strider88 Posted August 11, 2010 ID:299191 Share Posted August 11, 2010 I just had an instance of Antivir Solution Pro on my computer, so I ran the Malwarebytes anti-malware scan which found it and took care of it no problem. But now I'm suffering from regular attempted attacks every 2-3 minutes by different IPs, I ran an Mbam scan, AVG scan and a SUPERantispyware scan and got nothing. I hope I read the instructions right, The GMER Rootkit Scanner popped up with the following message when I tried to run it "C:\Windows\system32\config\system: The system cannot find the file specified." Here is the latest Mbam log:15:56:02 Strider MESSAGE Protection started successfully15:56:05 Strider MESSAGE IP Protection started successfully15:57:28 Strider MESSAGE IP Protection stopped15:57:31 Strider MESSAGE Database updated successfully15:57:31 Strider MESSAGE IP Protection started successfully15:57:59 Strider MESSAGE IP Protection stopped15:57:59 Strider MESSAGE IP Protection started successfully16:32:11 Strider IP-BLOCK 85.159.232.5116:32:11 Strider IP-BLOCK 85.159.232.5116:32:11 Strider IP-BLOCK 85.159.232.5116:32:11 Strider IP-BLOCK 85.159.232.5116:32:11 Strider IP-BLOCK 85.159.232.5116:32:11 Strider IP-BLOCK 85.159.232.5216:32:11 Strider IP-BLOCK 85.159.232.5216:32:11 Strider IP-BLOCK 85.159.232.5216:32:11 Strider IP-BLOCK 85.159.232.5216:32:11 Strider IP-BLOCK 85.159.232.5216:32:11 Strider IP-BLOCK 85.159.232.5316:32:11 Strider IP-BLOCK 85.159.232.5316:32:11 Strider IP-BLOCK 85.159.232.5316:32:11 Strider IP-BLOCK 85.159.232.5316:32:11 Strider IP-BLOCK 85.159.232.5316:32:11 Strider IP-BLOCK 85.159.232.5416:32:11 Strider IP-BLOCK 85.159.232.5416:32:11 Strider IP-BLOCK 85.159.232.5416:32:11 Strider IP-BLOCK 85.159.232.5416:32:11 Strider IP-BLOCK 85.159.232.5416:32:19 Strider IP-BLOCK 85.159.232.5116:32:19 Strider IP-BLOCK 85.159.232.5216:32:19 Strider IP-BLOCK 85.159.232.5316:32:19 Strider IP-BLOCK 85.159.232.5116:32:19 Strider IP-BLOCK 85.159.232.5416:32:19 Strider IP-BLOCK 85.159.232.5216:32:19 Strider IP-BLOCK 85.159.232.5316:32:19 Strider IP-BLOCK 85.159.232.5416:32:19 Strider IP-BLOCK 85.159.232.5116:32:19 Strider IP-BLOCK 85.159.232.5216:32:20 Strider IP-BLOCK 85.159.232.5316:32:20 Strider IP-BLOCK 85.159.232.5416:32:20 Strider IP-BLOCK 85.159.232.5116:32:20 Strider IP-BLOCK 85.159.232.5216:32:20 Strider IP-BLOCK 85.159.232.5316:32:20 Strider IP-BLOCK 85.159.232.5416:32:28 Strider IP-BLOCK 85.159.232.5116:32:28 Strider IP-BLOCK 85.159.232.5216:32:28 Strider IP-BLOCK 85.159.232.5316:32:28 Strider IP-BLOCK 85.159.232.5116:32:28 Strider IP-BLOCK 85.159.232.5116:32:28 Strider IP-BLOCK 85.159.232.5416:32:28 Strider IP-BLOCK 85.159.232.5216:32:28 Strider IP-BLOCK 85.159.232.5216:32:28 Strider IP-BLOCK 85.159.232.5316:32:28 Strider IP-BLOCK 85.159.232.5316:32:28 Strider IP-BLOCK 85.159.232.5416:32:28 Strider IP-BLOCK 85.159.232.5416:32:28 Strider IP-BLOCK 85.159.232.5116:32:28 Strider IP-BLOCK 85.159.232.5216:32:28 Strider IP-BLOCK 85.159.232.5316:32:28 Strider IP-BLOCK 85.159.232.5416:32:28 Strider IP-BLOCK 85.159.232.5116:32:28 Strider IP-BLOCK 85.159.232.5216:32:28 Strider IP-BLOCK 85.159.232.5316:32:28 Strider IP-BLOCK 85.159.232.5116:32:28 Strider IP-BLOCK 85.159.232.5416:32:28 Strider IP-BLOCK 85.159.232.5216:32:28 Strider IP-BLOCK 85.159.232.5316:32:28 Strider IP-BLOCK 85.159.232.5417:06:05 Strider IP-BLOCK 121.13.149.13717:36:34 Strider IP-BLOCK 81.192.93.1017:50:28 Strider IP-BLOCK 89.28.119.18718:04:39 Strider IP-BLOCK 212.117.160.20418:04:39 Strider IP-BLOCK 219.146.165.8718:04:55 Strider IP-BLOCK 117.205.48.19718:05:24 Strider MESSAGE IP Protection stopped18:05:24 Strider MESSAGE IP Protection started successfully18:16:28 Strider IP-BLOCK 222.71.19.22618:38:05 Strider IP-BLOCK 95.168.183.4018:49:50 Strider IP-BLOCK 222.64.106.20919:05:52 Strider IP-BLOCK 219.152.117.10820:42:06 Strider MESSAGE Protection started successfully20:42:10 Strider MESSAGE IP Protection started successfully20:45:06 Strider IP-BLOCK 77.222.142.14820:48:04 Strider IP-BLOCK 95.168.183.4020:52:54 Strider IP-BLOCK 77.222.142.14820:57:36 Strider IP-BLOCK 218.10.47.15021:00:35 Strider IP-BLOCK 188.65.50.8321:02:44 Strider IP-BLOCK 94.96.204.10221:03:17 Strider IP-BLOCK 94.96.203.6521:05:18 Strider IP-BLOCK 95.154.199.20021:08:24 Strider IP-BLOCK 95.168.183.4021:09:21 Strider IP-BLOCK 95.154.199.20021:09:21 Strider IP-BLOCK 95.154.199.20021:09:21 Strider IP-BLOCK 95.154.199.20021:09:29 Strider IP-BLOCK 95.154.199.20021:11:06 Strider IP-BLOCK 95.154.199.20021:11:14 Strider IP-BLOCK 95.154.199.20021:11:14 Strider IP-BLOCK 95.154.199.20021:11:22 Strider IP-BLOCK 95.154.199.20021:12:27 Strider IP-BLOCK 95.168.183.4021:12:27 Strider IP-BLOCK 95.168.183.4021:12:27 Strider IP-BLOCK 95.168.183.4021:12:35 Strider IP-BLOCK 95.168.183.4021:15:23 Strider IP-BLOCK 59.34.8.20421:17:16 Strider IP-BLOCK 95.154.199.20021:17:16 Strider IP-BLOCK 95.154.199.20021:17:24 Strider IP-BLOCK 95.154.199.20021:17:24 Strider IP-BLOCK 95.154.199.20021:23:34 Strider MESSAGE Protection started successfully21:23:38 Strider MESSAGE IP Protection started successfullyAnd here is the DDS log:DDS (Ver_10-03-17.01) - NTFSX64 Run by Strider at 18:48:46.69 on Tue 08/10/2010Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18Microsoft Windows 7 Home Premium 6.1.7600.2.1252.1.1033.18.4091.2192 [GMT -7:00]SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}============== Running Processes ===============C:\Windows\system32\wininit.exeC:\Program Files (x86)\AVG\AVG9\avgchsva.exeC:\Program Files (x86)\AVG\AVG9\avgrsa.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Program Files (x86)\AVG\AVG9\avgcsrva.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\system32\atiesrxx.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\atieclxx.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files (x86)\AVG\AVG9\avgwdsvc.exeC:\Program Files (x86)\Bonjour\mDNSResponder.exeC:\Windows\SysWOW64\PnkBstrA.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files (x86)\uTorrent\uTorrent.exeC:\Program Files (x86)\DAEMON Tools Lite\DTLite.exeC:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Windows\System32\rundll32.exeC:\Windows\SysWOW64\rundll32.exeC:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files (x86)\AVG\AVG9\avgtray.exeC:\Program Files (x86)\dcmsvc\dcmsvc.