jacksonv Posted September 23, 2010 ID:317191 Share Posted September 23, 2010 Hello everyone, Malewarebytes will not let me update. I'm given this message when I try to. MBAM_ERROR_UPDATING(12007, 0, WinHttpSendRequest)I've tried all of the troubleshooting steps that you guys recommend and I cannot get it to work. I have Windows XP and I'm not too good with computers. Also, on my second computer I've got the "Microsoft Security Essentials Alert" fake virus that I cannot fix either. I've been on bleepingcomputer and have followed their steps but it won't work. I've ran Malewarebytes on that computer and it shows up that I have none, but I cannot get Malewarebytes to update on that computer either. So right now that computer is just sitting there with this "Microsoft Security Essentials Alert" fake virus popped up and I cannot open the internet. I'm interested in getting this computer to update Malewarebytes and if possible get some help on my other computer with the fake virus (my internet on that computer will not open since I've gotten the virus so I'll have to do everything on this computer)Thank you! Link to post Share on other sites More sharing options...
Elise Posted September 23, 2010 ID:317399 Share Posted September 23, 2010 Hello , And My name is Elise and I'll be glad to help you with your computer problems.I will be working on your malware issues, this may or may not solve other issues you may have with your machine.Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen. Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. -----------------------------------------------------------If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.If you have already posted a log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.We need to see some information about what is happening in your machine. Please perform the following scan:Please download OTL from one of the following mirrors:This is THE Mirror[*]Save it to your desktop.[*]Double click on the icon on your desktop.[*]Click the "Scan All Users" checkbox.[*]Push the Quick Scan button.[*]Two reports will open, copy and paste them in a reply here:OTListIt.txt <-- Will be openedExtra.txt <-- Will be minimizedPlease download Rootkit Unhooker and save it to your DesktopDouble-click on RKUnhookerLE to run itClick the Report tab, then click ScanCheck Drivers, Stealth and uncheck the restClick OKWait until it's finished and then go to File > Save ReportSave the report to your DesktopCopy the entire contents of the report and paste it in a reply here.Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!It is recommended to remove parasite, okay?"-------------------------------------------------------------In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problemIf you still need help, please include the following in your next replyA detailed description of your problemsA new OTL log (don't forget extra.txt)RKU logThanks and again sorry for the delay. Link to post Share on other sites More sharing options...
jacksonv Posted September 23, 2010 Author ID:317537 Share Posted September 23, 2010 When I go to websites I will sometimes get redirected or I'll get a new window popping up. One of the windows I've noticed is called wordslife, I cannot remember the others. I downloaded Malewarebytes but cannot get it to update. I get this error when I try to update: MBAM_ERROR_UPDATING(12007, 0, WinHttpSendRequest). OTL logfile created on: 9/23/2010 11:11:27 AM - Run 1OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Josh Wicoff\My DocumentsWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File freePaging file location(s): C:\pagefile.sys 0 0 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 37.25 Gb Total Space | 13.72 Gb Free Space | 36.83% Space Free | Partition Type: NTFSD: Drive not present or media not loadedE: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: JWICOFFCurrent User Name: Josh WicoffLogged in as Administrator.Current Boot Mode: NormalScan Mode: All usersCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 90 DaysOutput = StandardQuick Scan========== Processes (SafeList) ==========PRC - [2010/09/23 11:07:33 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Josh Wicoff\My Documents\OTL.exePRC - [2010/09/23 11:02:03 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exePRC - [2010/08/07 13:05:43 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exePRC - [2010/08/07 13:05:41 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exePRC - [2010/08/07 13:05:37 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exePRC - [2010/08/07 13:05:19 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exePRC - [2010/08/07 13:04:51 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exePRC - [2010/08/07 13:04:46 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exePRC - [2009/11/19 11:26:54 | 000,455,944 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exePRC - [2009/01/14 17:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exePRC - [2008/08/18 18:41:00 | 001,832,272 | ---- | M] (Safer Networking Limited) -- C:\Program Files\Spybot - Search & Destroy 2\TeaTimer.exePRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2005/03/31 09:26:50 | 000,229,376 | ---- | M] (Yahoo!, Inc.) -- C:\Program Files\Yahoo!\browser\ycommon.exePRC - [2005/02/02 05:12:22 | 000,102,492 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exePRC - [2004/12/03 13:24:20 | 000,290,816 | ---- | M] (Hewlett-Packard ) -- C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exePRC - [2004/08/04 18:50:54 | 000,544,866 | ---- | M] (D-Link) -- C:\Program Files\D-Link AirPlus Xtreme G\AIRPLUS.exePRC - [2004/07/12 22:06:00 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\acs.exePRC - [2003/12/09 14:02:04 | 000,057,344 | ---- | M] (Yahoo!, Inc.) -- C:\Program Files\Yahoo!\browser\ybrwicon.exe========== Modules (SafeList) ==========MOD - [2010/09/23 11:07:33 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Josh Wicoff\My Documents\OTL.exeMOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocxMOD - [2005/02/02 05:12:14 | 000,069,724 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll========== Win32 Services (SafeList) ==========SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)SRV - [2010/08/07 13:04:51 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)SRV - [2010/08/07 13:04:46 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)SRV - [2009/11/19 11:26:54 | 000,455,944 | ---- | M] () [Auto | Running] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)SRV - [2009/01/14 17:53:02 | 000,226,656 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)SRV - [2004/07/12 22:06:00 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS)========== Driver Services (SafeList) ==========DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\JOSHWI~1\LOCALS~1\Temp\DMSKSSRh.sys -- (DMSKSSRh)DRV - [2010/08/07 13:06:53 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (AvgTdiX)DRV - [2010/08/07 13:06:40 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (AvgLdx86)DRV - [2010/08/07 13:06:39 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (AvgMfx86)DRV - [2006/03/15 13:36:25 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x)DRV - [2005/12/28 17:22:19 | 000,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)DRV - [2005/04/11 06:33:52 | 001,035,264 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)DRV - [2005/03/16 05:43:06 | 000,159,488 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)DRV - [2005/03/10 02:41:52 | 000,371,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)DRV - [2005/03/03 12:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)DRV - [2005/02/18 08:42:02 | 000,349,696 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6hal.sys -- (CAMCHALA)DRV - [2005/02/18 08:41:18 | 000,038,016 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6aud.sys -- (CAMCAUD)DRV - [2005/02/02 04:58:58 | 000,191,456 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)DRV - [2005/01/18 09:52:16 | 000,055,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)DRV - [2004/12/15 08:18:30 | 000,200,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWATI.sys -- (HSFHWATI)DRV - [2004/12/15 08:18:28 | 000,703,232 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)DRV - [2004/12/15 08:18:26 | 001,038,208 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)DRV - [2004/08/11 16:30:00 | 000,039,424 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)DRV - [2004/07/30 15:48:06 | 000,407,360 | ---- | M] (D-Link ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)DRV - [2004/04/14 07:36:50 | 000,007,432 | ---- | M] (Hewlett-Packard Company) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)DRV - [2003/07/15 23:27:40 | 000,043,264 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)DRV - [2003/06/06 11:46:16 | 000,005,220 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)DRV - [2001/08/17 12:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)DRV - [2001/08/17 08:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not foundIE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not foundIE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-805585887-968194908-2452809786-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/IE - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Xilisoft YouTube Toolbar\tbhelper.dll ()IE - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\URLSearchHook: CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not foundIE - HKU\S-1-5-21-805585887-968194908-2452809786-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-805585887-968194908-2452809786-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.localFF - HKLM\software\mozilla\Firefox\extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Program Files\RelevantKnowledge[2009/02/03 21:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Mozilla\Extensions[2009/02/03 21:14:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Mozilla\Extensions\mozswing@mozswing.orgO1 HOSTS File: ([2010/09/10 18:29:16 | 000,262,378 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: 127.0.0.1 www.007guard.comO1 - Hosts: 127.0.0.1 007guard.comO1 - Hosts: 127.0.0.1 008i.comO1 - Hosts: 127.0.0.1 www.008k.comO1 - Hosts: 127.0.0.1 008k.comO1 - Hosts: 127.0.0.1 www.00hq.comO1 - Hosts: 127.0.0.1 00hq.comO1 - Hosts: 127.0.0.1 010402.comO1 - Hosts: 127.0.0.1 www.032439.comO1 - Hosts: 127.0.0.1 032439.comO1 - Hosts: 127.0.0.1 www.1001-search.infoO1 - Hosts: 127.0.0.1 1001-search.infoO1 - Hosts: 127.0.0.1 www.100888290cs.comO1 - Hosts: 127.0.0.1 100888290cs.comO1 - Hosts: 127.0.0.1 www.100sexlinks.comO1 - Hosts: 127.0.0.1 100sexlinks.comO1 - Hosts: 127.0.0.1 www.10sek.comO1 - Hosts: 127.0.0.1 10sek.comO1 - Hosts: 127.0.0.1 www.123topsearch.comO1 - Hosts: 127.0.0.1 123topsearch.comO1 - Hosts: 127.0.0.1 www.132.comO1 - Hosts: 127.0.0.1 132.comO1 - Hosts: 127.0.0.1 www.136136.netO1 - Hosts: 127.0.0.1 136136.netO1 - Hosts: 9106 more lines...O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer Networking Limited)O2 - BHO: (UberButton Class) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll (Yahoo!)O2 - BHO: (YahooTaggedBM Class) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll (Yahoo! Inc.)O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll File not foundO2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O2 - BHO: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O2 - BHO: (SidebarAutoLaunch Class) - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (Yahoo! Inc.)O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Xilisoft YouTube Toolbar\tbcore3.dll ()O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)O3 - HKLM\..\Toolbar: (Xilisoft YouTube Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Xilisoft YouTube Toolbar\tbcore3.dll ()O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.O3 - HKLM\..