run-time error 0, run-time error 440

touchez · May 6, 2010

I'm sure people say this a lot, but I really have no idea if I'm leaving this in the right spot, but I feel like I've exhausted all of the attempted fixes for my problem.

The other day, while using the computer, I was bombarded by pop-up ads and error messages. I rebooted my computer and a "Antimalware" icon was on my desktop. Tried to run AVG, didn't really do anything. Downloaded SUPERAntiSpyware and it seemed to fix everything, but the computer is still really slow and I'm still getting pop-up ads while using FireFox 3.6.3. Tried the "Advanced System Care" program and I'm still experiencing pop-ups. After spending the day at work, on a clean computer, reading about my home computer's symptoms and the best programs to alleviate the problem(s), I decided to come home and try Malwarebytes. Downloaded it, installed it, ran it and got the "Run time error 0, run time error 440" messages. Googled the error messages, read the forums that came up, tried a few of the solutions, and none of them have worked so far. I'm attaching my HiJack this log. I've spent so much time on the computer reading about what I could have, that I really don't know what the hell's going on...all I'm sure of is that I can't install Malwarebytes. Any advice on how I could get Malwarebytes to run, or general input as to what the problem might be, based on the HiJack file I'm attaching, would be greatly appreciated. Okay, now it's not letting me attach my hijack this log, so I'll cut and paste, even though I don't know if this is the right place for this:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:44:30 PM, on 5/5/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

D:\Program Files\AVG\AVG9\avgchsvx.exe

D:\Program Files\AVG\AVG9\avgrsx.exe

C:\WINDOWS\system32\rundll32.exe

D:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

D:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\WINDOWS\system32\svchost.exe

D:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\system32\MsPMSPSv.exe

D:\Program Files\AVG\AVG9\avgemc.exe

D:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\explorer.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: hotrevenue browser enhancer - {F4D10D28-DBED-BA83-2EBE-8493D57B33E0} - (no file)

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [MPlayer2_FixUp] C:\WINDOWS\inf\unregmp2.exe /Fixups (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG9\avgpp.dll

O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Security Toolbar Service - Unknown owner - D:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - D:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - D:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe

O23 - Service: NBService - Nero AG - D:\Program Files\Nero 7\Nero BackItUp\NBService.exe

--

End of file - 4704 bytes

touchez · May 8, 2010

Can I add that I've read many of the forums and so far nothing has helped me? I've tried doing a scan with RootRepeal, and no .sys files even come up from that scan. I've also tried the MBAM Fix.bat advice, and that didn't allow me to run Malwarebytes, either. After that, I downloaded the Microsoft Visual Basic Controls, but no. I still can't run Malwarebytes. The computer is still slow, and I'm still getting pop up ads, and both SuperAntiSpyware & AVG are not finding the real problem here. I still can't run Malwarebytes, but I can install it. Once I try to run it, I get the "Run-Time error '0'" message, followed by the "Run-time error '440'". Any advice would be fantastic.

Maurice Naggar · May 8, 2010

Hello touchez,

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not touchez and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 3

Download & SAVE OTL by OldTimer to your desktop from one of the following links: Link1 or

Link2

Close all open windows on the Task Bar. Double-click OTL.com (for Vista, right click the icon and Run as Administrator) to start the program.
In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
Exit OTL by clicking the X at top right.

Download Security Check by screen317 and save it to your Desktop: here or here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Then copy/paste the following into your post (in order):

the contents of OTL.txt
the contents of Extras.txt
the contents of checkup.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

touchez · May 9, 2010

OTL logfile created on: 5/8/2010 6:33:03 PM - Run 1

OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\Vince Andreoni\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 169.00 Mb Available Physical Memory | 33.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 9.77 Gb Total Space | 4.09 Gb Free Space | 41.87% Space Free | Partition Type: NTFS

Drive D: | 64.73 Gb Total Space | 24.77 Gb Free Space | 38.26% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: GOD