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Users\Strider\Downloads\dds.scrC:\Windows\system32\conhost.exeC:\Windows\system32\wbem\wmiprvse.exe============== Pseudo HJT Report ===============mLocal Page = c:\windows\syswow64\blank.htmuInternet Settings,ProxyServer = http=127.0.0.1:6522uInternet Settings,ProxyOverride = <local>BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dlluRun: [uTorrent] "c:\program files (x86)\utorrent\uTorrent.exe"uRun: [DAEMON Tools Lite] "c:\program files (x86)\daemon tools lite\DTLite.exe" -autorunuRun: [sUPERAntiSpyware] c:\program files (x86)\superantispyware\SUPERAntiSpyware.exeuRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /backgrounduRun: [Video Library] c:\windows\system32\rundll32.exe c:\users\strider\appdata\local\temp\Rpcqt.dll,SetsmRun: [startCCC] "c:\program files (x86)\ati technologies\ati.ace\core-static\CLIStart.exe" MSRunmRun: [AVG9_TRAY] c:\progra~2\avg\avg9\avgtray.exemRun: [dcmsvc] c:\program files (x86)\dcmsvc\dcmsvc.exemRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [sunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe"mRun: [Malwarebytes' Anti-Malware] "c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe" /starttraymPolicies-explorer: NoActiveDesktop = 1 (0x1)mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: E&xport to Microsoft Excel - c:\progra~2\micros~3\office12\EXCEL.EXE/3000IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~3\office12\ONBttnIE.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~3\office12\REFIEBAR.DLLDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabNotify: !SASWinLogon - c:\program files (x86)\superantispyware\SASWINLO.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files (x86)\superantispyware\SASSEH.DLLAppInit_DLLs-X64: avgrssta.dll================= FIREFOX ===================FF - ProfilePath - c:\users\strider\appdata\roaming\mozilla\firefox\profiles\4mvk6nc6.default\FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npclntax_HotbarSA.dllFF - plugin: c:\program files (x86)\mozilla firefox\plugins\NPMFireLauncher.dllFF - plugin: c:\program files (x86)\mozilla firefox\plugins\npRLCT4Player.dllFF - plugin: c:\program files (x86)\pando networks\media booster\npPandoWebPlugin.dllFF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}---- FIREFOX POLICIES ----c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");============= SERVICES / DRIVERS ===============R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\drivers\avgldx64.sys [2009-10-30 269904]R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\drivers\avgmfx64.sys [2009-10-30 35536]R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-10-30 203264]R2 avg9wd;AVG Free WatchDog;c:\program files (x86)\avg\avg9\avgwdsvc.exe [2010-7-15 308136]R2 MBAMService;MBAMService;c:\program files (x86)\malwarebytes' anti-malware\mbamservice.exe [2010-7-18 304464]R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60a.sys [2009-6-10 270848]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-7-18 24664]R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\netw5v64.sys [2009-6-10 5434368]R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [2009-10-29 168864]R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [2009-10-29 315840]S1 SASDIFSV;SASDIFSV;c:\program files (x86)\superantispyware\sasdifsv.sys [2010-2-17 12872]S1 SASKUTIL;SASKUTIL;c:\program files (x86)\superantispyware\SASKUTIL.SYS [2010-2-17 66632]S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\dragon age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]S3 SASENUM;SASENUM;c:\program files (x86)\superantispyware\SASENUM.SYS [2010-2-17 12872]=============== Created Last 30 ================2010-08-10 17:43:36 0 d-----w- c:\programdata\Update2010-08-06 04:30:33 0 d-----w- C:\AMD2010-08-06 03:31:24 0 d-----w- c:\programdata\Blizzard Entertainment2010-08-06 03:31:24 0 d-----w- c:\program files (x86)\StarCraft II2010-08-06 03:31:24 0 d-----w- c:\program files (x86)\common files\Blizzard Entertainment2010-07-27 17:14:01 0 d-----w- c:\program files (x86)\Starcraft2010-07-24 03:37:34 0 d-----w- c:\program files (x86)\Computer Alarm Clock2010-07-24 03:33:40 0 d-----w- c:\program files (x86)\Alarm Clock2010-07-19 02:38:04 1021 ----a-w- c:\windows\EFXP.ini2010-07-19 02:01:41 0 d-----w- c:\users\strider\appdata\roaming\Malwarebytes2010-07-19 02:01:33 24664 ----a-w- c:\windows\system32\drivers\mbam.sys2010-07-19 02:01:33 0 d-----w- c:\programdata\Malwarebytes2010-07-19 02:01:33 0 d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware2010-07-18 23:25:13 0 d-----w- c:\users\strider\appdata\roaming\C50C3E96C2BCA3D2DA62597151DF52D62010-07-18 15:14:15 1012 ----a-w- c:\windows\EF.ini2010-07-18 15:13:52 0 d-----w- c:\program files (x86)\Raven2010-07-18 15:13:41 306688 ----a-w- c:\windows\IsUninst.exe2010-07-18 15:04:34 0 d-----w- c:\users\strider\appdata\roaming\Xfire2010-07-18 15:04:33 0 d-----w- c:\program files (x86)\Xfire2010-07-18 15:03:02 0 d-----w- C:\Netgame2010-07-15 16:45:12 13048 ----a-w- c:\windows\system32\avgrssta.dll==================== Find3M ====================2010-07-15 16:44:50 269904 ----a-w- c:\windows\system32\drivers\avgldx64.sys2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat2009-11-12 23:28:48 75 --sh--r- c:\windows\CT4CET.bin2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat2010-01-14 23:30:50 245760 --sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat2009-11-26 23:40:11 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat2010-02-04 08:33:48 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat2009-07-14 04:55:03 32768 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat2009-11-04 23:07:29 16384 --sha-w- c:\windows\temp\cookies\index.dat2009-11-04 23:07:29 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat2009-11-04 23:07:29 16384 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe============= FINISH: 18:50:05.24 ===============Attach.zip Link to post Share on other sites More sharing options...