\Toolbar: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll File not foundO3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O3 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)O3 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)O3 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\Toolbar\WebBrowser: (Xilisoft YouTube Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Xilisoft YouTube Toolbar\tbcore3.dll ()O3 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\Toolbar\WebBrowser: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)O3 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll File not foundO3 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)O4 - HKLM..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)O4 - HKLM..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe (Yahoo!, Inc.)O4 - HKU\S-1-5-21-805585887-968194908-2452809786-1006..\Run: [ares] C:\Program Files\Ares\Ares.exe File not foundO4 - HKU\S-1-5-21-805585887-968194908-2452809786-1006..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy 2\TeaTimer.exe (Safer Networking Limited)O4 - HKU\S-1-5-21-805585887-968194908-2452809786-1006..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe ()O4 - HKLM..\RunOnce: [NoIE4StubProcessing] File not foundO4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ACS.lnk = C:\WINDOWS\system32\Acs.bat ()O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus Xtreme G Configuration Utility.lnk = C:\Program Files\D-Link AirPlus Xtreme G\AIRPLUS.exe (D-Link)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-Link REG Utility.lnk = C:\Program Files\D-Link AirPlus Xtreme G\Reg.exe ()O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-805585887-968194908-2452809786-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll File not foundO9 - Extra Button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll (Yahoo!)O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer Networking Limited)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/...tiveXPlugin.cab (ScorchPlugin Class)O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)O24 - Desktop WallPaper: C:\Documents and Settings\Josh Wicoff\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Josh Wicoff\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)O32 - HKLM CDRom: AutoRun - 1O33 - MountPoints2\{368f67ee-c148-11dc-9a41-0011957b1a16}\Shell - "" = AutoRunO33 - MountPoints2\{368f67ee-c148-11dc-9a41-0011957b1a16}\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\{368f67ee-c148-11dc-9a41-0011957b1a16}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not foundO33 - MountPoints2\{42ea456a-023f-11db-99e7-00038a000015}\Shell\AutoRun\command - "" = wscript.exe \SMRTNTKY\script.jsO33 - MountPoints2\{6abd6ae1-0723-11dd-9a46-00c09ff388d1}\Shell - "" = AutoRunO33 - MountPoints2\{6abd6ae1-0723-11dd-9a46-00c09ff388d1}\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\{6abd6ae1-0723-11dd-9a46-00c09ff388d1}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not foundO33 - MountPoints2\{6abd6ae2-0723-11dd-9a46-00c09ff388d1}\Shell\AutoRun\command - "" = F:\LinksysConnectPC.exe -- File not foundO33 - MountPoints2\{ce4bd942-7d61-11df-8212-00c09ff388d1}\Shell\AutoRun\command - "" = E:\Setup_FlipShare.exe -- File not foundO33 - MountPoints2\{ce4bd942-7d61-11df-8212-00c09ff388d1}\Shell\Setup FlipShare\command - "" = E:\Setup_FlipShare.exe -- File not foundO34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 90 Days ==========[2010/09/23 11:07:25 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Josh Wicoff\My Documents\OTL.exe[2010/09/22 21:48:49 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Josh Wicoff\Recent[2010/09/22 17:39:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2010/09/21 22:00:23 | 000,000,000 | ---D | C] -- C:\Avenger[2010/09/18 12:03:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\Application Data\Malwarebytes[2010/09/18 12:03:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes[2010/09/07 15:09:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates[2010/09/07 14:51:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun[2010/09/07 14:28:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\My Documents\filelib[2010/09/07 14:03:21 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Josh Wicoff\PrivacIE[2010/09/07 14:01:52 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Josh Wicoff\IETldCache[2010/09/07 13:53:36 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8[2010/08/07 13:06:54 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll[2010/08/07 13:06:51 | 000,243,024 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys[2010/08/07 13:06:40 | 000,216,400 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys[2010/08/07 13:06:37 | 000,029,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys[2010/08/07 13:06:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg[2010/08/01 00:32:16 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll.prepare[2010/07/09 20:40:37 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner[2010/07/06 23:20:36 | 000,000,000 | ---D | C] -- C:\Program Files\MP3MyMP3 3.0[2010/07/06 20:20:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\Application Data\xVideoServiceThief[2010/07/06 20:18:27 | 000,000,000 | ---D | C] -- C:\Program Files\Xesc & Technology[2010/07/06 20:10:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\My Documents\Xilisoft[2010/07/06 20:10:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\Application Data\Xilisoft[2010/07/06 20:09:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\Application Data\Toolbar4[2010/07/06 20:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\Xilisoft YouTube Toolbar[2010/07/06 18:56:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\Local Settings\Application Data\AskToolbar[2010/07/06 18:52:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\My Documents\FrostWire[2010/07/06 18:52:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh Wicoff\Application Data\FrostWire[2010/07/06 18:51:59 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com[2010/07/06 18:51:10 | 000,000,000 | ---D | C] -- C:\Program Files\FrostWire[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files - Modified Within 90 Days ==========[2010/09/23 11:15:00 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\Symantec NetDetect.job[2010/09/23 11:07:33 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Josh Wicoff\My Documents\OTL.exe[2010/09/23 11:01:01 | 000,000,246 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job[2010/09/23 11:00:10 | 065,173,360 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm[2010/09/23 10:57:07 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn[2010/09/23 10:56:17 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2010/09/23 10:55:05 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2010/09/23 10:54:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2010/09/23 10:53:56 | 1206,439,936 | -HS- | M] () -- C:\hiberfil.sys[2010/09/22 22:41:28 | 007,340,032 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\ntuser.dat[2010/09/22 22:41:28 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Josh Wicoff\ntuser.ini[2010/09/22 21:05:57 | 000,000,046 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\jagex_runescape_preferences.dat[2010/09/22 20:55:32 | 000,000,099 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\jagex_runescape_preferences2.dat[2010/09/22 17:18:30 | 004,807,552 | -H-- | M] () -- C:\Documents and Settings\Josh Wicoff\Local Settings\Application Data\IconCache.db[2010/09/11 16:20:53 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\Desktop\iTunes.lnk[2010/09/10 21:18:33 | 000,381,794 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2010/09/10 21:18:32 | 000,440,822 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI[2010/09/10 21:18:32 | 000,053,684 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[2010/09/10 21:16:50 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat[2010/09/10 18:29:16 | 000,262,378 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts[2010/09/07 15:32:24 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk[2010/09/07 15:30:10 | 000,274,168 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2010/09/07 09:38:43 | 000,262,378 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100910-182916.backup[2010/09/06 13:54:23 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\jagex__preferences3.dat[2010/08/29 13:38:00 | 000,000,655 | ---- | M] () -- C:\WINDOWS\win.ini[2010/08/07 13:06:56 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll[2010/08/07 13:06:56 | 000,001,507 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk[2010/08/07 13:06:53 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys[2010/08/07 13:06:40 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys[2010/08/07 13:06:39 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys[2010/08/07 13:06:37 | 000,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm[2010/08/03 12:07:38 | 000,123,392 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2010/08/03 11:17:53 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FlipShare.lnk[2010/08/01 00:32:16 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll.prepare[2010/07/09 20:40:40 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\Josh Wicoff\Desktop\CCleaner.lnk[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files Created - No Company Name ==========[2010/09/06 13:54:23 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\jagex__preferences3.dat[2010/09/06 13:54:19 | 000,000,099 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\jagex_runescape_preferences2.dat[2010/09/06 13:51:52 | 000,000,046 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\jagex_runescape_preferences.dat[2010/09/01 16:27:59 | 007,340,032 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\ntuser.dat[2010/08/07 13:06:56 | 000,001,507 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk[2010/08/07 13:06:37 | 000,113,461 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm[2010/08/07 13:06:23 | 065,173,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm[2010/07/12 01:45:03 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat[2010/07/09 20:40:39 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\Desktop\CCleaner.lnk[2010/07/06 18:52:07 | 000,000,246 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job[2010/05/02 13:14:27 | 000,002,247 | ---- | C] () -- C:\WINDOWS\tabled32.ini[2008/12/14 12:16:05 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll[2008/08/16 01:02:39 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll[2006/09/19 16:33:52 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll[2006/09/03 17:02:45 | 000,004,971 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache[2006/08/14 12:55:56 | 000,000,450 | ---- | C] () -- C:\WINDOWS\SIERRA.INI[2006/08/12 12:35:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\gstar.INI[2006/08/04 23:05:00 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini[2006/06/07 10:02:32 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A5W.INI[2006/05/18 18:24:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSDraw.ini[2006/05/04 16:14:03 | 000,000,010 | ---- | C] () -- C:\WINDOWS\msoffice.ini[2006/02/28 14:00:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\muveeapp.INI[2006/01/08 12:02:58 | 000,003,120 | ---- | C] () -- C:\WINDOWS\System32\2d2ca2ce-704a-428c-8cbe-0736b29190aa.dll[2006/01/05 16:47:25 | 000,008,820 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\Application Data\wklnhst.dat[2005/12/29 06:02:17 | 000,000,022 | ---- | C] () -- C:\WINDOWS\blackops.ini[2005/12/28 17:29:04 | 000,123,392 | ---- | C] () -- C:\Documents and Settings\Josh Wicoff\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2005/04/29 22:30:44 