2010/05/22 09:10:36 | 1072,766,976 | -HS- | M] () -- C:\hiberfil.sys

[2010/05/22 09:10:36 | 000,403,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/05/22 09:09:08 | 007,864,320 | ---- | M] () -- C:\Documents and Settings\soulsis\ntuser.dat

[2010/05/22 09:09:08 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\soulsis\NTUSER.INI

[2010/05/22 08:22:06 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/05/22 05:35:46 | 000,000,531 | ---- | M] () -- C:\WINDOWS\WIN.INI

[2010/05/21 16:35:41 | 000,000,944 | ---- | M] () -- C:\WINDOWS\Brpfx04a.ini

[2010/05/20 11:14:01 | 000,000,000 | ---- | M] () -- C:\WINDOWS\brdfxspd.dat

[2010/05/19 22:42:07 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2010/04/27 17:16:24 | 000,385,880 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfehidk.sys

[2010/04/27 17:16:24 | 000,312,616 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfefirek.sys

[2010/04/27 17:16:24 | 000,152,320 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfeavfk.sys

[2010/04/27 17:16:24 | 000,095,568 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfeapfk.sys

[2010/04/27 17:16:24 | 000,088,480 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfendisk.sys

[2010/04/27 17:16:24 | 000,083,496 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mferkdet.sys

[2010/04/27 17:16:24 | 000,082,952 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfetdi2k.sys

[2010/04/27 17:16:24 | 000,055,456 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\cfwids.sys

[2010/04/27 17:16:24 | 000,051,688 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfebopk.sys

[2010/04/27 17:16:24 | 000,009,344 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\System32\drivers\mfeclnk.sys

[2010/04/14 22:10:29 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/03/30 22:49:12 | 000,000,439 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\Shortcut to Shared Documents.lnk

[2010/03/22 07:58:10 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\HiJackThis.lnk

[2010/03/21 16:03:31 | 001,644,436 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\SMR-manual.pdf

[2010/03/20 14:28:36 | 001,401,344 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\HijackThis.msi

[2010/03/20 14:26:56 | 000,464,491 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\RootRepeal.zip

[2010/03/20 14:23:57 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\rkill.scr

[2010/03/20 11:53:44 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/03/20 11:39:23 | 000,000,281 | RHS- | M] () -- C:\BOOT.INI

[2010/03/20 11:06:47 | 003,895,816 | R--- | M] () -- C:\Documents and Settings\soulsis\Desktop\ComboFix.exe

[2010/03/20 10:55:55 | 000,185,065 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\FixPolicies.exe

[2010/03/19 22:13:12 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\gmer.zip

[2010/03/19 22:11:06 | 000,843,187 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\SecurityCheck.exe

[2010/03/19 22:09:04 | 000,444,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\soulsis\Desktop\TFC.exe

[2010/03/19 11:52:11 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\soulsis\Desktop\erunt-setup.exe

[2010/03/17 15:03:13 | 000,483,160 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT

[2010/03/17 15:03:12 | 000,086,608 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT

[2010/03/17 15:03:09 | 000,580,614 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/03/12 18:02:38 | 000,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe

[2010/03/12 09:25:35 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn

[2010/03/12 01:27:49 | 000,050,113 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\MS_windows_error.JPG

[2010/03/11 23:02:15 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\soulsis\defogger_reenable

[2010/03/11 23:01:37 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\soulsis\Desktop\Defogger.exe

[2010/03/10 08:19:43 | 000,027,797 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\pop-up.JPG

[2010/03/09 01:43:39 | 000,004,654 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI

[2010/03/07 06:00:16 | 000,006,456 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\sugahono

[2010/03/06 03:47:11 | 000,078,137 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\rogue_site.JPG

========== Files Created - No Company Name ==========

[2010/05/22 12:20:32 | 000,000,218 | ---- | C] () -- C:\Documents and Settings\soulsis\.recently-used.xbel

[2010/05/22 10:48:29 | 000,003,192 | ---- | C] () -- C:\Documents and Settings\soulsis\2010_YTD

[2010/05/22 10:48:29 | 000,000,172 | ---- | C] () -- C:\Documents and Settings\soulsis\2010_YTD.20100522104829.log

[2010/05/22 10:48:28 | 000,000,172 | ---- | C] () -- C:\Documents and Settings\soulsis\2010_YTD.20100522104828.log

[2010/05/22 10:41:18 | 000,000,292 | ---- | C] () -- C:\Documents and Settings\soulsis\2009_YTD_pre_chk_exp_report_only.20100522104118.log

[2010/05/22 08:22:06 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/04/16 12:23:26 | 000,001,595 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Center.lnk

[2010/03/22 07:58:10 | 000,001,986 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\HiJackThis.lnk

[2010/03/21 16:03:31 | 001,644,436 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\SMR-manual.pdf

[2010/03/20 14:28:31 | 001,401,344 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\HijackThis.msi

[2010/03/20 14:26:52 | 000,464,491 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\RootRepeal.zip

[2010/03/20 14:23:49 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\rkill.scr

[2010/03/20 11:39:22 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2010/03/20 11:39:17 | 000,260,272 | ---- | C] () -- C:\cmldr

[2010/03/20 11:37:36 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/03/20 11:37:36 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/03/20 11:37:36 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010/03/20 11:37:36 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010/03/20 11:37:36 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/03/20 11:06:24 | 003,895,816 | R--- | C] () -- C:\Documents and Settings\soulsis\Desktop\ComboFix.exe

[2010/03/20 10:55:52 | 000,185,065 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\FixPolicies.exe

[2010/03/19 22:13:08 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\gmer.zip

[2010/03/19 22:11:03 | 000,843,187 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\SecurityCheck.exe

[2010/03/12 01:27:49 | 000,050,113 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\MS_windows_error.JPG

[2010/03/11 23:02:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\soulsis\defogger_reenable

[2010/03/11 23:01:33 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\soulsis\Desktop\Defogger.exe

[2010/03/10 08:19:43 | 000,027,797 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\pop-up.JPG

[2010/03/07 18:08:20 | 1072,766,976 | -HS- | C] () -- C:\hiberfil.sys

[2010/03/06 03:47:11 | 000,078,137 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\rogue_site.JPG

[2010/02/23 15:32:57 | 000,000,886 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/02/23 15:32:52 | 000,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2009/10/14 09:42:06 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2009/10/14 09:42:06 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2009/10/14 09:41:22 | 000,000,944 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini

[2009/10/14 09:41:22 | 000,000,180 | ---- | C] () -- C:\WINDOWS\brpcfx.ini

[2009/10/14 09:39:03 | 000,000,086 | ---- | C] () -- C:\WINDOWS\Brfaxrx.ini

[2009/10/14 09:39:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll

[2009/10/14 09:28:07 | 000,031,567 | ---- | C] () -- C:\WINDOWS\maxlink.ini

[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2008/07/04 13:55:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QFN.ini

[2008/07/04 13:55:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QDQICK.ini

[2007/09/15 17:00:01 | 000,001,486 | ---- | C] () -- C:\WINDOWS\NETG.INI

[2007/08/12 14:28:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007/05/13 18:15:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pestpatrol5.INI

[2007/02/06 16:02:00 | 000,123,939 | ---- | C] () -- C:\WINDOWS\System32\drivers\kqemu.sys

[2006/01/02 16:18:43 | 000,000,030 | ---- | C] () -- C:\WINDOWS\iedit.INI

[2005/12/01 01:48:27 | 000,004,654 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI

[2004/01/27 17:30:22 | 000,000,024 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2004/01/27 17:29:59 | 000,000,006 | ---- | C] () -- C:\WINDOWS\msoffice.ini

[2003/10/06 15:16:00 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\nvcod.dll

[2003/06/07 21:51:37 | 000,000,536 | ---- | C] () -- C:\WINDOWS\_delis32.ini

[2003/05/28 12:15:07 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\ctavp4.dll

[2003/03/11 23:54:49 | 000,017,493 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2003/02/13 16:57:21 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2003/02/13 16:46:47 | 000,000,185 | ---- | C] () -- C:\WINDOWS\intuprof.ini

[2003/02/13 16:46:45 | 000,000,793 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI

[2003/02/13 16:43:47 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI

[2003/02/13 16:43:21 | 000,039,936 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll

[2003/02/13 16:43:21 | 000,002,092 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini

[2003/02/13 16:43:21 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini

[2003/02/13 16:43:20 | 000,006,175 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI

[2003/02/13 16:43:20 | 000,005,917 | ---- | C] () -- C:\WINDOWS\SBMIXDEF.INI

[2003/02/13 16:43:20 | 000,000,064 | ---- | C] () -- C:\WINDOWS\P16x.ini

[2003/02/13 16:42:38 | 000,000,245 | ---- | C] () -- C:\WINDOWS\SBWIN.INI

[2003/02/13 16:38:29 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2003/02/13 16:17:18 | 000,000,550 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2002/02/06 10:04:14 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\NMSInst.dll

[2002/01/21 16:17:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PROInst.dll

========== LOP Check ==========

[2003/02/13 16:42:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software

[2007/05/13 18:10:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA

[2008/11/21 01:30:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation

[2009/08/05 23:11:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations

[2007/09/30 14:58:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft

[2004/06/26 01:21:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pixelStorm

[2005/03/20 03:19:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap

[2009/10/14 09:28:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft

[2004/12/11 11:21:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2007/01/08 12:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip

[2009/08/05 22:20:21 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}

[2010/01/03 01:44:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\GetRightToGo

[2010/05/22 10:48:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\gtk-2.0

[2007/11/07 01:03:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\InfraRecorder

[2003/02/20 01:30:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\InterTrust

[2009/12/12 16:33:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\PC-FAX TX

[2007/08/22 10:07:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\SecondLife

[2007/04/14 00:25:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\soulsis\Application Data\Viewpoint

[2010/05/19 22:42:07 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

[2010/05/22 09:15:11 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

[2010/05/22 10:24:17 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========

< End of report >

##############################

Link to post
Share on other sites

It has been several weeks since your last post. Please make sure you reply in a very timely manner this time around.

Step 1

Get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm

Steps to follow for the MVP Hosts file:

1) Download and SAVE the zip file to a temporary folder

2) Unzip (extract the contents) in the same folder

3) After extract is complete, run mvps.bat batch file. This copies your pre-existing Hosts file to Hosts.mvp in the folder where Windows' Hosts resides

typically, C:\WINDOWS\system32\drivers\etc

and after that copy is saved, it replaces the old Hosts with the new one.

And you should see (in the blue background command window) the following:

_________________________________________________
Link to post
Share on other sites

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

It seems my topic has been locked .. so here is the latest. Let me know if you want me to start a new post instead.

As a side note, I mostly only have times during the weekend to run scans that will take > 2 hours (my computer is 7 years old so its slow). I did run the ESET multiple times during the week but since I only have a 2 hour period between getting back from work and going to bed, I had to stop the scan as I didn't want to leave the computer on overnight with my Anti-virus turned off.

################# ESET LOGS ##############

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=7fa819a03613904aadfa15df3f484b62

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-05-29 06:07:23

# local_time=2010-05-29 01:07:23 (-0600, Central Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1024 16777215 100 0 24651787 24651787 0 0

# compatibility_mode=4864 16777215 100 0 0 0 0 0

# compatibility_mode=5121 16777189 100 75 2744827 13298103 0 0

# compatibility_mode=6143 16777215 0 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=97384

# found=0

# cleaned=0

# scan_time=8293

#########################################################

DrWeb Cure-It : I get an error while the Express Scan is ongoing. I get an "858m9XP.exe" encountered a problem, so DrWeb gets terminated.

I have a screen-shot. post-35304-1275169638_thumb.jpg

Link to post
Share on other sites

The ESET scan resulted in nothing being found. Let's cancel the DrWeb run request.

Delete the DrWeb Cure-it download.

I see that you are clear of your original issues.

If you have a problem with these steps, or something does not quite work here, do let me know.

De-install your Adobe Reader: Use Control Panel's Add-Remove programs, Remove Adobe Reader.

De-install also ESET Online

Exit Control Panel.

Older versions of Adobe Reader pose a potential security risk.

Get latest Adobe Reader version 9.3

http://get.adobe.com/reader/

Be sure to un-check the box for Free McAfee Security Scan

The following few steps will remove tools we used; followed by advice on staying safer.

If Combofix is still present on the Desktop, we need to remove it. You had named it combofix icon_exclaim.gif), put that name in the RUN box stated just below.

The "/uninstall" in the Run line below is to start Combofix for it's cleanup & removal function.

Note the space after before the slash mark.

The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.

  • Click Start, then click Run. In the Run box that opens, type or copy/paste
    combofix /uninstall
    and then click OK.

  • Please double-click OTL.exe otlDesktopIcon.png to run it.
  • Click on the CleanUp! button at upper Right corner. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTL attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
  • This step removes the files, folders, and shortcuts created by the tools I had you download and run.

We are finished here. Best regards.

Link to post
Share on other sites

I see that you are clear of your original issues.

If you have a problem with these steps, or something does not quite work here, do let me know.

It seems so which is why I didn't not respond for weeks....I thought all was well until I noticed that this pop up still shows up. I was unaware because it happens on the non-admin account that I don't use often and the user failed to mention that to me. It seems like there is still an attempt to run the rogue program, so that means that is still listed as a valid program in "startup program" list or something somewhere. How can I remove that?

Screen-post-35304-1275232903_thumb.jpgshot attached.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.