Gammo Posted August 13, 2010 ID:299879 Share Posted August 13, 2010 Hi,Download OTL to your DesktopDouble click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.Check the box that says Scan All Users.Under the Custom Scan box paste this innetsvcs%SYSTEMDRIVE%\*.*%systemroot%\Fonts\*.com%systemroot%\Fonts\*.dll%systemroot%\Fonts\*.ini%systemroot%\Fonts\*.ini2%systemroot%\Fonts\*.exe%systemroot%\system32\spool\prtprocs\w32x86\*.*%systemroot%\REPAIR\*.bak1%systemroot%\REPAIR\*.ini%systemroot%\system32\*.jpg%systemroot%\*.jpg%systemroot%\*.png%systemroot%\*.scr%systemroot%\*._sy%APPDATA%\Adobe\Update\*.*%ALLUSERSPROFILE%\Favorites\*.*%APPDATA%\Microsoft\*.*%PROGRAMFILES%\*.*%APPDATA%\Update\*.*%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\System32\config\*.sav%PROGRAMFILES%|bak;true;false;false /fp%systemroot%\system32|bak;true;false;false /fp%ALLUSERSPROFILE%\Start Menu\*.lnk /x%systemroot%\system32\config\systemprofile\*.dat /x%systemroot%\*.config%systemroot%\system32\*.dbHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rsClick the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time Link to post Share on other sites More sharing options...
strider88 Posted August 14, 2010 Author ID:300502 Share Posted August 14, 2010 First off thanks for the help, my confidence in my PC has been shattered.The OTL report:OTL logfile created on: 8/14/2010 3:12:20 PM - Run 2OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Strider\Downloads64bit- Home Premium Edition Service Pack 2 (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free8.00 Gb Paging File | 6.00 Gb Available in Paging File | 81.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 465.76 Gb Total Space | 170.98 Gb Free Space | 36.71% Space Free | Partition Type: NTFSD: Drive not present or media not loadedE: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: HEADHUUNTERCurrent User Name: StriderLogged in as Administrator.Current Boot Mode: NormalScan Mode: All usersInclude 64bit ScansCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 90 DaysOutput = StandardQuick Scan========== Processes (SafeList) ==========PRC - [2010/08/10 18:28:54 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Strider\Downloads\OTL.exePRC - [2010/07/15 09:45:13 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exePRC - [2010/07/15 09:45:11 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exePRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2009/12/25 19:10:45 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe========== Modules (SafeList) ==========MOD - [2010/08/10 18:28:54 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Strider\Downloads\OTL.exeMOD - [2009/07/13 18:17:54 | 000,242,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\rsaenh.dllMOD - [2009/07/13 18:16:19 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\wmiutils.dllMOD - [2009/07/13 18:16:17 | 000,427,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\vbscript.dllMOD - [2009/07/13 18:16:17 | 000,362,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbemcomn.dllMOD - [2009/07/13 18:16:17 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\wbemdisp.dllMOD - [2009/07/13 18:16:17 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\wbemsvc.dllMOD - [2009/07/13 18:16:17 | 000,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\wbemprox.dllMOD - [2009/07/13 18:16:15 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\sxs.dllMOD - [2009/07/13 18:16:13 | 000,045,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\RpcRtRemote.dllMOD - [2009/07/13 18:16:11 | 000,090,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\ntdsapi.dllMOD - [2009/07/13 18:15:21 | 000,828,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\fontext.dllMOD - [2009/07/13 18:15:21 | 000,093,696 | ---- | M] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysWOW64\fms.dllMOD - [2009/07/13 18:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\fastprox.dllMOD - [2009/07/13 18:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocxMOD - [2009/07/13 18:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll========== Win32 Services (SafeList) ==========SRV:64bit: - File not found [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV:64bit: - [2009/06/25 18:48:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)SRV - [2010/07/15 09:45:11 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd)SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2009/12/30 17:06:49 | 000,321,320 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2009/12/25 19:10:45 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)SRV - [2009/12/15 13:07:16 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc)========== Driver Services (SafeList) ==========DRV:64bit: - [2010/07/15 09:44:50 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (AvgLdx64)DRV:64bit: - [2010/06/02 14:19:57 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (AvgMfx64)DRV:64bit: - [2010/04/29 15:39:28 | 000,024,664 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)DRV:64bit: - [2010/03/18 18:49:24 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)DRV:64bit: - [2010/03/18 18:49:23 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)DRV:64bit: - [2009/11/04 15:14:41 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)DRV:64bit: - [2009/07/13 18:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2009/07/13 18:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 18:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/07/13 17:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)DRV:64bit: - [2009/07/13 16:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)DRV:64bit: - [2009/06/25 19:24:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)DRV:64bit: - [2009/06/10 13:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)DRV:64bit: - [2009/06/10 13:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel®DRV:64bit: - [2009/06/10 13:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/06/05 05:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2008/09/19 02:03:00 | 000,315,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OA001Vid.sys -- (OA001Vid)DRV:64bit: - [2008/06/03 18:30:38 | 000,168,864 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OA001Ufd.sys -- (OA001Ufd)DRV:64bit: - [2008/04/21 11:53:10 | 000,025,752 | ---- | M] (XBCD Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xbcd.sys -- (XBCD)DRV - [2010/02/17 11:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)DRV - [2010/02/17 11:15:58 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)DRV - [2010/02/17 11:15:58 | 000,012,872 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E 01 41 FD 57 2F CB 01 [binary data]IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522========== FireFox ==========FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/07/21 16:31:47 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/07/21 16:31:47 | 000,000,000 | ---D | M][2009/10/30 12:37:22 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Mozilla\Extensions[2010/06/30 12:53:07 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Mozilla\Firefox\Profiles\4mvk6nc6.default\extensions[2010/02/20 21:31:39 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions[2009/11/09 18:30:56 | 000,189,592 | ---- | M] (MGame) -- C:\Program Files (x86)\Mozilla Firefox\plugins\NPMFireLauncher.dllO1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [dcmsvc] C:\Program Files (x86)\dcmsvc\dcmsvc.exe File not foundO4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [startCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000..