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll[2005/04/29 22:30:44 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll[2005/04/29 22:30:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll[2005/04/29 22:30:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll[2005/04/29 22:30:44 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll[2005/04/29 22:30:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll[2005/04/29 22:17:21 | 000,015,669 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini[2005/02/12 01:33:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini[2004/08/07 06:16:44 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2004/08/07 06:10:08 | 000,000,895 | ---- | C] () -- C:\WINDOWS\orun32.ini[2004/08/04 01:00:00 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll[2004/08/04 01:00:00 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll[2004/08/04 01:00:00 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll[2004/08/04 01:00:00 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll[2004/08/04 01:00:00 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll========== LOP Check ==========[2010/08/07 13:02:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9[2010/06/21 11:22:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Flip Video[2008/04/29 19:58:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MediaWidget[2005/04/29 22:47:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies[2007/06/30 22:23:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound[2009/03/21 04:24:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap Games[2007/01/14 19:12:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint[2009/09/02 20:31:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\winLAME[2006/08/04 23:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\acccore[2006/09/19 18:36:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Aim[2010/07/14 17:02:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Audacity[2008/04/29 20:58:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\BSD[2008/06/11 12:39:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Conference Composer[2010/07/06 19:18:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\FrostWire[2006/06/07 00:28:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\IMSI[2008/08/15 14:28:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\ImTOO Software Studio[2005/12/28 14:13:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\InterVideo[2006/03/01 15:04:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Leadertech[2006/02/28 14:00:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\muvee Technologies[2007/08/19 08:29:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\NCH Swift Sound[2009/03/20 13:35:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\OpenOffice.org[2007/06/30 22:22:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\RecordPad[2006/04/25 10:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Template[2010/07/06 20:09:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Toolbar4[2007/01/14 19:12:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Viewpoint[2010/07/06 20:13:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\Xilisoft[2010/07/06 20:26:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Josh Wicoff\Application Data\xVideoServiceThief[2010/09/23 11:01:01 | 000,000,246 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job========== Purity Check ==========< End of report >OTL Extras logfile created on: 9/23/2010 11:11:27 AM - Run 1OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Josh Wicoff\My DocumentsWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File freePaging file location(s): C:\pagefile.sys 0 0 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 37.25 Gb Total Space | 13.72 Gb Free Space | 36.83% Space Free | Partition Type: NTFSD: Drive not present or media not loadedE: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: JWICOFFCurrent User Name: Josh WicoffLogged in as Administrator.Current Boot Mode: NormalScan Mode: All usersCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 90 DaysOutput = StandardQuick Scan========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*htmlfile [edit] -- Reg Error: Key error.piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirstRunDisabled" = 1"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]========== System Restore Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]"Start" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]"Start" = 2========== Firewall Settings ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DoNotAllowExceptions" = 0"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"C:\Program Files\America Online 9.0a\waol.exe" = C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:America Online 9.0a -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL -- File not found"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0 -- File not found"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -- File not found[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Program Files\America Online 9.0a\waol.exe" = C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:America Online 9.0a -- File not found"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Disabled:LimeWire swarmed installer -- File not found"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Disabled:Earthlink -- File not found"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire -- File not found"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)"C:\WINDOWS\system32\dxdiag.exe" = C:\WINDOWS\system32\dxdiag.exe:*:Enabled:Microsoft DirectX Diagnostic Tool -- (Microsoft Corporation)"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL -- File not found"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe" = C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe:*:Enabled:AOLTsMon -- File not found"C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe" = C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe:*:Enabled:AOLTopSpeed -- File not found"C:\Program Files\Common Files\AOL\1136853302\ee\AOLServiceHost.exe" = C:\Program Files\Common Files\AOL\1136853302\ee\AOLServiceHost.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\System Information\sinf.exe" = C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe" = C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\AOL Spyware Protection\asp.exe" = C:\Program Files\Common Files\AOL\AOL Spyware Protection\asp.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe" = C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\1136853302\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1136853302\ee\aolsoftware.exe:*:Enabled:AOL Services -- File not found"C:\Program Files\Common Files\AOL\1136853302\ee\aim6.exe" = C:\Program Files\Common Files\AOL\1136853302\ee\aim6.exe:*:Enabled:AIM -- File not found"C:\Program Files\Yahoo!\Messenger\YPager.exe" = C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger -- ()"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)"C:\Program Files\Common Files\AOL\1158709450\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1158709450\ee\aolsoftware.exe:*:Enabled:AOL Services -- File not found"C:\Program Files\Common Files\AOL\1158709450\ee\aim6.exe" = C:\Program Files\Common Files\AOL\1158709450\ee\aim6.exe:*:Enabled:AIM -- File not found"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- File not found"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0 -- File not found"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -- File not found"C:\Documents and Settings\Josh Wicoff\My Documents\LimeWire\LimeWire.exe" = C:\Documents and Settings\Josh Wicoff\My Documents\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- File not found"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)"C:\Documents and Settings\Josh Wicoff\My Documents\My eBooks\Uninst.isu\BH2Game\BH2.exe" = C:\Documents and Settings\Josh Wicoff\My Documents\My eBooks\Uninst.isu\BH2Game\BH2.exe:*:Disabled:BH2 -- File not found"C:\Program Files\Infogrames Interactive\Beach Head 2002\BH2Game\BH2.exe" = C:\Program Files\Infogrames Interactive\Beach Head 2002\BH2Game\BH2.exe:*:Disabled:BH2 -- ()"C:\Program Files\Uninst.isu\BH2Game\BH2.exe" = C:\Program Files\Uninst.isu\BH2Game\BH2.exe:*:Disabled:BH2 -- File not found"C:\Program Files\World of Warcraft\Launcher.exe" = C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- File not found"C:\Program Files\World of Warcraft\BackgroundDownloader.exe" = C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader -- File not found"C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- File not found"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire -- (FrostWire Group)"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0451FD8E-D80E-4BA6-AE02-EBE80A059CB0}" = Sibelius Scorch (ActiveX Only)"{06ECCCF4-9295-468E-851C-9529A7C181E8}" = HP User Guides 0001"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel"{15D91706-6ADF-44CF-9D7D-FF2D8ACD2C6F}" = LS_HSI"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus"{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}" = Windows Live Sign-in Assistant"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java 6 Update 21"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager"{30C2FCD0-FF7B-4FFA-8DDE-43A22E01A1E7}" = Rhapsody Player Engine"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java SE Runtime Environment 6 Update 1"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 1.01 A2"{44734179-8A79-4DEE-BB08-73037F065543}" = Apple Mobile Device Support"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{52A5F706-2FCC-4C14-9E9A-345C2DCB25E9}" = D-Link AirPlus Xtreme G Adapter"{534AA552-E1F1-4965-B2AA-FBDEB0730D60}" = muvee autoProducer 4.0 - SE"{612DC38A-B36A-4699-88EB-12C7394DE2FC}" = TIxx21"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler"{80FD852F-5AAC-4129-B931-06AAFFA43138}" = iTunes"{8338BA06-E527-491B-9400-F51708FEE695}" = iPod for Windows 2005-11-17"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD"{98177940-C048-4831-A279-F3888B1E2C7F}" = InstallMgr"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender"{A8AC89BA-D8CB-4372-9743-1C54D23286B0}" = MSN Toolbar"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy"{B6EF6DCE-078E-4952-A7FA-352A9C349EB0}" = MSN Toolbar"{B7148D71-0A8F-4501-96B4-4E1CC67F874E}" = Microsoft Default Manager"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update"{BFD96B89-B769-4CD6-B11E-E79FFD46F067}" = QuickTime"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 5.10 B2"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin"{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0"{F7F23DFB-31E1-B7EC-7A6D-7668B595ADAE}" = FlipShare"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"All ATI Software" = ATI - Software Uninstall Utility"AOL Toolbar" = AOL Toolbar 2.0"ATI Display Driver" = ATI Display Driver"Audacity 1.3 Beta_is1" = Audacity 1.3.7"AVG9Uninstall" = AVG Free 9.0"Beach Head 2002" = Beach Head 2002"CCleaner" = CCleaner"CNXT_AUDIO" = Conexant AC-Link Audio"CNXT_MODEM_PCI_VEN_1002&DEV_4378&SUBSYS_3091103C" = Data Fax SoftModem with SmartCP"Hoyle Battling Ships and War" = Hoyle Battling Ships and War"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs"ie7" = Windows Internet Explorer 7"ie8" = Windows Internet Explorer 8"InstallShield_{612DC38A-B36A-4699-88EB-12C7394DE2FC}" = Texas Instruments PCIxx21/x515 drivers."InstallShield_{8338BA06-E527-491B-9400-F51708FEE695}" = iPod for Windows 2005-11-17"IrfanView" = IrfanView (remove only)"LAME for Audacity_is1" = LAME v3.98.2 for Audacity"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1"Money2005b" = Microsoft Money 2005"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs"Optio E10 Digital Camera Driver" = Optio E10 Digital Camera Driver"RealPlayer 6.0" = RealPlayer Basic"SBC Yahoo! Applications" = SBC Yahoo! Applications"Sierra Utilities" = Sierra Utilities"SkeetShooting" = Skeet Shooting"StreetPlugin" = Learn2 Player (Uninstall Only)"SynTPDeinstKey" = Synaptics Pointing Device Driver"TablEdit_is1" = TablEdit 2.69"V5385 Digital Camera Driver" = V5385 Digital Camera Driver"ViewpointMediaPlayer" = Viewpoint Media Player"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 10"Windows XP Service Pack" = Windows XP Service Pack 3"WMFDist11" = Windows Media Format 11 runtime"Xilisoft YouTube Toolbar" = Xilisoft YouTube Toolbar"Yahoo! Toolbar" = Yahoo! Toolbar========== Last 10 Event Log Errors ==========[ Application Events ]Error - 9/21/2010 5:43:09 PM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application SpybotSD.exe, version 1.6.0.31, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:02 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:02 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:02 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:05 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:05 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:05 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:05 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:06 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 9/23/2010 12:48:06 AM | Computer Name = JWICOFF | Source = Application Hang | ID = 1002Description = Hanging application avgtray.exe, version 9.0.0.832, hang module hungapp, version 0.0.0.0, hang address 0x00000000.