Current User Name: Vince Andreoni

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/05/08 18:22:49 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vince Andreoni\Desktop\OTL.com

PRC - [2010/05/04 21:27:05 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Program Files\AVG\AVG9\avgchsvx.exe

PRC - [2010/05/04 21:27:05 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Program Files\AVG\AVG9\avgnsx.exe

PRC - [2010/05/04 21:27:03 | 000,508,184 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Program Files\AVG\AVG9\avgrsx.exe

PRC - [2010/05/04 21:27:00 | 000,710,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Program Files\AVG\AVG9\avgcsrvx.exe

PRC - [2010/05/04 21:26:17 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Program Files\AVG\AVG9\avgemc.exe

PRC - [2010/05/04 21:26:07 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Program Files\AVG\AVG9\avgwdsvc.exe

PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2010/05/08 18:22:49 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vince Andreoni\Desktop\OTL.com

MOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/05/04 21:26:17 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- D:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)

SRV - [2010/05/04 21:26:07 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- D:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)

SRV - [2010/02/23 14:04:14 | 000,369,920 | ---- | M] () [On_Demand | Stopped] -- D:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)

SRV - [2006/10/09 23:11:08 | 000,724,992 | ---- | M] (Nero AG) [On_Demand | Stopped] -- D:\Program Files\Nero 7\Nero BackItUp\NBService.exe -- (NBService)

========== Driver Services (SafeList) ==========

DRV - [2010/05/04 21:28:28 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (AvgTdiX)

DRV - [2010/05/04 21:28:13 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (AvgLdx86)

DRV - [2010/05/04 21:28:12 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (AvgMfx86)

DRV - [2010/04/27 17:30:10 | 000,061,440 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- D:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010/02/17 11:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- D:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2009/08/14 06:45:24 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)

DRV - [2009/08/14 06:45:24 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)

DRV - [2008/04/03 05:36:14 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)

DRV - [2004/08/03 15:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2003/11/20 15:14:28 | 000,646,825 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52)

DRV - [2003/11/20 15:13:40 | 001,232,741 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51)

DRV - [2003/11/20 15:12:56 | 000,059,717 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53)

DRV - [2003/11/20 15:12:42 | 000,037,048 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt)

DRV - [2003/03/27 09:58:56 | 000,287,920 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctdvda2k.sys -- (ctdvda2k)

DRV - [2003/03/26 14:33:58 | 000,498,688 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)

DRV - [2003/03/26 14:32:32 | 000,189,504 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)

DRV - [2003/03/26 14:32:02 | 000,141,536 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hap16v2k.sys -- (hap16v2k)

DRV - [2003/03/26 14:31:40 | 000,823,616 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k)

DRV - [2003/03/06 08:10:34 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pfmodnt.sys -- (PfModNT)

DRV - [2003/02/20 15:24:46 | 000,116,000 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia)

DRV - [2003/02/20 15:24:34 | 000,135,248 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)

DRV - [2003/02/20 15:24:18 | 000,006,144 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k)

DRV - [2003/02/20 15:22:38 | 000,135,040 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k)

DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)

DRV - [2001/08/17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.812

FF - prefs.js..extensions.enabledItems: avg@igeared:4.002.023.004

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: D:\Program Files\AVG\AVG9\Firefox [2010/05/04 21:25:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: D:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/05/04 21:27:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2010/04/28 22:53:58 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2010/04/15 18:36:32 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2010/03/17 20:06:12 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins

[2009/01/10 19:00:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\Mozilla\Extensions

[2010/05/06 00:29:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\Mozilla\Firefox\Profiles\2hxhj3x4.default\extensions

[2009/10/14 23:29:51 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Vince Andreoni\Application Data\Mozilla\Firefox\Profiles\2hxhj3x4.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

O1 HOSTS File: ([2004/08/03 18:07:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (hotrevenue browser enhancer) - {F4D10D28-DBED-BA83-2EBE-8493D57B33E0} - Reg Error: Value error. File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_12)