\Run: [sUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)O4 - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)O4 - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000..\Run: [Video Library] C:\Users\Strider\AppData\Local\Temp\Rpcqt.DLL (Safer Networking Limited )O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O13 - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not foundO20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)O32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 90 Days ==========[2010/08/10 10:43:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Update[2010/08/10 10:43:06 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\qfojkagtg[2010/08/10 10:42:49 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\Windows Server[2010/08/05 21:30:33 | 000,000,000 | ---D | C] -- C:\AMD[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\Users\Strider\Documents\StarCraft II[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StarCraft II[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment[2010/07/27 10:14:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Starcraft[2010/07/23 20:37:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Computer Alarm Clock[2010/07/23 20:33:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Alarm Clock[2010/07/18 19:01:41 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Roaming\Malwarebytes[2010/07/18 19:01:34 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys[2010/07/18 19:01:33 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys[2010/07/18 19:01:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2010/07/18 19:01:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/07/18 16:25:34 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\foxivavqd[2010/07/18 16:25:13 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Roaming\C50C3E96C2BCA3D2DA62597151DF52D6[2010/07/18 08:13:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Raven[2010/07/18 08:04:34 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Roaming\Xfire[2010/07/18 08:04:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Xfire[2010/07/18 08:03:02 | 000,000,000 | ---D | C] -- C:\Netgame[2010/07/15 09:45:12 | 000,013,048 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\avgrssta.dll[2010/07/09 14:37:05 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\PMB Files[2010/07/09 14:37:04 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files[2010/07/09 14:36:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]========== Files - Modified Within 90 Days ==========[2010/08/14 15:12:22 | 003,407,872 | -HS- | M] () -- C:\Users\Strider\NTUSER.DAT[2010/08/14 14:58:19 | 000,013,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/08/14 14:58:19 | 000,013,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/08/14 14:56:19 | 000,713,888 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2010/08/14 14:56:19 | 000,615,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2010/08/14 14:56:19 | 000,103,702 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2010/08/14 14:51:06 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT[2010/08/14 14:50:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/08/14 14:50:54 | 560,479,924 | ---- | M] () -- C:\Windows\MEMORY.DMP[2010/08/14 14:50:52 | 3217,182,720 | -HS- | M] () -- C:\hiberfil.sys[2010/08/14 13:12:29 | 063,430,874 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm[2010/08/14 03:19:30 | 001,932,775 | -H-- | M] () -- C:\Users\Strider\AppData\Local\IconCache.db[2010/08/10 21:25:00 | 000,003,648 | ---- | M] () -- C:\Users\Strider\Documents\Attach.zip[2010/08/10 21:20:24 | 000,000,188 | ---- | M] () -- C:\Users\Strider\defogger_reenable[2010/08/10 21:15:19 | 000,293,376 | ---- | M] () -- C:\Users\Strider\Desktop\gq9uuf60.exe[2010/08/05 20:41:44 | 000,001,097 | ---- | M] () -- C:\Users\Public\Desktop\StarCraft II.lnk[2010/07/27 10:14:39 | 000,001,023 | ---- | M] () -- C:\Users\Strider\Desktop\StarCraft.lnk[2010/07/23 20:33:40 | 000,000,977 | ---- | M] () -- C:\Users\Strider\Desktop\Alarm Clock.lnk[2010/07/18 19:38:05 | 000,001,021 | ---- | M] () -- C:\Windows\EFXP.ini[2010/07/18 08:14:17 | 000,002,201 | ---- | M] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Holomatch.lnk[2010/07/18 08:14:17 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Single Player.lnk[2010/07/18 08:14:15 | 000,001,012 | ---- | M] () -- C:\Windows\EF.ini[2010/07/18 08:03:43 | 000,001,579 | ---- | M] () -- C:\Users\Strider\Desktop\OPERATION7.lnk[2010/07/15 09:45:12 | 000,013,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\avgrssta.dll[2010/07/15 09:44:50 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys[2010/07/09 15:49:59 | 000,000,294 | ---- | M] () -- C:\Users\Strider\Desktop\Resume Download of The Lord of the Rings Online.url[2010/06/02 14:19:57 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]========== Files Created - No Company Name ==========[2010/08/10 21:25:00 | 000,003,648 | ---- | C] () -- C:\Users\Strider\Documents\Attach.zip[2010/08/10 21:20:24 | 000,000,188 | ---- | C] () -- C:\Users\Strider\defogger_reenable[2010/08/10 21:15:18 | 000,293,376 | ---- | C] () -- C:\Users\Strider\Desktop\gq9uuf60.exe[2010/08/05 20:31:24 | 000,001,097 | ---- | C] () -- C:\Users\Public\Desktop\StarCraft II.lnk[2010/07/27 10:14:39 | 000,001,023 | ---- | C] () -- C:\Users\Strider\Desktop\StarCraft.lnk[2010/07/23 20:33:40 | 000,000,977 | ---- | C] () -- C:\Users\Strider\Desktop\Alarm Clock.lnk[2010/07/18 19:38:04 | 000,001,021 | ---- | C] () -- C:\Windows\EFXP.ini[2010/07/18 08:14:17 | 000,002,201 | ---- | C] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Holomatch.lnk[2010/07/18 08:14:17 | 000,002,185 | ---- | C] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Single Player.lnk[2010/07/18 08:14:15 | 000,001,012 | ---- | C] () -- C:\Windows\EF.ini[2010/07/18 08:03:43 | 000,001,579 | ---- | C] () -- C:\Users\Strider\Desktop\OPERATION7.lnk[2010/07/09 