[ System Events ]Error - 9/22/2010 1:03:25 AM | Computer Name = JWICOFF | Source = Service Control Manager | ID = 7026Description = The following boot-start or system-start driver(s) failed to load: AliIde IntelIde ViaIdeError - 9/22/2010 2:43:56 AM | Computer Name = JWICOFF | Source = Dhcp | ID = 1002Description = The IP address lease 192.168.2.4 for the Network Card with network address 0011957B1A16 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).Error - 9/22/2010 2:48:38 AM | Computer Name = JWICOFF | Source = Dhcp | ID = 1001Description = Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0011957B1A16. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.Error - 9/22/2010 11:14:57 AM | Computer Name = JWICOFF | Source = Dhcp | ID = 1002Description = The IP address lease 192.168.2.4 for the Network Card with network address 0011957B1A16 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).Error - 9/22/2010 8:22:31 PM | Computer Name = JWICOFF | Source = Server | ID = 2505Description = The server could not bind to the transport \Device\NetBT_Tcpip_{B3694490-580A-4281-979E-16F8C4114893} because another computer on the network has the same name. The server could not start.Error - 9/22/2010 8:27:01 PM | Computer Name = JWICOFF | Source = Dhcp | ID = 1002Description = The IP address lease 192.168.2.4 for the Network Card with network address 0011957B1A16 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).Error - 9/22/2010 8:28:15 PM | Computer Name = JWICOFF | Source = Server | ID = 2505Description = The server could not bind to the transport \Device\NetBT_Tcpip_{B3694490-580A-4281-979E-16F8C4114893} because another computer on the network has the same name. The server could not start.Error - 9/22/2010 8:29:00 PM | Computer Name = JWICOFF | Source = Dhcp | ID = 1001Description = Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0011957B1A16. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.Error - 9/23/2010 1:42:47 AM | Computer Name = JWICOFF | Source = Dhcp | ID = 1002Description = The IP address lease 192.168.2.4 for the Network Card with network address 0011957B1A16 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).Error - 9/23/2010 1:54:38 PM | Computer Name = JWICOFF | Source = Dhcp | ID = 1002Description = The IP address lease 192.168.2.4 for the Network Card with network address 0011957B1A16 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).< End of report >RkU Version: 3.8.388.590, Type LE (SR2)==============================================OS Name: Windows XPVersion 5.1.2600 (Service Pack 3)Number of processors #1==============================================>Drivers==============================================0xBF0B2000 C:\WINDOWS\System32\ati3duag.dll 2297856 bytes (ATI Technologies Inc. , ati3duag.dll)0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2066816 bytes (Microsoft Corporation, NT Kernel & System)0x804D7000 PnpManager 2066816 bytes0x804D7000 RAW 2066816 bytes0x804D7000 WMIxWDM 2066816 bytes0xBF800000 Win32k 1855488 bytes0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)0xF6C73000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 1073152 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)0xF69C9000 C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 1040384 bytes (Conexant Systems, Inc., HSF_DP driver)0xF691D000 C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 704512 bytes (Conexant Systems, Inc., HSF_CNXT driver)0xBF2E3000 C:\WINDOWS\System32\ativvaxx.dll 610304 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)0xF73A5000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)0xEDE52000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)0xF6B72000 C:\WINDOWS\system32\DRIVERS\ar5211.sys 409600 bytes (D-Link , D-Link Wireless Network Adapter)0xF67F7000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)0xEE037000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)0xB7E19000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)0xF6B1C000 C:\WINDOWS\system32\drivers\camc6hal.sys 352256 bytes (Conexant Systems Inc., Conexant AmcHal Driver)0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)0xB7798000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 245760 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)0xEDFFD000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)0xEDE1E000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)0xBF04E000 C:\WINDOWS\System32\ati2cqag.dll 204800 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)0xBF080000 C:\WINDOWS\System32\atikvmag.dll 204800 bytes (ATI Technologies Inc., Virtual Command And Memory Manager)0xF6AC7000 C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys 200704 bytes (Conexant Systems, Inc., HSFHWATI WDM driver)0xF6BE9000 C:\WINDOWS\system32\DRIVERS\SynTP.sys 192512 bytes (Synaptics, Inc., Synaptics Touchpad Driver)0xF74E1000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)0xB8028000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)0xF7378000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)0xB71A2000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)0xEDEC2000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)0xEDF0F000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)0xEDFD7000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)0xF6AF8000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))0xF6C3B000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)0xF6C18000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)0xEDEED000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)0x806D0000 ACPI_HAL 131840 bytes0x806D0000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)0xF745B000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)0xF7493000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)0xF74B2000 pcmcia.sys 122880 bytes (Microsoft Corporation, PCMCIA Bus Driver)0xF735E000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)0xF747B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)0xEDAAD000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes0xF7432000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)0xF6906000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))0xB8263000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)0xF6C5F000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)0xEE090000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)0xF6BD6000 C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys 77824 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver )0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)0xF7449000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)0xF74D0000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)0xF68F5000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)0xF68A5000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)0xF7790000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)0xF7620000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)0xF7680000 serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)0xF7770000 C:\WINDOWS\system32\DRIVERS\AmdK8.sys 61440 bytes (Advanced Micro Devices, AMD Processor Driver)0xF77D0000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)0xF77A0000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)0xB8360000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)0xF7860000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)0xF7630000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)0xF7670000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)0xF77B0000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)0xF77E0000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)0xF7650000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)0xF7800000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)0xF7720000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)0xF7780000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)0xF7640000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)0xF77F0000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)0xF77C0000 C:\WINDOWS\system32\drivers\camc6aud.sys 40960 bytes (Conexant Systems Inc., Conexant WDM AC97 Audio Driver)0xF7610000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)0xF7830000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)0xF7820000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)0xF7660000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)0xF76F0000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)0xF7810000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)0xF7700000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)0xB71ED000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)0xF76E0000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)0xF7918000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)0xF7958000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)0xF78F8000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)0xF7900000 C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CD/DVD Class Filter Driver)0xF7960000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)0xF7890000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)0xF7968000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)0xF7908000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)0xF7910000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)0xF7948000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)0xF7950000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)0xF7898000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)0xF7928000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)0xF78A0000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)0xF7930000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)0xF7920000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)0xF78F0000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)0xF79B0000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)0xF7A28000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver)0xF7AC8000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)0xB859C000 C:\WINDOWS\system32\DRIVERS\mdc8021x.sys 16384 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)0xF7B04000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)0xB84E4000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)0xF7A2C000 ACPIEC.sys 12288 bytes (Microsoft Corporation, ACPI Embedded Controller