O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_12)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

O24 - Desktop WallPaper: C:\Documents and Settings\Vince Andreoni\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vince Andreoni\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/11/19 22:35:29 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/05/08 18:26:37 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2010/05/08 18:25:43 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Vince Andreoni\Desktop\erunt-setup.exe

[2010/05/08 18:25:43 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Vince Andreoni\Desktop\OTL.com

[2010/05/06 01:58:45 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/05/06 01:58:43 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/05/05 18:03:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/05/05 00:13:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Vince Andreoni\Recent

[2010/05/04 23:35:19 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WgaTray.exe

[2010/05/04 22:32:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vince Andreoni\Application Data\IObit

[2010/05/04 22:05:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vince Andreoni\Local Settings\Application Data\AVG Security Toolbar

[2010/05/04 21:28:28 | 000,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll

[2010/05/04 21:28:25 | 000,242,896 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys

[2010/05/04 21:28:13 | 000,216,200 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys

[2010/05/04 21:28:08 | 000,029,512 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys

[2010/05/04 21:27:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg

[2010/05/04 21:27:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar

[2010/05/04 21:24:15 | 000,000,000 | ---D | C] -- C:\Program Files\AVG

[2010/05/04 20:00:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

[2010/05/04 20:00:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vince Andreoni\Application Data\SUPERAntiSpyware.com

[2010/05/04 19:59:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard

[2010/05/04 19:10:14 | 000,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll

[2010/05/04 19:10:13 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll

[2010/05/04 19:10:13 | 000,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll

[2010/05/04 19:05:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/05/04 18:47:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia

[2010/05/04 18:47:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe

[2010/05/04 18:39:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vince Andreoni\Application Data\ezLife

[2010/05/04 18:36:26 | 000,000,000 | ---D | C] -- C:\Program Files\Smart-Ads-Solutions

[2010/05/04 18:35:33 | 000,000,000 | ---D | C] -- C:\Program Files\ezLife

[2010/05/04 18:34:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vince Andreoni\Application Data\EEB7D1EAF1B8C0A7E2642E0133BD5E1B

[2009/01/14 23:36:51 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/08 18:27:19 | 005,242,880 | -H-- | M] () -- C:\Documents and Settings\Vince Andreoni\NTUSER.DAT

[2010/05/08 18:26:40 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Vince Andreoni\Desktop\NTREGOPT.lnk

[2010/05/08 18:26:40 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Vince Andreoni\Desktop\ERUNT.lnk

[2010/05/08 18:23:11 | 000,867,892 | ---- | M] () -- C:\Documents and Settings\Vince Andreoni\Desktop\SecurityCheck.exe

[2010/05/08 18:22:49 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vince Andreoni\Desktop\OTL.com

[2010/05/08 18:22:25 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Vince Andreoni\Desktop\erunt-setup.exe

[2010/05/08 18:21:00 | 000,000,306 | -H-- | M] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

[2010/05/08 18:16:34 | 000,000,264 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

[2010/05/08 18:15:41 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/05/08 18:15:40 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\tasks\ybsdvp.job

[2010/05/08 18:15:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/05/08 15:05:25 | 000,030,036 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx

[2010/05/08 15:05:25 | 000,030,036 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx

[2010/05/08 15:05:25 | 000,029,760 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx

[2010/05/08 15:05:25 | 000,029,760 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx

[2010/05/08 15:05:25 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm

[2010/05/08 15:05:25 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm

[2010/05/08 15:05:24 | 000,000,288 | ---- | M] () -- C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat

[2010/05/08 15:05:24 | 000,000,288 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat

[2010/05/08 15:05:06 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Vince Andreoni\ntuser.ini

[2010/05/08 15:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At16.job

[2010/05/08 14:48:02 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Vince Andreoni\Local Settings\Application Data\prvlcl.dat

[2010/05/08 14:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At15.job

[2010/05/08 13:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At14.job

[2010/05/08 12:05:17 | 006,950,856 | -H-- | M] () -- C:\Documents and Settings\Vince Andreoni\Local Settings\Application Data\IconCache.db

[2010/05/08 12:00:04 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At13.job

[2010/05/08 11:57:47 | 059,724,220 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm

[2010/05/08 11:53:04 | 000,002,262 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/05/07 11:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At12.job

[2010/05/06 02:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At3.job

[2010/05/06 01:58:48 | 000,000,570 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/05/06 01:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At2.job

[2010/05/05 19:44:13 | 000,000,816 | ---- | M] () -- C:\Documents and Settings\Vince Andreoni\Desktop\HijackThis.lnk

[2010/05/05 19:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At20.job

[2010/05/05 18:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At19.job

[2010/05/05 17:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At18.job

[2010/05/05 16:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At17.job

[2010/05/05 00:02:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At1.job

[2010/05/04 23:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At24.job

[2010/05/04 22:32:56 | 000,000,748 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk

[2010/05/04 22:00:01 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At23.job

[2010/05/04 21:28:31 | 000,000,627 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk

[2010/05/04 21:28:30 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll

[2010/05/04 21:28:28 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys

[2010/05/04 21:28:13 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys

[2010/05/04 21:28:12 | 000,029,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys

[2010/05/04 21:28:08 | 000,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm

[2010/05/04 21:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At22.job

[2010/05/04 20:00:19 | 000,000,650 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Professional.lnk

[2010/05/04 20:00:17 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At21.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At9.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At8.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At7.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At6.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At5.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At4.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At11.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\At10.job

[2010/05/04 18:35:33 | 000,045,568 | RHS- | M] () -- C:\WINDOWS\System32\rsvpe.dll

[2010/05/04 12:46:22 | 004,481,358 | ---- | M] () -- C:\WINDOWS\{00000002-00000000-00000002-00001102-00000004-10031102}.CDF

[2010/05/04 11:50:58 | 000,002,055 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/04/10 21:33:04 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/08 18:26:40 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Vince Andreoni\Desktop\NTREGOPT.lnk

[2010/05/08 18:26:40 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Vince Andreoni\Desktop\ERUNT.lnk

[2010/05/08 18:25:44 | 000,867,892 | ---- | C] () -- C:\Documents and Settings\Vince Andreoni\Desktop\SecurityCheck.exe

[2010/05/06 01:58:48 | 000,000,570 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/05/05 19:44:12 | 000,000,816 | ---- | C] () -- C:\Documents and Settings\Vince Andreoni\Desktop\HijackThis.lnk

[2010/05/04 23:35:16 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2010/05/04 22:32:56 | 000,000,748 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk

[2010/05/04 21:28:31 | 000,000,627 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk

[2010/05/04 21:28:08 | 000,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm

[2010/05/04 21:27:55 | 059,724,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm

[2010/05/04 20:00:19 | 000,000,650 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Professional.lnk

[2010/05/04 19:10:14 | 001,152,444 | ---- | C] () -- C:\WINDOWS\UDB.zip

[2010/05/04 19:10:14 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll

[2010/05/04 19:10:14 | 000,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml

[2010/05/04 19:10:14 | 000,000,880 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml

[2010/05/04 19:10:14 | 000,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At9.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At8.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At7.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At6.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At5.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At4.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At3.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At24.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At23.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At22.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At21.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At20.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At19.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At18.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At17.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At16.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At15.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At14.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At13.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At12.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At11.job

[2010/05/04 18:35:56 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At10.job

[2010/05/04 18:35:55 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At2.job

[2010/05/04 18:35:55 | 000,000,380 | ---- | C] () -- C:\WINDOWS\tasks\At1.job

[2010/05/04 18:35:42 | 000,000,306 | -H-- | C] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

[2010/05/04 18:35:37 | 000,000,314 | -HS- | C] () -- C:\WINDOWS\tasks\ybsdvp.job

[2010/05/04 18:35:33 | 000,045,568 | RHS- | C] () -- C:\WINDOWS\System32\rsvpe.dll

[2010/05/04 18:35:26 | 000,000,264 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

[2009/04/16 18:21:01 | 000,000,230 | ---- | C] () -- C:\WINDOWS\reimage.ini

[2009/04/13 08:04:12 | 001,380,403 | ---- | C] () -- C:\WINDOWS\System32\avgsdk.dll

[2009/01/21 23:04:39 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009/01/14 23:37:39 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI

[2009/01/14 23:37:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SBWIN.INI

[2009/01/14 23:37:06 | 000,066,807 | ---- | C] () -- C:\WINDOWS\System32\Aud2_Del.ini

[2009/01/14 23:37:06 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini

[2009/01/14 23:36:57 | 000,005,515 | ---- | C] () -- C:\WINDOWS\System32\ENSDEF.INI

[2009/01/14 23:36:57 | 000,000,180 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI

[2008/11/20 19:52:22 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2010/05/04 21:27:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar

[2010/05/04 21:24:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9

[2010/05/03 19:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Soulseek

[2010/05/04 21:05:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2009/09/16 11:28:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2009/04/15 12:28:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

[2010/03/26 23:10:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\BitTorrent

[2010/05/04 18:29:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\DNA

[2010/05/04 20:46:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\EEB7D1EAF1B8C0A7E2642E0133BD5E1B

[2010/05/04 18:39:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\ezLife

[2010/05/05 17:45:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\IObit

[2009/02/28 02:47:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vince Andreoni\Application Data\Thunderbird

[2010/05/05 00:02:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job

[2010/05/07 11:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job

[2010/05/08 12:00:04 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job

[2010/05/08 13:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job

[2010/05/08 14:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job

[2010/05/08 15:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job

[2010/05/05 16:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job

[2010/05/05 17:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job

[2010/05/05 18:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job

[2010/05/06 01:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job

[2010/05/05 19:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job

[2010/05/04 20:00:17 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job

[2010/05/04 21:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job

[2010/05/04 22:00:01 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job

[2010/05/04 23:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job

[2010/05/06 02:00:00 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job

[2010/05/04 18:35:58 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job

[2010/05/08 18:15:40 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\Tasks\ybsdvp.job

[2010/05/08 18:16:34 | 000,000,264 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

[2010/05/08 18:21:00 | 000,000,306 | -H-- | M] () -- C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

Edited May 9, 2010 by Maurice Naggar
Removed quote-reply section

touchez · May 9, 2010

OTL Extras logfile created on: 5/8/2010 6:33:03 PM - Run 1

OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\Vince Andreoni\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 169.00 Mb Available Physical Memory | 33.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 9.77 Gb Total Space | 4.09 Gb Free Space | 41.87% Space Free | Partition Type: NTFS

Drive D: | 64.73 Gb Total Space | 24.77 Gb Free Space | 38.26% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: GOD

Current User Name: Vince Andreoni

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:TCP" = 1900:TCP:LocalSubNet:Enabled:UDP 1900

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\ATT-HSI\McciBrowser.exe" = C:\Program Files\ATT-HSI\McciBrowser.exe:*:Enabled:motivebrowser.exe -- (Motive Communications, Inc.)

"D:\Program Files\SoulseekNS\slsk.exe" = D:\Program Files\SoulseekNS\slsk.exe:*:Enabled:SoulSeek -- ()

"D:\Program Files\BitTorrent\bittorrent.exe" = D:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)

"D:\Program Files\Mozilla Firefox\firefox.exe" = D:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)

"D:\Program Files\iTunes\iTunes.exe" = D:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)

"D:\Program Files\AVG\AVG9\avgemc.exe" = D:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)

"D:\Program Files\AVG\AVG9\avgupd.exe" = D:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)

"D:\Program Files\AVG\AVG9\avgnsx.exe" = D:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime

"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java 6 Update 12

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes

"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support

"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Professional

"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD

"{E82BF103-904F-49C0-B77F-6EC110B71E87}" = Sound Blaster Audigy 2

"{F14B8ECC-BDA0-4987-9201-D7B7DBE11033}" = Nero 7 Ultra Edition

"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop 7.0" = Adobe Photoshop 7.0

"Advanced SystemCare 3_is1" = Advanced SystemCare 3

"ATT-PRT22" = ATT-PRT22

"AVG9Uninstall" = AVG Free 9.0

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"ERUNT_is1" = ERUNT 1.1j

"Free RAR Extract Frog" = Free RAR Extract Frog

"HijackThis" = HijackThis 2.0.2

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"Intel

Edited May 9, 2010 by Maurice Naggar
Removed quote-reply section

Maurice Naggar · May 9, 2010

When making a reply, please only use the ADDReply button at bottom right of forum window

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not touchez and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Step 1

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

Double-click FixPolicies.exe.
Click the "Install" button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
A black box will briefly appear and then close.
This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.

Step 2

Please double-click OTL.com to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy all the lines in between the **** stars lines **** below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
*****************************************************************
:files
C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk
C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINDOWS\tasks\ybsdvp.job
C:\WINDOWS\tasks\At*.job
C:\WINDOWS\System32\rsvpe.dll
:Commands
[purity]
[emptytemp]
[CREATERESTOREPOINT]
*****************************************************************
Return to OTL. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
Close any browser(s) windows that may be open.
Using your mouse, click on the red-lettered button Run Fix.
Once you see a message box "Fix complete! Click OK to open the fix log."
Click the OK button
The log will open in Notepad (your default text editor).
Save the log. Post a copy of that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.

If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Step 3

See this topic in the AumHa Security forum and get the latest Java run-time

http://aumha.net/viewtopic.php?f=26&t=43792

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
  [*]Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  [*]Click OK to leave the Temporary Files Window
Small tweaks for Java runtime, since most all users do not need to load Java at each Windows startup:
Click Advanced Tab. Expand the Miscellaneous item.
UN-check the line Java quick starter
If you want to also un-check the "Check for updates automatically" you may:
Click the Update tab. un-check the line if it is checked.
Press Apply then OK. Close the applet when done.
To test your Java Run-time, you may go to this page http://www.java.com/en/download/help/testvm.xml
When all is well, you should see Java Version: Java 6 Update 20 from Sun Microsystems Inc.
Step 4
Using Internet Explorer browser only, go to ESET Online Scanner website:
Vista users should start IE by Start (Vista Orb) >> Internet Explorer >> Right-Click and select Run As Administrator.
- Accept the Terms of Use and press Start button;
- Approve the install of the required ActiveX Control, then follow on-screen instructions;
- Enable (check) the Remove found threats option, and run the scan.
- After the scan completes, the Details tab in the Results window will display what was found and removed.
  - A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt.
  Look at contents of this file using Notepad or Wordpad.
  The Frequently Asked Questions for ESET Online Scanner can be viewed here
  http://www.eset.com/onlinescan/cac4.php?page=faq
  - From ESET Tech Support: If you have ESET NOD32 installed, you should disable it prior to running this scanner.
    Otherwise the scan will take twice as long to do:
    everytime the ESET online scanner opens a file on your computer to scan it, NOD32 on your machine will rescan the file as a result.
  - It is emphasized to temporarily disable any pc-resident {active} antivirus program prior to any on-line scan by any on-line scanner.
    (And the prompt re-enabling when finished.)
  - If you use Firefox, you have to install IETab, an add-on. This is to enable ActiveX support.
Step 5
Go to Control Panel > Add-or-Remove Programs. Locate the entry for Malwarebytes MBAM. Now de-install it, if found.
Logoff and Restart Windows for a new start.
Next, Download & Save and then run the MBAM Clean utility.
It should prompt you to Restart the system. Do so. If there's no prompt, do Logoff and Restart fresh.
Next, Please try this version of malwarebytes: Click the link >> here <<
Save it on your desktop. You'll see it will have a random name, and will look similar like this:
Doubleclick on it, so it will extract the files and will start Malwarebytes automatically.
In case the installer (random named file) won't run either, rename it to BRAVO.EXE and try again.
When Malwarebytes opens, click the "Update" tab FIRST and select to check for updates in order to get the latest updates.
In case Malwarebytes doesn't open, search for the folder mbam-installer on your desktop, open it and doubleclick the file winlogon.exe which will be present in there. This should launch Malwarebytes.
Then perform a scan and let it remove what it found. Reboot afterwards (important).
Step 6
De-install (remove) the copy of HijackThis and then get the latest version 2.04
Download and SAVE >> HijackThis <<
Save the HJT to your desktop or the folder of your choice, then navigate to that folder and double-click Hijackthis.exe to start it.
Do a "Scan and Save log".
Reply with copy of contents of OTL Moved Files log
ESET scan log
the MBAM log
the new Hijackthis log
and tell me, How is your system now ?
Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.
Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Edited May 9, 2010 by Maurice Naggar

touchez · May 9, 2010

I run Fix_Policies.cmd and then move on to OTL. After I paste the proper text into the "Custom Scans/Fixes" window and then select "Run Fix", it doesn't get far. At the bottom of OTL it says,

"Processing IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C}" and stops there. After about 5-10 minutes of waiting, OTL eventually says it's not responding, so then I end the process and reset. I tried it 1 more time and the same thing happened.

Maurice Naggar · May 9, 2010

I've modified my reply just a bit, for the OTL fix. Please do a screen refresh (F5) and redo step 2 once more, then go forward with all the next steps.

touchez · May 10, 2010

I got as far as trying to install the randomly named Malwarebytes file. Tried renaming it bravo.exe, but I still kept getting the run time error 0, 440 messages. Went into the mbam-installer folder and tried to run winlogon.exe, got the same run time error messages. Here's my OTL log and ESET scan logs, though:

All processes killed

========== FILES ==========

C:\Documents and Settings\All Users\Desktop\Advanced SystemCare.lnk moved successfully.

C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job moved successfully.

C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully.

C:\WINDOWS\tasks\ybsdvp.job moved successfully.

C:\WINDOWS\tasks\At1.job moved successfully.

C:\WINDOWS\tasks\At10.job moved successfully.

C:\WINDOWS\tasks\At11.job moved successfully.

C:\WINDOWS\tasks\At12.job moved successfully.

C:\WINDOWS\tasks\At13.job moved successfully.

C:\WINDOWS\tasks\At14.job moved successfully.

C:\WINDOWS\tasks\At15.job moved successfully.

C:\WINDOWS\tasks\At16.job moved successfully.

C:\WINDOWS\tasks\At17.job moved successfully.

C:\WINDOWS\tasks\At18.job moved successfully.

C:\WINDOWS\tasks\At19.job moved successfully.

C:\WINDOWS\tasks\At2.job moved successfully.

C:\WINDOWS\tasks\At20.job moved successfully.

C:\WINDOWS\tasks\At21.job moved successfully.

C:\WINDOWS\tasks\At22.job moved successfully.

C:\WINDOWS\tasks\At23.job moved successfully.

C:\WINDOWS\tasks\At24.job moved successfully.

C:\WINDOWS\tasks\At3.job moved successfully.

C:\WINDOWS\tasks\At4.job moved successfully.

C:\WINDOWS\tasks\At5.job moved successfully.

C:\WINDOWS\tasks\At6.job moved successfully.

C:\WINDOWS\tasks\At7.job moved successfully.

C:\WINDOWS\tasks\At8.job moved successfully.

C:\WINDOWS\tasks\At9.job moved successfully.

C:\WINDOWS\System32\rsvpe.dll moved successfully.

File\Folder :Commands not found.

File\Folder [purity] not found.

File\Folder [emptytemp] not found.

File\Folder [CREATERESTOREPOINT] not found.

OTL by OldTimer - Version 3.2.4.1 log created on 05092010_165835

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=7.00.6000.16827 (vista_gdr.090226-1506)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=a83c672a9f2908418b2563d23659e6c9

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-05-10 01:51:34

# local_time=2010-05-09 06:51:34 (-0800, Pacific Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=768 16777215 100 0 0 0 0 0

# compatibility_mode=1024 16777191 100 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=44670

# found=11

# cleaned=11

# scan_time=4980

C:\Documents and Settings\Vince Andreoni\Application Data\Thunderbird\Profiles\r88e1vav.default\Mail\Local Folders\Inbox multiple threats (contained infected files) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Application Data\Thunderbird\Profiles\r88e1vav.default\Mail\Local Folders\Junk multiple threats (contained infected files) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\96.tmp a variant of Win32/Mebroot.DV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\99.tmp a variant of Win32/Mebroot.DV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\enxrascowm.tmp a variant of Win32/TrojanClicker.Punad.AA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\Ovv.exe a variant of Win32/Injector.BET trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\xcemwsaorn.tmp multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\nsm9E.tmp\cnclb.dll Win32/Lifze.H trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\RarSFX0\ezwi1550.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Vince Andreoni\Local Settings\Temp\RarSFX0\smwi1550.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

C:\Program Files\Internet Explorer\js.mui Win32/TrojanDownloader.Unruy.BO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

touchez · May 12, 2010

Should I try it again? Did I maybe do something wrong? Was I supposed to run FixPolicies.exe everytime my computer restarted?

Maurice Naggar · May 14, 2010

Fixpolicies you needed to run just one time. It appears that you may not have copied all my script lines for OTL fix. Do not run it again. Just follow my directions.

Close and save any open work documents, and exit programs you started.

Next step

Download TFC by OldTimer to your desktop

Please double-click TFC.exe to run it. (Note: If you are running on Vista or Windows 7, right-click on the file and choose Run As Administrator).
It will close all programs when run, so make sure you have saved all your work before you begin.
Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
IF prompted to Reboot, reply "Yes".

Step 2

De-install Advanced System Care.

De-install (remove) the copy of HijackThis you now have and then get the latest version 2.04

Download and SAVE >> HijackThis <<

Save the HJT to your desktop or the folder of your choice, then navigate to that folder and double-click Hijackthis.exe to start it.

Do a "Scan and Save log".

Step 3

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

Double-click gmer.exe. The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click Yes.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
Save it where you can easily find it, such as your desktop.

Now, reply with copy of the Hijackthis log

and the Gmer.txt log

touchez · May 15, 2010

I ran TFC, uninstalled Advanced System Care, got rid of my old Hijack this and got the new one, ran hijack this, then ran GMER Rootkit Scanner; that's when the problems started. I've tried to run GMER 4 times now, and each time something different happens. All 4 times it hasn't encountered a possible rootkit activity, so I've just selected the "Scan" option while on the Rootkit/Malware tab (show all unticked). The 1st time it just stopped scanning and everything on my computer just sort of shut off. The 2nd time it said it encountered an error and had to close. The 3rd time it was scanning for about 2 hours and then my computer just rebooted by itself. The 4th time it encountered an error again and shut itself off. I'll copy my Hijackthis log, but I never could finish a GMER scan. Hopefully I'm not giving you an enormous headache.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:48:11 AM, on 5/15/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

D:\Program Files\AVG\AVG9\avgchsvx.exe

D:\Program Files\AVG\AVG9\avgrsx.exe

D:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

D:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

D:\Program Files\AVG\AVG9\avgemc.exe

D:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\system32\wuauclt.exe

D:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

D:\Program Files\AVG\AVG9\avgupd.exe

C:\Documents and Settings\Vince Andreoni\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"