15:49:59 | 000,000,294 | ---- | C] () -- C:\Users\Strider\Desktop\Resume Download of The Lord of the Rings Online.url[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2009/01/25 14:10:48 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll[2009/01/08 16:01:22 | 000,815,104 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll[2008/11/20 13:45:30 | 000,042,320 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll[2008/10/07 10:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll[2008/10/07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll[2007/04/17 16:34:40 | 000,135,716 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat[2002/10/15 15:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll========== LOP Check ==========[2009/12/31 17:42:47 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Aura4You[2010/08/10 10:42:47 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\C50C3E96C2BCA3D2DA62597151DF52D6[2009/12/02 04:14:58 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.1[2009/11/04 16:03:59 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\DAEMON Tools Lite[2010/01/08 14:43:09 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Gearbox Software[2010/03/20 21:03:08 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\OpenOffice.org[2009/10/30 16:54:13 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\runic games[2009/11/12 16:56:49 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\tmp[2010/08/14 15:07:46 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\uTorrent[2010/03/19 18:39:42 | 000,032,618 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2009/07/13 18:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr[2009/10/29 18:05:50 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt[2007/11/07 09:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt[2007/11/07 09:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt[2008/04/11 10:07:18 | 000,010,134 | ---- | M] () -- C:\eula.1049.txt[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt[2008/04/11 10:07:18 | 000,001,110 | ---- | M] () -- C:\globdata.ini[2010/08/14 14:50:52 | 3217,182,720 | -HS- | M] () -- C:\hiberfil.sys[2008/04/11 08:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe[2008/04/11 10:07:18 | 000,000,843 | ---- | M] () -- C:\install.ini[2008/04/11 08:03:48 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll[2008/04/11 08:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll[2008/04/11 08:03:48 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll[2008/04/11 08:03:48 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll[2008/04/11 08:03:48 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll[2008/04/11 08:03:48 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll[2008/04/11 08:03:48 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll[2008/04/11 10:09:24 | 000,093,200 | ---- | M] (Microsoft Corporation) -- C:\install.res.1049.dll[2008/04/11 08:03:48 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll[2008/04/11 08:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll[2006/12/01 23:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll[2010/08/14 14:50:54 | 4289,576,960 | -HS- | M] () -- C:\pagefile.sys[2010/07/18 19:00:43 | 000,000,499 | ---- | M] () -- C:\rkill.log[2008/04/11 10:07:18 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp[2007/11/07 08:50:40 | 001,927,956 | ---- | M] () -- C:\VC_RED.cab[2007/11/07 08:53:12 | 000,242,176 | ---- | M] () -- C:\VC_RED.MSI< %systemroot%\Fonts\*.com >[2009/07/13 22:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont[2009/07/13 22:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont[2009/07/13 22:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont[2009/07/13 22:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont< %systemroot%\Fonts\*.dll >< %systemroot%\Fonts\*.ini >[2009/06/10 13:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini< %systemroot%\Fonts\*.ini2 >< %systemroot%\Fonts\*.exe >< %systemroot%\system32\spool\prtprocs\w32x86\*.* >< %systemroot%\REPAIR\*.bak1 >< %systemroot%\REPAIR\*.ini >< %systemroot%\system32\*.jpg >< %systemroot%\*.jpg >< %systemroot%\*.png >< %systemroot%\*.scr >< %systemroot%\*._sy >< %APPDATA%\Adobe\Update\*.* >< %ALLUSERSPROFILE%\Favorites\*.* >< %APPDATA%\Microsoft\*.* >< %PROGRAMFILES%\*.* >[2009/07/13 21:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini< %APPDATA%\Update\*.* >< %systemroot%\*. /mp /s >< %systemroot%\System32\config\*.sav >< %PROGRAMFILES%|bak;true;false;false /fp >< %systemroot%\system32|bak;true;false;false /fp >< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >< %systemroot%\system32\config\systemprofile\*.dat /x >< %systemroot%\*.config >< %systemroot%\system32\*.db >< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >< End of report >And the extras.txt:OTL Extras logfile created on: 8/14/2010 2:11:01 PM - Run 1OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Strider\Downloads64bit- Home Premium Edition Service Pack 2 (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 71.00% Memory free8.00 Gb Paging File | 7.00 Gb Available in Paging File | 82.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 465.76 Gb Total Space | 174.52 Gb Free Space | 37.47% Space Free | Partition Type: NTFSD: Drive not present or media not loadedE: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: HEADHUUNTERCurrent User Name: StriderLogged in as Administrator.Current Boot Mode: NormalScan Mode: All usersInclude 64bit ScansCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 90 DaysOutput = StandardQuick Scan========== Extra Registry (SafeList) ==================== File Associations ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>][HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)[HKEY_USERS\S-1-5-21-2068625909-1864389607-3729417074-1000\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)========== Shell Spawning ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %* File not foundcmdfile [open] -- "%1" %* File not foundcomfile [open] -- "%1" %* File not foundexefile [open] -- "%1" %* File not foundhelpfile [open] -- Reg Error: Key error.htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %* File not foundregfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1" File not foundscrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /S File not foundtxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not foundDirectory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 164bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 064bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"DisableNotifications" = 0"EnableFirewall" = 1========== Authorized Applications List ==================== HKEY_LOCAL_MACHINE Uninstall List ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{04054166-0801-48A9-89E0-BC4B53FE7A81}_is1" = XBCD Uninstaller"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)"{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition)"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022"{64FBA03C-575C-D688-1C80-A5773CE471F9}" = ATI Catalyst Install Manager"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{9EFC40E3-5F31-4F75-8445-286273F74D8E}" = Apple Mobile Device Support"{A5F59952-475D-4DCC-BEAD-C216FC68E05C}" = iTunes"{D3E7A2A5-A059-4A44-949B-21FBD371A8B9}" = Paint.NET v3.5"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour"{E461C0B2-523B-2940-C5DF-D174284CE609}" = ccc-utility64"Creative OA001" = Integrated Webcam Driver (1.03.02.0919) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{03CFDC67-5B03-EE5C-4176-F545B0D2F485}" = CCC Help Korean"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{0A2AC888-61DC-CD55-5969-8602A7E9716D}" = CCC Help Italian"{0CA38F52-F0FA-4B9F-8A36-EC8A9609FBBC}" = Halo 2 for Windows Vista"{0CF884B6-C6D8-EB7B-D2BF-2877C6F49EBC}" = CCC Help Swedish"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen"{185CC275-907C-0D83-B0C2-7B065C5108D8}" = CCC Help Chinese Traditional"{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java 6 Update 18"{2ED967AD-FBB0-5355-F5F2-E7A03AAD4F71}" = Catalyst Control Center Localization All"{2EF0D7ED-F944-4E0D-AC78-7DA00C0B81E4}_is1" = Penumbra Episode 1"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)"{30FA0F5C-B1A9-39EB-8148-3D574C0C8332}" = Catalyst Control Center Graphics Previews Common"{35852FDE-7263-23EA-435F-44E4B61996D0}" = CCC Help Japanese"{406FB8A4-F539-48A9-809C-F94706F9C9F6}_is1" = S.T.A.L.K.E.R. - Call of Pripyat [v1.6.02]"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD"{445F6C1F-C48F-0CC9-A030-040D3EA42C93}" = Catalyst Control Center Graphics Full New"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant"{46E08E5F-02B4-E854-CD4F-ED3E4FEBE122}" = CCC Help French"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{5A841BCF-1C5B-E3DA-9475-892CA6576425}" = CCC Help Finnish"{5B8741B6-4BEA-47D3-DB77-959C7FF35B39}" = Catalyst Control Center Graphics Full Existing"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411"{5F055711-2CAF-4323-8443-BEE4913FC7E6}" = Shade: Wrath Of Angels"{5FA16D15-FA5B-7F0F-7CBB-369E1E2937C9}" = CCC Help Spanish"{61F27C5E-5274-0DB8-67CC-5253C6CF2B93}" = CCC Help Dutch"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator"{6625CE8F-6E89-561F-D828-1B8535DEEBB6}" = Catalyst Control Center Core Implementation"{69533745-1E2D-4C98-8B4A-B7643EF9E1A2}" = Catalyst Control Center - Branding"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2"{6D2CCC4B-007D-EEE7-3E69-578B178A7B91}" = Catalyst Control Center Graphics Previews Vista"{71E3D92F-2C51-B4E9-F2B6-EAF89C33E580}" = CCC Help Portuguese"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2"{77F218D6-EAF4-402C-36B1-C3F0EC62598D}" = ccc-core-static"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{839916F4-D8B5-4407-BE6D-6D4EB9D96AF4}" = LIVE gaming on Windows Runtime Version 1.0.6027"{86C527CC-4AF2-903C-7BFF-5975272CC645}" = Catalyst Control Center InstallProxy"{870013DB-984D-42A8-9E63-8673D8B2775A}" = Stubbs The Zombie"{894084B6-BC69-43B7-BF06-B93AECFEA520}" = GameSpy Comrade"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8DDFDDE9-C206-F32E-66AD-D17558D7677E}" = CCC Help German"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007"{96443F45-13E2-11D6-AC87-00D0B7A9E540}" = Arx Fatalis"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster"{A2A4AC67-DC60-A92B-DD50-65BEE8FA8D71}" = CCC Help Russian"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support"{B9C5005C-56CA-38E4-A093-79F22ECA0427}" = CCC Help Norwegian"{BABAEBE4-9FFB-4B5D-9453-64FF11517CA2}" = Tom Clancy's Splinter Cell Chaos Theory"{C5334C85-F601-427C-85F7-CDD9FDC8C69F}" = StubbsPatchInstaller"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition"{DC857502-657E-4046-83C9-2CB973E62C26}" = Nosferatu"{DC93F14E-D2C9-D6D1-31B6-D31AC2AD3BB0}" = Catalyst Control Center Graphics Light"{E0303B6A-C675-4102-95DA-C013625BFA99}" = GTA San Andreas"{E6E0F53B-B7B8-E052-5C32-76C885536A3E}" = CCC Help Danish"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call"{F7FE3C6E-ECB8-0853-584F-BE19BA05B1B8}" = CCC Help Chinese Standard"{FCC49808-C684-FEFA-3C02-46A04A7C9EBD}" = CCC Help English"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin"Advanced Audio FX Engine" = Advanced Audio FX Engine"Advanced Video FX Engine" = Advanced Video FX Engine"Alarm Clock_is1" = Alarm Clock v1.0"Audacity_is1" = Audacity 1.2.6"Aura Video Converter_is1" = Aura Video Converter 1.2.1"AutoGK" = Auto Gordian Knot 2.55"AVG9Uninstall" = AVG Free 9.0"AviSynth" = AviSynth 2.5"bgbennyboyGrimReplacementSetup_is1" = Grim Fandango"Blood Omen 2" = Blood Omen 2"dcmsvc_is1" = dcmsvc 1.0"Dell Webcam Center" = Dell Webcam Center"Dell Webcam Manager" = Dell Webcam Manager"Dexter Screen Saver" = Dexter Screen Saver"DVD Decrypter" = DVD Decrypter (Remove Only)"Guild Wars" = Guild Wars"Halo 2" = Halo 2 for Windows Vista"Hitman: Contracts" = Hitman: Contracts"HOMESTUDENTR" = Microsoft Office Home and Student 2007"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware"Mozilla Firefox (3.5.11)" = Mozilla Firefox (3.5.11)"OpenAL" = OpenAL"OPERATION7" = OPERATION7"PunkBusterSvc" = PunkBuster Services"Runic Games Torchlight" = Torchlight"S.T.A.L.K.E.R. - Link to post Share on other sites More sharing options...
Gammo Posted August 15, 2010 ID:300810 Share Posted August 15, 2010 Hi,Run OTLUnder the Custom Scans/Fixes box at the bottom, paste in the following:OTLIE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>IE - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522O4 - HKU\S-1-5-21-2068625909-1864389607-3729417074-1000..\Run: [Video Library] C:\Users\Strider\AppData\Local\Temp\Rpcqt.DLL (Safer Networking Limited )[2010/08/10 10:43:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Update[2010/08/10 10:43:06 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\qfojkagtg[2010/08/10 10:42:49 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\Windows Server[2010/07/18 16:25:34 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\foxivavqd[2010/07/18 16:25:13 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Roaming\C50C3E96C2BCA3D2DA62597151DF52D6[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]:Services:Reg:Filesipconfig /flushdns /c:Commands[purity][resethosts][emptytemp][emptyflash][createrestorepoint][reboot]Then click the Run Fix button at the topLet the program run unhindered, reboot the PC when it is doneOpen OTL again and click the Quick Scan button. Post the log it produces in your next reply. Link to post Share on other sites More sharing options...