Driver)0xF7A20000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)0xF7A24000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)0xEDAE9000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)0xF7AB8000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)0xB7F40000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)0xF7AC4000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)0xF7AF0000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)0xF7305000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)0xF7AEC000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI)0xF7B18000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver)0xF7BC8000 C:\WINDOWS\System32\Drivers\ASCTRM.SYS 8192 bytes (Windows ® 2000 DDK provider, TR Manager)0xF7B38000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)0xF7B80000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes0xF7B40000 C:\WINDOWS\system32\drivers\EABFiltr.sys 8192 bytes (Hewlett-Packard Company, QLB PS/2 Keyboard filter driver)0xF7B36000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)0xF7B14000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)0xF7B10000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)0xF7B3A000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)0xF7B3C000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)0xF7B2A000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)0xF7B28000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)0xF7B16000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)0xF7B12000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)0xF7CF9000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)0xF7D04000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)0xF7D58000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)0xF7BD9000 C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 4096 bytes (Microsoft Corporation, ACPI Operation Registration Driver)0xF7BD8000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)==============================================>Stealth==============================================WARNING: Virus alike driver modification [bthpan.sys]WARNING: Virus alike driver modification [compbatt.sys]WARNING: Virus alike driver modification [sffp_mmc.sys]WARNING: Virus alike driver modification [hsfdpsp2.sys]WARNING: Virus alike driver modification [atinrvxx.sys]WARNING: Virus alike driver modification [mup.sys]WARNING: Virus alike driver modification [sffp_sd.sys]WARNING: Virus alike driver modification [irenum.sys]WARNING: Virus alike driver modification [wadv08nt.sys]WARNING: Virus alike driver modification [ati1mdxx.sys]WARNING: Virus alike driver modification [acpiec.sys]WARNING: Virus alike driver modification [cpqdap01.sys]WARNING: Virus alike driver modification [wadv07nt.sys]WARNING: Virus alike driver modification [wadv09nt.sys]WARNING: Virus alike driver modification [sffdisk.sys]WARNING: Virus alike driver modification [wadv11nt.sys]WARNING: Virus alike driver modification [pcmcia.sys]WARNING: Virus alike driver modification [nikedrv.sys]WARNING: Virus alike driver modification [rio8drv.sys]WARNING: Virus alike driver modification [riodrv.sys]WARNING: Virus alike driver modification [ws2ifsl.sys]WARNING: Virus alike driver modification [tdpipe.sys]WARNING: Virus alike driver modification [ati1pdxx.sys]WARNING: Virus alike driver modification [fsvga.sys]WARNING: Virus alike driver modification [usbvideo.sys]WARNING: Virus alike driver modification [tunmp.sys]WARNING: Virus alike driver modification [nwlnkflt.sys]WARNING: Virus alike driver modification [ftdisk.sys]WARNING: Virus alike driver modification [mtlmnt5.sys]WARNING: Virus alike driver modification [mutohpen.sys]WARNING: Virus alike driver modification [usb8023.sys]WARNING: Virus alike driver modification [usb8023x.sys]WARNING: Virus alike driver modification [slnt7554.sys]WARNING: Virus alike driver modification [fltmgr.sys]WARNING: Virus alike driver modification [mtlstrm.sys]WARNING: Virus alike driver modification [slwdmsup.sys]WARNING: Virus alike driver modification [recagent.sys]WARNING: Virus alike driver modification [atinmdxx.sys]WARNING: Virus alike driver modification [atinttxx.sys]WARNING: Virus alike driver modification [cbidf2k.sys]WARNING: Virus alike driver modification [rdpwd.sys]WARNING: Virus alike driver modification [battc.sys]WARNING: Virus alike driver modification [diskdump.sys]WARNING: Virus alike driver modification [wacompen.sys]WARNING: Virus alike driver modification [asyncmac.sys]WARNING: Virus alike driver modification [atinpdxx.sys]WARNING: Virus alike driver modification [hdaudbus.sys]WARNING: Virus alike driver modification [smclib.sys]WARNING: Virus alike driver modification [tape.sys]WARNING: Virus alike driver modification [dmio.sys]WARNING: Virus alike driver modification [serenum.sys]WARNING: Virus alike driver modification [usbintel.sys]WARNING: Virus alike driver modification [tifm21.sys]WARNING: Virus alike driver modification [s3gnbm.sys]WARNING: Virus alike driver modification [bthenum.sys]WARNING: Virus alike driver modification [ntmtlfax.sys]WARNING: Virus alike driver modification [ndis.sys]WARNING: Virus alike driver modification [acpi.sys]WARNING: Virus alike driver modification [bthusb.sys]WARNING: Virus alike driver modification [nv4_mini.sys]WARNING: Virus alike driver modification [hidir.sys]WARNING: Virus alike driver modification [rasirda.sys]WARNING: Virus alike driver modification [rdpdr.sys]WARNING: Virus alike driver modification [partmgr.sys]WARNING: Virus alike driver modification [rmcast.sys]WARNING: Virus alike driver modification [flpydisk.sys]WARNING: Virus alike driver modification [secdrv.sys]WARNING: Virus alike driver modification [pxhelp20.sys]WARNING: Virus alike driver modification [usbuhci.sys]WARNING: Virus alike driver modification [ipinip.sys]WARNING: Virus alike driver modification [ati1ttxx.sys]WARNING: Virus alike driver modification [tsbvcap.sys]WARNING: Virus alike driver modification [tdtcp.sys]WARNING: Virus alike driver modification [hsfbs2s2.sys]WARNING: Virus alike driver modification [watv06nt.sys]WARNING: Virus alike driver modification [pciidex.sys]WARNING: Virus alike driver modification [sonydcam.sys]WARNING: Virus alike driver modification [watv10nt.sys]WARNING: Virus alike driver modification [hidbth.sys]WARNING: Virus alike driver modification [usbcamd.sys]WARNING: Virus alike driver modification [usbcamd2.sys]WARNING: Virus alike driver modification [usbprint.sys]WARNING: Virus alike driver modification [cinemst2.sys]WARNING: Virus alike driver modification [ati1snxx.sys]WARNING: Virus alike driver modification [bthport.sys]WARNING: Virus alike driver modification [fdc.sys]WARNING: Virus alike driver modification [atinsnxx.sys]WARNING: Virus alike driver modification [ati1xbxx.sys]WARNING: Virus alike driver modification [usbaapl.sys]WARNING: Virus alike driver modification [rndismp.sys]WARNING: Virus alike driver modification [rndismpx.sys]WARNING: Virus alike driver modification [ati1raxx.sys]WARNING: Virus alike driver modification [atmepvc.sys]WARNING: Virus alike driver modification [atinxbxx.sys]WARNING: Virus alike driver modification [usbccgp.sys]WARNING: Virus alike driver modification [nwlnkfwd.sys]WARNING: Virus alike driver modification [ati2mtaa.sys]WARNING: Virus alike driver modification [ipfltdrv.sys]WARNING: Virus alike driver modification [rawwan.sys]WARNING: Virus alike driver modification [ati1xsxx.sys]WARNING: Virus alike driver modification [atmuni.sys]WARNING: Virus alike driver modification [smcirda.sys]WARNING: Virus alike driver modification [disk.sys]WARNING: Virus alike driver modification [intelppm.sys]WARNING: Virus alike driver modification [ati1tuxx.sys]WARNING: Virus alike driver modification [bthprint.sys]WARNING: Virus alike driver modification [ip6fw.sys]WARNING: Virus alike driver modification [crusoe.sys]WARNING: Virus alike driver modification [bCMWL5.SYS]WARNING: Virus alike driver modification [isapnp.sys]WARNING: Virus alike driver modification [amdk6.sys]WARNING: Virus alike driver modification [amdk7.sys]WARNING: Virus alike driver modification [bthmodem.sys]WARNING: Virus alike driver modification [stMp3Rec.sys]WARNING: Virus alike driver modification [nmnt.sys]WARNING: Virus alike driver modification [slntamr.sys]WARNING: Virus alike driver modification [ar5211.sys]WARNING: Virus alike driver modification [ar52119x.sys]WARNING: Virus alike driver modification [sisagp.sys]WARNING: Virus alike driver modification [viaagp.sys]WARNING: Virus alike driver modification [agp440.sys]WARNING: Virus alike driver modification [mountmgr.sys]WARNING: Virus alike driver modification [alim1541.sys]WARNING: Virus alike driver modification [p3.sys]WARNING: Virus alike driver modification [amdagp.sys]WARNING: Virus alike driver modification [ser2pl.sys]WARNING: Virus alike driver modification [CoachVc.sys]WARNING: Virus alike driver modification [uagp35.sys]WARNING: Virus alike driver modification [agpcpq.sys]WARNING: Virus alike driver modification [mtxparhm.sys]WARNING: Virus alike driver modification [gagp30kx.sys]WARNING: Virus alike driver modification [stream.sys]WARNING: Virus alike driver modification [classpnp.sys]WARNING: Virus alike driver modification [mspqm.sys]WARNING: Virus alike driver modification [CoachUsb.sys]WARNING: Virus alike driver modification [tosdvd.sys]WARNING: Virus alike driver modification [EabUsb.sys]WARNING: Virus alike driver modification [atinraxx.sys]WARNING: Virus alike driver modification [volsnap.sys]WARNING: Virus alike driver modification [aliide.sys]WARNING: Virus alike driver modification [1394bus.sys]WARNING: Virus alike driver modification [mspclock.sys]WARNING: Virus alike driver modification [viaide.sys]WARNING: Virus alike driver modification [intelide.sys]WARNING: Virus alike driver modification [btwusb.sys]WARNING: Virus alike driver modification [atmlane.sys]WARNING: Virus alike driver modification [nwlnkspx.sys]WARNING: Virus alike driver modification [ati1btxx.sys]WARNING: Virus alike driver modification [ntfs.sys]WARNING: Virus alike driver modification [atinbtxx.sys]WARNING: Virus alike driver modification [vdmindvd.sys]WARNING: Virus alike driver modification [dmload.sys]WARNING: Virus alike driver modification [rootmdm.sys]WARNING: Virus alike driver modification [smbali.sys]WARNING: Virus alike driver modification [rfcomm.sys]WARNING: Virus alike driver modification [atmarpc.sys]WARNING: Virus alike driver modification [arp1394.sys]WARNING: Virus alike driver modification [ohci1394.sys]WARNING: Virus alike driver modification [nic1394.sys]WARNING: Virus alike driver modification [nwlnknb.sys]WARNING: Virus alike driver modification [atinxsxx.sys]WARNING: Virus alike driver modification [ati1rvxx.sys]WARNING: Virus alike driver modification [mf.sys]WARNING: Virus alike driver modification [enum1394.sys]WARNING: Virus alike driver modification [serial.sys]WARNING: Virus alike driver modification [udfs.sys]WARNING: Virus alike driver modification [parvdm.sys]WARNING: Virus alike driver modification [pci.sys]WARNING: Virus alike driver modification [hsfcxts2.sys]WARNING: Virus alike driver modification [bridge.sys]WARNING: Virus alike driver modification [atintuxx.sys]WARNING: Virus alike driver modification [sr.sys]WARNING: Virus alike driver modification [mskssrv.sys]WARNING: Virus alike driver modification [sONYPVU1.SYS]WARNING: Virus alike driver modification [mcd.sys]WARNING: Virus alike driver modification [sdbus.sys]WARNING: Virus alike driver modification [dmboot.sys]WARNING: Virus alike driver modification [parport.sys]WARNING: Virus alike driver modification [irda.sys]WARNING: Virus alike driver modification [nwlnkipx.sys]WARNING: Virus alike driver modification [slnthal.sys]WARNING: Virus alike driver modification [scsiport.sys] Link to post Share on other sites More sharing options...
Elise Posted September 23, 2010 ID:317545 Share Posted September 23, 2010 Hello again,Please download DeFogger to your desktop.Double click DeFogger to run the tool. The application window will appear Click the Disable button to disable your CD Emulation drivers Click Yes to continue A 'Finished!' message will appear Click OK DeFogger will now ask to reboot the machine - click OKIMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.Do not re-enable these drivers until otherwise instructed.COMBOFIX---------------Please download ComboFix from one of these locations:BleepingcomputerForoSpywareDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)Double click on Combofix.exe and follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Link to post Share on other sites More sharing options...
jacksonv Posted September 23, 2010 Author ID:317584 Share Posted September 23, 2010 Hi, I did the Defogger steps except it never asked me to reboot. What should I do? Link to post Share on other sites More sharing options...
Elise Posted September 23, 2010 ID:317605 Share Posted September 23, 2010 Just continue with combofix. Link to post Share on other sites More sharing options...
jacksonv Posted September 23, 2010 Author ID:317618 Share Posted September 23, 2010 Just as an example, right now when I clicked "add reply" it went to the right site but a new windown opened up with the website called wordslife. ComboFix 10-09-23.01 - Josh Wicoff 09/23/2010 13:11:19.1.1 - x86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1150.615 [GMT -7:00]Running from: c:\documents and settings\Josh Wicoff\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\Josh Wicoff\Application Data\Microsoft\~DFK3af531c9.tmpc:\documents and settings\Josh Wicoff\Application Data\Microsoft\1eaadjc.dllc:\documents and settings\Josh Wicoff\Application Data\Microsoft\bass.dllc:\documents and settings\Josh Wicoff\Application Data\Microsoft\kfgresk.dllc:\documents and settings\Josh Wicoff\Application Data\Microsoft\mjcriu.dllc:\documents and settings\Josh Wicoff\Application Data\Microsoft\peaadje.dllc:\documents and settings\Josh Wicoff\Application Data\Microsoft\qwadjb.dllc:\documents and settings\Josh Wicoff\Application Data\Microsoft\rsaadjd.dllc:\program files\Commonc:\program files\Xilisoft YouTube Toolbar\tbHElper.dllc:\windows\f96ac0e5-19d2-42c5-8f68-eb7a99861769.ocxc:\windows\system32\2d2ca2ce-704a-428c-8cbe-0736b29190aa.dll.((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 ))))))))))))))))))))))))))))))).2010-09-23 18:02 . 2010-09-23 18:02 620896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgnsx.exe2010-09-23 18:02 . 2010-09-23 18:02 4093792 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe2010-09-23 18:02 . 2010-09-23 18:02 3586912 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe2010-09-23 18:02 . 2010-09-23 18:02 1619296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll2010-09-23 18:02 . 2010-09-23 18:02 942432 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcfgx.dll2010-09-23 18:02 . 2010-09-23 18:02 598368 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgsrmx.dll2010-09-23 18:02 . 2010-09-23 18:02 4371296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll2010-09-23 18:02 . 2010-09-23 18:02 300896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchclx.dll2010-09-23 18:01 . 2010-09-23 18:01 1690952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll2010-09-23 00:39 . 2010-09-23 02:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-09-22 22:09 . 2010-05-21 21:14 221568 ------w- c:\windows\system32\MpSigStub.exe2010-09-18 19:03 . 2010-09-23 00:40 -------- d-----w- c:\documents and settings\Josh Wicoff\Application Data\Malwarebytes2010-09-18 19:03 . 2010-09-23 00:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2010-09-07 22:10 . 2010-06-18 11:39 16896 ------w- c:\windows\system32\dllcache\iecompat.dll2010-09-07 22:09 . 2010-09-07 22:09 -------- d-----w- c:\windows\ie8updates2010-09-07 22:09 . 2010-06-24 12:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll2010-09-07 22:09 . 2010-06-24 12:21 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll2010-09-07 22:09 . 2010-06-24 12:21 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll2010-09-07 21:51 . 2010-09-07 21:51 503808 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-786cd72f-n\msvcp71.dll2010-09-07 21:51 . 2010-09-07 21:51 499712 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-786cd72f-n\jmc.dll2010-09-07 21:51 . 2010-09-07 21:51 348160 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-786cd72f-n\msvcr71.dll2010-09-07 21:51 . 2010-09-07 21:51 61440 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5b2c5e8b-n\decora-sse.dll2010-09-07 21:51 . 2010-09-07 21:51 12800 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5b2c5e8b-n\decora-d3d.dll2010-09-07 21:50 . 2010-07-17 12:00 423656 ----a-w- c:\windows\system32\deployJava1.dll2010-09-07 21:41 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll2010-09-07 21:40 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe2010-09-07 21:35 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe2010-09-07 21:19 . 2010-09-07 21:19 -------- d-----w- c:\windows\system32\wbem\Repository2010-09-07 21:03 . 2010-09-07 21:03 -------- d-sh--w- c:\documents and settings\Josh Wicoff\PrivacIE2010-09-07 21:02 . 2010-09-07 21:02 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache2010-09-07 21:01 . 2010-09-07 21:01 -------- d-sh--w- c:\documents and settings\Josh Wicoff\IETldCache2010-09-07 20:53 . 2010-09-07 22:08 -------- dc-h--w- c:\windows\ie82010-09-06 20:54 . 2010-09-06 20:54 0 ----a-w- c:\documents and settings\Josh Wicoff\jagex__preferences3.dat2010-09-06 20:54 . 2010-09-23 03:55 99 ----a-w- c:\documents and settings\Josh Wicoff\jagex_runescape_preferences2.dat2010-09-06 20:51 . 2010-09-23 04:05 46 ----a-w- c:\documents and settings\Josh Wicoff\jagex_runescape_preferences.dat.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-09-23 20:15 . 2010-07-07 03:09 -------- d-----w- c:\program files\Xilisoft YouTube Toolbar2010-09-23 04:50 . 2008-06-09 09:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2010-09-22 23:45 . 2006-09-20 01:33 -------- d-----w- c:\program files\AIM2010-09-22 21:13 . 2008-01-29 04:31 -------- d-----w- c:\documents and settings\Josh Wicoff\Application Data\U32010-09-11 22:48 . 2009-03-20 20:41 1 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys2010-09-11 04:16 . 2010-07-12 08:45 664 ----a-w- c:\windows\system32\d3d9caps.dat2010-09-07 21:50 . 2005-04-30 05:08 -------- d-----w- c:\program files\Common Files\Java2010-09-07 21:50 . 2005-04-30 05:08 -------- d-----w- c:\program files\Java2010-08-17 13:17 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\spoolsv.exe2010-08-07 20:06 . 2010-08-07 20:06 12536 ----a-w- c:\windows\system32\avgrsstx.dll2010-08-07 20:06 . 2010-08-07 20:06 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys2010-08-07 20:06 . 2010-08-07 20:06 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys2010-08-07 20:06 . 2010-08-07 20:06 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2010-08-07 20:02 . 2010-03-29 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\avg92010-07-22 15:49 . 2004-08-04 08:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll2010-07-22 05:57 . 2009-12-26 04:34 5120 ----a-w- c:\windows\system32\xpsp4res.dll2010-06-30 12:31 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\schannel.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]2010-02-04 23:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\ypager.exe" [2005-08-15 3092480]"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy 2\TeaTimer.exe" [2008-08-19 1832272][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-12-29 26112]"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2003-12-09 57344]"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-08-07 2065760]c:\documents and settings\All Users\Start Menu\Programs\Startup\ACS.lnk - c:\windows\system32\ACS.BAT [2006-3-15 28]D-Link AirPlus Xtreme G Configuration Utility.lnk - c:\program files\D-Link AirPlus Xtreme G\AirPlus.exe [2006-3-15 544866]D-Link REG Utility.lnk - c:\program files\D-Link AirPlus Xtreme G\Reg.exe [2006-3-15 24576][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2010-08-07 20:06 12536 ----a-w- c:\windows\system32\avgrsstx.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]@=""[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]@="Service"[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\WINDOWS\\system32\\sessmgr.exe"="c:\\WINDOWS\\system32\\dpnsvr.exe"="c:\\WINDOWS\\system32\\dxdiag.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Infogrames Interactive\\Beach Head 2002\\BH2Game\\BH2.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\FrostWire\\FrostWire.exe"="c:\\Program Files\\AVG\\AVG9\\avgemc.exe"="c:\\Program Files\\AVG\\AVG9\\avgupd.exe"="c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/7/2010 1:06 PM 216400]R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/7/2010 1:06 PM 243024]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [8/7/2010 1:04 PM 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [8/7/2010 1:04 PM 308136]R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 200192]S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\JOSHWI~1\LOCALS~1\Temp\DMSKSSRh.sys --> c:\docume~1\JOSHWI~1\LOCALS~1\Temp\DMSKSSRh.sys [?]S3 PentaxUsb;PENTAX Optio E10 on USB;c:\windows\system32\drivers\CoachUsb.sys [9/26/2006 7:08 PM 50976]S3 PentaxVc;PENTAX Optio E10 Video Capture;c:\windows\system32\drivers\CoachVc.sys [9/26/2006 7:08 PM 44256]--- Other Services/Drivers In Memory ---*NewlyCreated* - NORMANDY*Deregistered* - Normandy.Contents of the 'Scheduled Tasks' folder2010-09-23 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 23:50]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = *.localuSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com.- - - - ORPHANS REMOVED - - - -URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)HKCU-Run-ares - c:\program files\Ares\Ares.exeAddRemove-AOL Toolbar - c:\program files\AOL\AOL Toolbar 2.0\uninstall.exe**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-09-23 13:16Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????4?9?0?8??????? ???B?????????????hLC? ?????? scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(572)c:\windows\system32\Ati2evxx.dll.Completion time: 2010-09-23 13:20:07ComboFix-quarantined-files.txt 2010-09-23 20:20Pre-Run: 14,616,600,576 bytes freePost-Run: 14,652,035,072 bytes freeWindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsUnsupportedDebug="do not select this" /debugmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetectCurrent=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4- - End Of File - - 679AA1642F520ABF7B76CE26779A73B3 Link to post Share on other sites More sharing options...
Elise Posted September 23, 2010 ID:317624 Share Posted September 23, 2010 If MBAM isn't installed at the moment, please reinstall it and let me know if it can be updated now. If not, make sure you downloaded the latest installer, install it, and run a quick scan. Post me the resulting log. Link to post Share on other sites More sharing options...
jacksonv Posted September 23, 2010 Author ID:317626 Share Posted September 23, 2010 Sorry, I'm not sure if I am suppose to post again. But I got redirected to this site hxxp://://98.232.72.138:11066/index.html?u=141&t=1 and it said something like "your computer is under the attack of a virus and needs to be scanned" and then it went about doing a fake scan on that webpage. Not sure if this is useful information to you, if not I apologize for this second post! Link to post Share on other sites More sharing options...
Elise Posted September 23, 2010 ID:317631 Share Posted September 23, 2010 Yes, that is indeed useful information. However, could you please disable your link ASAP (or delete it altogether) so people who are watching this threat cannot inadvertently click on it?Please attempt to run MBAM and rerun a scan with combofix. Post me both logs. Link to post Share on other sites More sharing options...
jacksonv Posted September 23, 2010 Author ID:317636 Share Posted September 23, 2010 Very sorry! I could not find out how to edit or delete.I installed Malewarebytes and got the same error while trying to update. Here is the log to the quick scan, not sure if you wanted it since I could not update.Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4052Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187029/23/2010 1:53:08 PMmbam-log-2010-09-23 (13-53-08).txtScan type: Quick scanObjects scanned: 122023Time elapsed: 7 minute(s), 32 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)ComboFix 10-09-23.01 - Josh Wicoff 09/23/2010 13:56:15.2.1 - x86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1150.562 [GMT -7:00]Running from: c:\documents and settings\Josh Wicoff\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}.((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 ))))))))))))))))))))))))))))))).2010-09-23 20:44 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-09-23 20:44 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-09-23 18:02 . 2010-09-23 18:02 620896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgnsx.exe2010-09-23 18:02 . 2010-09-23 18:02 4093792 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe2010-09-23 18:02 . 2010-09-23 18:02 3586912 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe2010-09-23 18:02 . 2010-09-23 18:02 1619296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll2010-09-23 18:02 . 2010-09-23 18:02 942432 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcfgx.dll2010-09-23 18:02 . 2010-09-23 18:02 598368 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgsrmx.dll2010-09-23 18:02 . 2010-09-23 18:02 4371296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll2010-09-23 18:02 . 2010-09-23 18:02 300896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchclx.dll2010-09-23 18:01 . 2010-09-23 18:01 1690952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll2010-09-23 00:39 . 2010-09-23 20:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-09-22 22:09 . 2010-05-21 21:14 221568 ------w- c:\windows\system32\MpSigStub.exe2010-09-18 19:03 . 2010-09-23 00:40 -------- d-----w- c:\documents and settings\Josh Wicoff\Application Data\Malwarebytes2010-09-18 19:03 . 2010-09-23 00:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2010-09-07 22:10 . 2010-06-18 11:39 16896 ------w- c:\windows\system32\dllcache\iecompat.dll2010-09-07 22:09 . 2010-09-07 22:09 -------- d-----w- c:\windows\ie8updates2010-09-07 22:09 . 2010-06-24 12:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll2010-09-07 22:09 . 2010-06-24 12:21 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll2010-09-07 22:09 . 2010-06-24 12:21 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll2010-09-07 21:51 . 2010-09-07 21:51 503808 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-786cd72f-n\msvcp71.dll2010-09-07 21:51 . 2010-09-07 21:51 499712 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-786cd72f-n\jmc.dll2010-09-07 21:51 . 2010-09-07 21:51 348160 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-786cd72f-n\msvcr71.dll2010-09-07 21:51 . 2010-09-07 21:51 61440 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5b2c5e8b-n\decora-sse.dll2010-09-07 21:51 . 2010-09-07 21:51 12800 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5b2c5e8b-n\decora-d3d.dll2010-09-07 21:50 . 2010-07-17 12:00 423656 ----a-w- c:\windows\system32\deployJava1.dll2010-09-07 21:41 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll2010-09-07 21:40 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe2010-09-07 21:35 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe2010-09-07 21:19 . 2010-09-07 21:19 -------- d-----w- c:\windows\system32\wbem\Repository2010-09-07 21:03 . 2010-09-07 21:03 -------- d-sh--w- c:\documents and settings\Josh Wicoff\PrivacIE2010-09-07 21:02 . 2010-09-07 21:02 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache2010-09-07 21:01 . 2010-09-07 21:01 -------- d-sh--w- c:\documents and settings\Josh Wicoff\IETldCache2010-09-07 20:53 . 2010-09-07 22:08 -------- dc-h--w- c:\windows\ie82010-09-06 20:54 . 2010-09-06 20:54 0 ----a-w- c:\documents and settings\Josh Wicoff\jagex__preferences3.dat2010-09-06 20:54 . 2010-09-23 03:55 99 ----a-w- c:\documents and settings\Josh Wicoff\jagex_runescape_preferences2.dat2010-09-06 20:51 . 2010-09-23 04:05 46 ----a-w- c:\documents and settings\Josh Wicoff\jagex_runescape_preferences.dat.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-09-23 20:15 . 2010-07-07 03:09 -------- d-----w- c:\program files\Xilisoft YouTube Toolbar2010-09-23 04:50 . 2008-06-09 09:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2010-09-22 23:45 . 2006-09-20 01:33 -------- d-----w- c:\program files\AIM2010-09-22 21:13 . 2008-01-29 04:31 -------- d-----w- c:\documents and settings\Josh Wicoff\Application Data\U32010-09-11 22:48 . 2009-03-20 20:41 1 ----a-w- c:\documents and settings\Josh Wicoff\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys2010-09-11 04:16 . 2010-07-12 08:45 664 ----a-w- c:\windows\system32\d3d9caps.dat2010-09-07 21:50 . 2005-04-30 05:08 -------- d-----w- c:\program files\Common Files\Java2010-09-07 21:50 . 2005-04-30 05:08 -------- d-----w- c:\program files\Java2010-08-17 13:17 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\spoolsv.exe2010-08-07 20:06 . 2010-08-07 20:06 12536 ----a-w- c:\windows\system32\avgrsstx.dll2010-08-07 20:06 . 2010-08-07 20:06 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys2010-08-07 20:06 . 2010-08-07 20:06 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys2010-08-07 20:06 . 2010-08-07 20:06 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2010-08-07 20:02 . 2010-03-29 22:07 -------- d-----w- c:\documents and settings\All Users\Application Data\avg92010-07-22 15:49 . 2004-08-04 08:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll2010-07-22 05:57 . 2009-12-26 04:34 5120 ----a-w- c:\windows\system32\xpsp4res.dll2010-06-30 12:31 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\schannel.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]2010-02-04 23:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\ypager.exe" [2005-08-15 3092480]"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy 2\TeaTimer.exe" [2008-08-19 1832272][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-12-29 26112]"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2003-12-09 57344]"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-08-07 2065760]c:\documents and settings\All Users\Start Menu\Programs\Startup\ACS.lnk - c:\windows\system32\ACS.BAT [2006-3-15 28]D-Link AirPlus Xtreme G Configuration Utility.lnk - c:\program files\D-Link AirPlus Xtreme G\AirPlus.exe [2006-3-15 544866]D-Link REG Utility.lnk - c:\program files\D-Link AirPlus Xtreme G\Reg.exe [2006-3-15 24576][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2010-08-07 20:06 12536 ----a-w- c:\windows\system32\avgrsstx.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]@=""[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]@="Service"[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\WINDOWS\\system32\\sessmgr.exe"="c:\\WINDOWS\\system32\\dpnsvr.exe"="c:\\WINDOWS\\system32\\dxdiag.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Infogrames Interactive\\Beach Head 2002\\BH2Game\\BH2.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\FrostWire\\FrostWire.exe"="c:\\Program Files\\AVG\\AVG9\\avgemc.exe"="c:\\Program Files\\AVG\\AVG9\\avgupd.exe"="c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/7/2010 1:06 PM 216400]R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/7/2010 1:06 PM 243024]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [8/7/2010 1:04 PM 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [8/7/2010 1:04 PM 308136]R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 200192]S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\JOSHWI~1\LOCALS~1\Temp\DMSKSSRh.sys --> c:\docume~1\JOSHWI~1\LOCALS~1\Temp\DMSKSSRh.sys [?]S3 PentaxUsb;PENTAX Optio E10 on USB;c:\windows\system32\drivers\CoachUsb.sys [9/26/2006 7:08 PM 50976]S3 PentaxVc;PENTAX Optio E10 Video Capture;c:\windows\system32\drivers\CoachVc.sys [9/26/2006 7:08 PM 44256]--- Other Services/Drivers In Memory ---*NewlyCreated* - NORMANDY*Deregistered* - Normandy.Contents of the 'Scheduled Tasks' folder2010-09-23 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 23:50]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = *.localuSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-09-23 14:01Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????4?9?0?8??????? ???B?????????????hLC? ?????? scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(572)c:\windows\system32\Ati2evxx.dll- - - - - - - > 'explorer.exe'(3620)c:\windows\system32\WININET.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.Completion time: 2010-09-23 14:04:06ComboFix-quarantined-files.txt 2010-09-23 21:04ComboFix2.txt 2010-09-23 20:20Pre-Run: 14,647,652,352 bytes freePost-Run: 14,644,375,552 bytes freeCurrent=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4- - End Of File - - 406C3B17ECFA5BB48A283EBA73BD75DE Link to post Share on other sites More sharing options...
Elise Posted September 24, 2010 ID:317841 Share Posted September 24, 2010 Hi please update MBAM manually: if you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.Once done, run a quick scan and post me the log. Link to post Share on other sites More sharing options...
jacksonv Posted September 24, 2010 Author ID:317994 Share Posted September 24, 2010 Hi, I get the same error when I tried to update and when I click on the link you gave me it says "internet cannot display the webpage" Link to post Share on other sites More sharing options...
Elise Posted September 24, 2010 ID:318000 Share Posted September 24, 2010 Please try to download the manual update file from a clean computer and transfer it with a flashdrive. Link to post Share on other sites More sharing options...
jacksonv Posted September 24, 2010 Author ID:318005 Share Posted September 24, 2010 Ok, I'm not sure when the next time is that I'll be able to use somebody's computer, my other one is infected as well so the link will not open on that computer either. Is anything else to do in the mean time, or just that?Thanks Link to post Share on other sites More sharing options...
Elise Posted September 24, 2010 ID:318047 Share Posted September 24, 2010 If your other computer has this same problem and you are connecting both computers through the same router, you might want to reset it. An infected router is quite common these days and a reset to factory defaults will resolve that. Link to post Share on other sites More sharing options...
jacksonv Posted September 24, 2010 Author ID:318065 Share Posted September 24, 2010 Oo, ok. So just push in the little reset button on the router is all? Or do I need to do something else with the computers as well to reset it. Link to post Share on other sites More sharing options...
jacksonv Posted September 24, 2010 Author ID:318066 Share Posted September 24, 2010 I reset the router, I updated Malewarebytes. I'm running a quick scan now. Link to post Share on other sites More sharing options...
jacksonv Posted September 24, 2010 Author ID:318070 Share Posted September 24, 2010 Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4686Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187029/24/2010 1:23:01 PMmbam-log-2010-09-24 (13-23-01).txtScan type: Quick scanObjects scanned: 144587Time elapsed: 12 minute(s), 28 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Elise Posted September 24, 2010 ID:318076 Share Posted September 24, 2010 On most models you have to power off the router and to hold the reset button for about ten seconds. But since you were able to update MBAM, can I conclude that did the trick? What other problems do you still have? Link to post Share on other sites More sharing options...
jacksonv Posted September 24, 2010 Author ID:318083 Share Posted September 24, 2010 Yep, I think that did the trick. So far I haven't been redirected or anything yet. The router reset enabled me to update malewarebytes on my other computer so I'm running a scan on that now, but it's still being redirected almost everytime on that computer so hopefully it will find some infections. Link to post Share on other sites More sharing options...
Elise Posted September 25, 2010 ID:318403 Share Posted September 25, 2010 Hi, do you have any other problems left at this point?ESET ONLINE SCANNER----------------------------I'd like us to scan your machine with ESET OnlineScanHold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScanClick the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check Click the button.Accept any security warnings from your browser.Check Push the Start button.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.Note - when ESET doesn't find any threats, no report will be created.Push the button.Push Link to post Share on other sites More sharing options...
jacksonv Posted September 25, 2010 Author ID:318495 Share Posted September 25, 2010 Well, it seems like everything was fixed. Alot of times on IE or some other program it will freeze up and say not responding, not sure if that has anything to do with maleware removal or not though.The scan showed 0 threats. Link to post Share on other sites More sharing options...
Elise Posted September 25, 2010 ID:318511 Share Posted September 25, 2010 Is it one specific program (IE) that freezes up, or does it happen randomly with different programs?As far as malware is concerned you are clean. We can see then if we can find a solution for this freezing problem. ALL CLEAN--------------Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean Please do the following to remove the remaining programs from your PC:Delete the tools used during the disinfection:Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.Delete [bRootkit Unhooker and OTL.Please read these advices, in order to prevent reinfecting your PC:Install and update the following programs regularly:an outbound firewallA comprehensive tutorial and a list of possible firewalls can be found here.an AntiVirus SoftwareIt is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.an Anti-Spyware programMalware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.SUPERAntiSpyware is another good scanner with high detection and removal rates.Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.Spyware BlasterA tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.MVPs hosts fileA tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file[*]Keep Windows (and your other Microsoft software) up to date!I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!![*]Keep your other software up to date as wellSoftware does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.[*]Stay up to date!The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.Some more links you might find of interest:Miekies' prevention suggestionsSo How did I get infected?Microsoft - 'Security at home'Calendar of Updates: See which updates have been released.How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail :wink:Commonly Used Freeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.osalt: Find (free) open source alternatives to known commercial software.Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards. Link to post Share on other sites More sharing options...
jacksonv Posted September 25, 2010 Author ID:318566 Share Posted September 25, 2010 Nothing specific, it happens on different programs but most noticeable on IE.Thank you very much for all of the help, I will definatley be updating everything quite often from now on Link to post Share on other sites More sharing options...
Recommended Posts