strider88 Posted August 16, 2010 Author ID:300934 Share Posted August 16, 2010 OTL logfile created on: 8/15/2010 10:04:01 PM - Run 3OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Strider\Downloads64bit- Home Premium Edition Service Pack 2 (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 70.00% Memory free8.00 Gb Paging File | 7.00 Gb Available in Paging File | 83.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 465.76 Gb Total Space | 169.44 Gb Free Space | 36.38% Space Free | Partition Type: NTFSD: Drive not present or media not loadedE: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: HEADHUUNTERCurrent User Name: StriderLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userInclude 64bit ScansCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 90 DaysOutput = StandardQuick Scan========== Processes (SafeList) ==========PRC - [2010/08/10 18:28:54 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Strider\Downloads\OTL.exePRC - [2010/07/21 16:31:46 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exePRC - [2010/07/15 09:45:13 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exePRC - [2010/07/15 09:45:11 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exePRC - [2010/05/14 15:52:46 | 000,322,352 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files (x86)\uTorrent\uTorrent.exePRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2010/04/01 12:28:36 | 002,010,864 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exePRC - [2009/12/25 19:10:45 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe========== Modules (SafeList) ==========MOD - [2010/08/10 18:28:54 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Strider\Downloads\OTL.exeMOD - [2009/07/13 18:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocxMOD - [2009/07/13 18:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll========== Win32 Services (SafeList) ==========SRV:64bit: - File not found [Auto | Running] -- C:\Windows\SysNative\PnkBstrA.exe -- (PnkBstrA)SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV:64bit: - [2009/06/25 18:48:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)SRV - [2010/07/15 09:45:11 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd)SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2009/12/30 17:06:49 | 000,321,320 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2009/12/25 19:10:45 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)SRV - [2009/12/15 13:07:16 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc)========== Driver Services (SafeList) ==========DRV:64bit: - [2010/07/15 09:44:50 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (AvgLdx64)DRV:64bit: - [2010/06/02 14:19:57 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (AvgMfx64)DRV:64bit: - [2010/04/29 15:39:28 | 000,024,664 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)DRV:64bit: - [2010/03/18 18:49:24 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)DRV:64bit: - [2010/03/18 18:49:23 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)DRV:64bit: - [2009/11/04 15:14:41 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)DRV:64bit: - [2009/07/13 18:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2009/07/13 18:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 18:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/07/13 17:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)DRV:64bit: - [2009/07/13 16:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)DRV:64bit: - [2009/06/25 19:24:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)DRV:64bit: - [2009/06/10 13:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)DRV:64bit: - [2009/06/10 13:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel®DRV:64bit: - [2009/06/10 13:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/06/05 05:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2008/09/19 02:03:00 | 000,315,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OA001Vid.sys -- (OA001Vid)DRV:64bit: - [2008/06/03 18:30:38 | 000,168,864 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OA001Ufd.sys -- (OA001Ufd)DRV:64bit: - [2008/04/21 11:53:10 | 000,025,752 | ---- | M] (XBCD Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xbcd.sys -- (XBCD)DRV - [2010/02/17 11:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)DRV - [2010/02/17 11:15:58 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)DRV - [2010/02/17 11:15:58 | 000,012,872 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7E 01 41 FD 57 2F CB 01 [binary data]IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0========== FireFox ==========FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/07/21 16:31:47 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/07/21 16:31:47 | 000,000,000 | ---D | M][2009/10/30 12:37:22 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Mozilla\Extensions[2010/06/30 12:53:07 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Mozilla\Firefox\Profiles\4mvk6nc6.default\extensions[2010/02/20 21:31:39 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions[2009/11/09 18:30:56 | 000,189,592 | ---- | M] (MGame) -- C:\Program Files (x86)\Mozilla Firefox\plugins\NPMFireLauncher.dllO1 HOSTS File: ([2010/08/15 21:56:37 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\HostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: ::1 localhostO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [dcmsvc] C:\Program Files (x86)\dcmsvc\dcmsvc.exe File not foundO4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [startCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)O4 - HKCU..\Run: [sUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)O13 - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not foundO20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)O32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 90 Days ==========[2010/08/15 21:56:36 | 000,000,000 | ---D | C] -- C:\_OTL[2010/08/05 21:30:33 | 000,000,000 | ---D | C] -- C:\AMD[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\Users\Strider\Documents\StarCraft II[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StarCraft II[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment[2010/08/05 20:31:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment[2010/07/27 10:14:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Starcraft[2010/07/23 20:37:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Computer Alarm Clock[2010/07/23 20:33:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Alarm Clock[2010/07/18 19:01:41 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Roaming\Malwarebytes[2010/07/18 19:01:34 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys[2010/07/18 19:01:33 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys[2010/07/18 19:01:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2010/07/18 19:01:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/07/18 08:13:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Raven[2010/07/18 08:04:34 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Roaming\Xfire[2010/07/18 08:04:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Xfire[2010/07/18 08:03:02 | 000,000,000 | ---D | C] -- C:\Netgame[2010/07/15 09:45:12 | 000,013,048 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\avgrssta.dll[2010/07/09 14:37:05 | 000,000,000 | ---D | C] -- C:\Users\Strider\AppData\Local\PMB Files[2010/07/09 14:37:04 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files[2010/07/09 14:36:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks========== Files - Modified Within 90 Days ==========[2010/08/15 22:03:40 | 000,713,888 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2010/08/15 22:03:40 | 000,615,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2010/08/15 22:03:40 | 000,103,702 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2010/08/15 21:59:23 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT[2010/08/15 21:59:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/08/15 21:59:06 | 3217,182,720 | -HS- | M] () -- C:\hiberfil.sys[2010/08/15 21:58:27 | 003,407,872 | -HS- | M] () -- C:\Users\Strider\NTUSER.DAT[2010/08/15 21:58:24 | 001,936,929 | -H-- | M] () -- C:\Users\Strider\AppData\Local\IconCache.db[2010/08/15 21:57:35 | 000,013,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/08/15 21:57:35 | 000,013,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/08/15 21:56:37 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts[2010/08/15 21:54:23 | 063,481,130 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm[2010/08/14 14:50:54 | 560,479,924 | ---- | M] () -- C:\Windows\MEMORY.DMP[2010/08/10 21:25:00 | 000,003,648 | ---- | M] () -- C:\Users\Strider\Documents\Attach.zip[2010/08/10 21:20:24 | 000,000,188 | ---- | M] () -- C:\Users\Strider\defogger_reenable[2010/08/10 21:15:19 | 000,293,376 | ---- | M] () -- C:\Users\Strider\Desktop\gq9uuf60.exe[2010/08/05 20:41:44 | 000,001,097 | ---- | M] () -- C:\Users\Public\Desktop\StarCraft II.lnk[2010/07/27 10:14:39 | 000,001,023 | ---- | M] () -- C:\Users\Strider\Desktop\StarCraft.lnk[2010/07/23 20:33:40 | 000,000,977 | ---- | M] () -- C:\Users\Strider\Desktop\Alarm Clock.lnk[2010/07/18 19:38:05 | 000,001,021 | ---- | M] () -- C:\Windows\EFXP.ini[2010/07/18 08:14:17 | 000,002,201 | ---- | M] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Holomatch.lnk[2010/07/18 08:14:17 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Single Player.lnk[2010/07/18 08:14:15 | 000,001,012 | ---- | M] () -- C:\Windows\EF.ini[2010/07/18 08:03:43 | 000,001,579 | ---- | M] () -- C:\Users\Strider\Desktop\OPERATION7.lnk[2010/07/15 09:45:12 | 000,013,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\avgrssta.dll[2010/07/15 09:44:50 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys[2010/07/09 15:49:59 | 000,000,294 | ---- | M] () -- C:\Users\Strider\Desktop\Resume Download of The Lord of the Rings Online.url[2010/06/02 14:19:57 | 000,035,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys========== Files Created - No Company Name ==========[2010/08/10 21:25:00 | 000,003,648 | ---- | C] () -- C:\Users\Strider\Documents\Attach.zip[2010/08/10 21:20:24 | 000,000,188 | ---- | C] () -- C:\Users\Strider\defogger_reenable[2010/08/10 21:15:18 | 000,293,376 | ---- | C] () -- C:\Users\Strider\Desktop\gq9uuf60.exe[2010/08/05 20:31:24 | 000,001,097 | ---- | C] () -- C:\Users\Public\Desktop\StarCraft II.lnk[2010/07/27 10:14:39 | 000,001,023 | ---- | C] () -- C:\Users\Strider\Desktop\StarCraft.lnk[2010/07/23 20:33:40 | 000,000,977 | ---- | C] () -- C:\Users\Strider\Desktop\Alarm Clock.lnk[2010/07/18 19:38:04 | 000,001,021 | ---- | C] () -- C:\Windows\EFXP.ini[2010/07/18 08:14:17 | 000,002,201 | ---- | C] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Holomatch.lnk[2010/07/18 08:14:17 | 000,002,185 | ---- | C] () -- C:\Users\Public\Desktop\Star Trek Voyager Elite Force Single Player.lnk[2010/07/18 08:14:15 | 000,001,012 | ---- | C] () -- C:\Windows\EF.ini[2010/07/18 08:03:43 | 000,001,579 | ---- | C] () -- C:\Users\Strider\Desktop\OPERATION7.lnk[2010/07/09 15:49:59 | 000,000,294 | ---- | C] () -- C:\Users\Strider\Desktop\Resume Download of The Lord of the Rings Online.url[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2009/01/25 14:10:48 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll[2009/01/08 16:01:22 | 000,815,104 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll[2008/11/20 13:45:30 | 000,042,320 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll[2008/10/07 10:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll[2008/10/07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll[2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll[2007/04/17 16:34:40 | 000,135,716 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat[2002/10/15 15:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll========== LOP Check ==========[2009/12/31 17:42:47 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Aura4You[2009/12/02 04:14:58 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.1[2009/11/04 16:03:59 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\DAEMON Tools Lite[2010/01/08 14:43:09 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\Gearbox Software[2010/03/20 21:03:08 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\OpenOffice.org[2009/10/30 16:54:13 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\runic games[2009/11/12 16:56:49 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\tmp[2010/08/15 22:06:33 | 000,000,000 | ---D | M] -- C:\Users\Strider\AppData\Roaming\uTorrent[2010/03/19 18:39:42 | 000,032,618 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==========< End of report > Link to post Share on other sites More sharing options...
Gammo Posted August 16, 2010 ID:300992 Share Posted August 16, 2010 Hi,Start Malwarebytes' Anti-MalwareOnce the program has loaded, click the "Update" tab and click the "Check For updates" button.Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'd like us to scan your machine with ESET OnlineScanHold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScanClick the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check Click the button.Accept any security warnings from your browser.Check Push the Start button.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.Push the button.Push Link to post Share on other sites More sharing options...
strider88 Posted August 17, 2010 Author ID:301254 Share Posted August 17, 2010 Both Mbam & ESET found zero infections.Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4437Windows 6.1.7600 Service Pack 2Internet Explorer 8.0.7600.163858/16/2010 2:20:07 PMmbam-log-2010-08-16 (14-20-07).txtScan type: Quick scanObjects scanned: 128535Time elapsed: 3 minute(s), 34 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Gammo Posted August 17, 2010 ID:301544 Share Posted August 17, 2010 Hi,Your logs appears to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. :thumbsup: Open OTLUnder the Custom Scans/Fixes box at the bottom, paste the following::Commands[clearallrestorepoints]Click the Run Fix button at the topIt might ask you to reboot, if so click YES~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Download OTC to your desktop and run itA list of tool components used in the Cleanup of malware will be downloaded.If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.Click Yes to begin the Cleanup process and remove these components, including this application.You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Please download JavaRa to your desktop and unzip it to its own folderRun JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.Accept any prompts.Open JavaRa.exe again and select Search For Updates.Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep a backup of your important filesNow, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Make proper use of your anti-virus and firewallYou should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep all your software updatedIt is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Use a safer web browserInternet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Some other security programsIt is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.SpywareBlaster to help prevent spyware from installing in the first place.MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Be carefulHaving security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Slow computer?If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!Cheers,Gammo Link to post Share on other sites More sharing options...
strider88 Posted August 18, 2010 Author ID:301723 Share Posted August 18, 2010 I hate to say it but the infection is still present.Latest protection log:00:17:58 Strider IP-BLOCK 94.96.234.21500:17:58 Strider IP-BLOCK 89.149.226.19605:00:00 Strider MESSAGE Scheduled scan executed successfully16:39:35 Strider MESSAGE Protection started successfully16:39:39 Strider MESSAGE IP Protection started successfully16:44:35 Strider IP-BLOCK 212.117.183.25317:00:38 Strider IP-BLOCK 59.34.124.5817:28:25 Strider IP-BLOCK 94.96.196.617:42:42 Strider IP-BLOCK 94.96.113.18217:49:41 Strider IP-BLOCK 212.95.32.175 Link to post Share on other sites More sharing options...
Gammo Posted August 18, 2010 ID:301840 Share Posted August 18, 2010 EDIT: Instructions updated (see next post). Link to post Share on other sites More sharing options...
Gammo Posted August 20, 2010 ID:302890 Share Posted August 20, 2010 Hi,I notice you're using uTorrent. That's probably the cause of the IP blocks.Please uninstall uTorrent and then wait in order to see if the IP blocks reoccur. Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 28, 2010 ID:305861 Share Posted August 28, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts