daydreams3 Posted October 22, 2010 ID:331791 Share Posted October 22, 2010 I am not sure if I completely got rid of this. I had a rogue antimalware attack a few days ago, and had it removed (I thought). It seems my computer was compromised as since then I have had bi-daily Trojans removed off my computer since the attack by security essentials. These have included FakeYak (antimalware), Zbot.C, Harnig.P, Alureon.DX, Meredrop, and I also had a HTML/Iframe.J on there as well. It seems no matter how many things are removed, other trojans are being planted on my computer. If you guys see anything on this log, please let me know. It is quite distressing knowing that my personal information could be compromised! Also, I have no idea why all of the bottom things say file missing.... please let me know whats going on here =) I ran Malware Bytes AntiMalware, and it removed the rogue program completely it seems, but I do not think this is the reason for the trojans? Please let me know if anyone sees something on here. Thanks a ton.Logfile of Trend Micro HijackThis v2.0.4Scan saved at 10:25:59 AM, on 10/22/2010Platform: Windows 7 (WinNT 6.00.3504)MSIE: Internet Explorer v8.00 (8.00.7600.16671)Boot mode: NormalRunning processes:C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files (x86)\LG Soft India\forteManager\bin\Monitor.exeC:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exeC:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exeC:\hp\support\hpsysdrv.exeC:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exeC:\Program Files (x86)\iTunes\iTunesHelper.exec:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exeC:\Program Files (x86)\Hewlett-Packard\KBD\kbd.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...buy&pf=cndtR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myfastwebsearch.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dllF2 - REG:system.ini: UserInit=C:\WINDOWS\SYSWOW64\userinit.exe,O1 - Hosts: ::1 localhostO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dllO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dllO2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dllO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllO3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dllO3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\Spyware Doctor\BDT\PCTBrowserDefender.dll (file missing)O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllO4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exeO4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exeO4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [KBD] C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.EXEO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimeO4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [iSUSPM Startup] c:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startupO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')O4 - Startup: startup.cmdO4 - Global Startup: forteManager.lnk = ?O4 - Global Startup: LimeWire SpeedUp Pro.lnk = C:\Program Files (x86)\LimeWire SpeedUp Pro\LimeWire SpeedUp Pro.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.htmlO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\OFFICE11\REFIEBAR.DLLO10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dllO10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dllO16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cabO16 - DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} (UMediaPlayer Class) - http://www.umediaserver.net/bin/UMediaControl5.cabO16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cabO16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cabO18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - (no file)O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exeO23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files (x86)\Spyware Doctor\BDT\BDTUpdateService.exeO23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exeO23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exeO23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\My HP Game Console\GameConsoleService.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exeO23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exeO23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exeO23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exeO23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exeO23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exeO23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) Link to post Share on other sites More sharing options...
Gammo Posted October 24, 2010 ID:332917 Share Posted October 24, 2010 Hi,Download TFC to your desktopOpen the file and close any other windows.It will close all programs itself when run, make sure to let it run uninterrupted.Click the Start button to begin the process. The program should not take long to finish its jobOnce its finished it should reboot your machine, if not, do this yourself to ensure a complete clean~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Start Malwarebytes' Anti-MalwareOnce the program has loaded, click the "Update" tab and click the "Check For updates" button.Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Download OTL to your DesktopDouble click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.Check the box that says Scan All Users.Under the Custom Scan box paste this innetsvcsdrivers32 %SYSTEMDRIVE%\*.*%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\System32\config\*.sav HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rsClick the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic Link to post Share on other sites More sharing options...
daydreams3 Posted October 25, 2010 Author ID:333317 Share Posted October 25, 2010 Hi, Thanks for the reply. The Trojan attacks seem to have ceased, but I am still not sure that I am secure. After I did a full scan on Microsoft Security Essentials, it came up with a java script hack, and since getting rid of that I have not had an issue, or so it seems. Here is the log from the 22nd when I removed Antimalware Doctor and following it are the recent ones from today."Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4912Windows 6.1.7600Internet Explorer 8.0.7600.1638510/22/2010 10:53:42 AMmbam-log-2010-10-22 (10-53-42).txtScan type: Quick scanObjects scanned: 145360Time elapsed: 7 minute(s), 28 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 3Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 2Files Infected: 3Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.C:\Users\Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.Files Infected:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.C:\Users\Erica\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.C:\Users\Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully."________________________________________________________________________Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4939Windows 6.1.7600Internet Explorer 8.0.7600.1638510/24/2010 11:52:55 PMmbam-log-2010-10-24 (23-52-55).txtScan type: Quick scanObjects scanned: 145450Time elapsed: 6 minute(s), 16 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)______________________________________________________OTL logfile created on: 10/24/2010 11:56:24 PM - Run 2OTL by OldTimer - Version 3.2.17.1 Folder = C:\Users\Erica\Downloads64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy6.00 Gb Total Physical Memory | 5.00 Gb Available Physical Memory | 77.00% Memory free12.00 Gb Paging File | 10.00 Gb Available in Paging File | 87.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 582.97 Gb Total Space | 353.82 Gb Free Space | 60.69% Space Free | Partition Type: NTFSDrive D: | 13.20 Gb Total Space | 1.77 Gb Free Space | 13.40% Space Free | Partition Type: NTFSDrive J: | 4.18 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDFDrive K: | 7.72 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFSComputer Name: ERICA-PC | User Name: Erica | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - [2010/10/24 23:47:08 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Erica\Downloads\OTL(2).exePRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exePRC - [2010/03/13 13:47:17 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exePRC - [2010/01/22 09:56:24 | 000,112,592 | ---- | M] (Threat Expert Ltd.) -- C:\Program Files (x86)\Spyware Doctor\BDT\BDTUpdateService.exePRC - [2009/10/20 14:50:34 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exePRC - [2009/04/28 17:05:54 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exePRC - [2008/10/17 20:57:18 | 000,189,736 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exePRC - [2008/03/27 11:44:02 | 001,126,400 | ---- | M] () -- C:\Program Files (x86)\LG Soft India\forteManager\bin\Monitor.exePRC - [2007/04/18 11:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exePRC - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exePRC - [2005/06/10 10:44:02 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe========== Modules (SafeList) ==========MOD - [2010/10/24 23:47:08 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Erica\Downloads\OTL(2).exeMOD - [2010/08/21 01:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll========== Win32 Services (SafeList) ==========SRV:64bit: - [2010/03/25 23:48:42 | 000,017,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)SRV:64bit: - [2009/08/10 17:01:06 | 000,206,880 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)SRV:64bit: - [2009/08/10 17:01:04 | 000,626,208 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM))SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)SRV - [2010/01/22 09:56:24 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)SRV - [2009/12/15 16:07:16 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc)SRV - [2009/11/06 00:34:01 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)SRV - [2009/10/20 14:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)SRV - [2009/10/19 12:40:52 | 000,109,288 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)SRV - [2009/09/23 17:37:30 | 000,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2009/04/15 10:42:56 | 000,273,952 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)SRV - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)========== Driver Services (SafeList) ==========DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\LVPr2M64.sys -- (LVPr2M64)DRV:64bit: - [2010/04/19 20:47:42 | 000,050,688 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:64bit: - [2010/03/29 10:06:06 | 000,233,488 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PCTCore64.sys -- (PCTCore)DRV:64bit: - [2009/10/20 14:19:54 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)DRV:64bit: - [2009/08/05 07:59:48 | 000,987,648 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)DRV:64bit: - [2009/07/30 18:12:56 | 000,339,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)DRV:64bit: - [2009/07/13 21:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2009/07/13 21:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/06/10 19:12:38 | 000,023,536 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- c:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms -- (PCDSRVC{F36B3A4C-F95654BD-06000000}_0)DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)DRV:64bit: - [2009/06/10 16:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/05/20 09:53:32 | 000,716,288 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364)DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2009/04/30 22:55:58 | 002,755,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)DRV:64bit: - [2009/02/24 19:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)DRV:64bit: - [2008/12/17 02:01:22 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)DRV:64bit: - [2008/12/17 02:00:02 | 001,133,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)DRV:64bit: - [2008/12/17 01:53:12 | 000,015,768 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)DRV:64bit: - [2008/07/03 23:49:26 | 000,252,928 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTwindrvr6.sys -- (VSTWinDriver6)DRV:64bit: - [2007/06/29 14:48:06 | 000,039,424 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmdLLD64.sys -- (AmdLLD64)DRV - [2010/10/22 16:36:22 | 000,034,560 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWow64\drivers\Normandy.sys -- (Normandy)DRV - [2009/02/24 19:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)DRV - [2008/03/27 11:42:46 | 000,014,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys -- (LGDDCDevice)DRV - [2008/03/27 11:42:46 | 000,013,312 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys -- (LGII2CDevice)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...buy&pf=cndtIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...buy&pf=cndtIE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://myfastwebsearch.com/IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.localIE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555========== FireFox ==========FF - prefs.js..browser.search.defaultenginename: "Yahoo"FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="FF - prefs.js..browser.search.useDBForOrder: trueFF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1FF - prefs.js..extensions.enabledItems: 6FF - prefs.js..extensions.enabledItems: 2FF - prefs.js..extensions.enabledItems: 48FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.47.4FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:3.4FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.3FF - prefs.js..extensions.enabledItems: {771f3037-9885-4423-b50f-a5ede4854e26}:1.300.306FF - prefs.js..keyword.URL: "http://search.freecause.com/search?fr=freecause&ourmark=3&type=62133&p="FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2009/11/22 13:10:23 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/13 13:48:31 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/10/21 01:39:15 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.6.11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/10/21 01:39:15 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Sunbird 0.9\extensions\\Components: C:\Program Files (x86)\Mozilla Sunbird\components [2010/10/05 09:52:55 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010/10/22 00:42:54 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins[2010/06/24 13:16:29 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Mozilla\Extensions[2010/06/24 13:16:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Erica\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}[2009/04/29 02:15:04 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org[2010/10/24 19:53:23 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions[2010/07/15 01:21:39 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}[2010/09/09 17:57:58 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}[2010/07/15 01:21:40 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}[2010/07/15 01:21:39 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}[2010/10/24 13:53:27 | 000,000,000 | ---D | M] (InboxDollars) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}[2010/07/15 01:21:40 | 000,000,000 | ---D | M] (Easy Youtube Video Downloader) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}[2010/07/15 01:21:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}[2009/11/22 13:22:49 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}[2010/07/15 01:21:42 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}[2010/07/15 01:21:39 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\personas@christopher.beard[2009/11/22 19:15:19 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Mozilla\Sunbird\Profiles\e5l09n19.default\extensions[2010/10/24 13:53:34 | 000,001,734 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\searchplugins\search-the-web.xml[2010/10/24 19:53:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions[2010/08/04 22:38:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}[2009/11/19 17:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll[2009/11/06 17:38:39 | 001,152,488 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\plugins\NPFxViewer.dll[2009/11/19 17:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dllO1 HOSTS File: ([2009/12/29 02:02:13 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: ::1 localhostO2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg64.dll (Google Inc.)O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\Spyware Doctor\BDT\PCTBrowserDefender.dll File not foundO3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)O3:64bit: - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)O3:64bit: - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)O3:64bit: - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)O4:64bit: - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)O4:64bit: - HKLM..\Run: [NVRaidService] C:\Windows\SysNative\nvraidservice.exe (NVIDIA Corporation)O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)O4 - HKLM..\Run: [iSUSScheduler] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)O4 - HKLM..\Run: [KBD] C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe (Microsoft)O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000..\Run: [iSUSPM Startup] c:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)O4 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not foundO4 - Startup: C:\Users\Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.cmd ()O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0O7 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)O13 - gopher Prefix: missingO13 - gopher Prefix: missingO15 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)O15 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)O15 - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\..Trusted Ranges: Range1 ([http] in Local intranet)O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0...heckControl.cab (Windows Genuine Advantage Validation Tool)O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cab (System Requirements Lab Class)O16 - DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} http://www.umediaserver.net/bin/UMediaControl5.cab (UMediaPlayer Class)O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab (Reg Error: Key error.)O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab (NVIDIA Smart Scan)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\msdaipp - No CLSID value foundO18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O18:64bit: - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not foundO18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - Reg Error: Key error. File not foundO18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - Reg Error: Key error. File not foundO18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not foundO20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O21:64bit: - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\SysNative\WPDShServiceObj.dll (Microsoft Corporation)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.O24 - Desktop WallPaper: C:\Users\Erica\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpgO24 - Desktop BackupWallPaper: C:\Users\Erica\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpgO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2009/12/29 02:01:42 | 000,000,000 | -H-D | M] - C:\Autorun.inf -- [ NTFS ]O32 - AutoRun File - [2009/12/29 02:01:43 | 000,000,000 | -H-D | M] - D:\Autorun.inf -- [ NTFS ]O32 - AutoRun File - [2005/11/21 13:26:21 | 000,000,057 | R--- | M] () - J:\autorun.inf -- [ UDF ]O32 - AutoRun File - [2009/07/16 18:13:07 | 001,246,440 | R--- | M] (BioWare) - K:\autorun.exe -- [ CDFS ]O32 - AutoRun File - [2009/04/13 23:17:18 | 000,000,058 | R--- | M] () - K:\autorun.inf -- [ CDFS ]O33 - MountPoints2\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\Shell - "" = AutoRunO33 - MountPoints2\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\Shell\AutoRun\command - "" = J:\OblivionLauncher.exe -- [2006/02/27 10:15:50 | 001,662,976 | R--- | M] (Bethesda Softworks)O33 - MountPoints2\{fb3716e2-e768-11de-b196-8d7db381dac3}\Shell - "" = AutoRunO33 - MountPoints2\{fb3716e2-e768-11de-b196-8d7db381dac3}\Shell\AutoRun\command - "" = K:\autorun.exe -- [2009/07/16 18:13:07 | 001,246,440 | R--- | M] (BioWare)O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)Drivers32: msacm.avis - C:\Windows\SysWow64\ff_acm.acm ()Drivers32: msacm.imc - C:\Windows\SysWow64\IMC32.ACM (Intel Corporation)Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (http://www.mp3dev.org/)Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)Drivers32: VIDC.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)Drivers32: vidc.i263 - C:\Windows\SysWow64\I263_32.DRV (Intel Corporation)Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)Drivers32: VIDC.MSUD - C:\Windows\SysWow64\msulvc06.DLL (Moscow State University)Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()Drivers32: VIDC.YV12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)CREATERESTOREPOINTRestore point Set: OTL Restore Point========== Files/Folders - Created Within 30 Days ==========[2010/10/22 10:39:31 | 000,000,000 | ---D | C] -- C:\Users\Erica\AppData\Roaming\Malwarebytes[2010/10/22 10:39:25 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys[2010/10/22 10:39:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2010/10/22 10:39:23 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys[2010/10/22 10:39:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2010/10/21 01:42:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro[2010/10/05 09:52:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime[2010/10/04 15:06:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Coupons========== Files - Modified Within 30 Days ==========[2010/10/24 23:35:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2010/10/24 23:05:12 | 000,009,728 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2010/10/24 23:05:12 | 000,009,728 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2010/10/24 23:02:31 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2010/10/24 22:57:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2010/10/24 22:57:40 | 536,256,511 | -HS- | M] () -- C:\hiberfil.sys[2010/10/22 16:36:22 | 000,034,560 | ---- | M] () -- C:\Windows\SysWow64\drivers\Normandy.sys[2010/10/22 16:24:34 | 000,000,020 | ---- | M] () -- C:\Users\Erica\Documents\aionmemo_316fb19b.dat[2010/10/22 10:39:28 | 000,001,011 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk[2010/10/22 10:16:08 | 000,001,044 | ---- | M] () -- C:\Users\Public\Documents\Videos - Shortcut.lnk[2010/10/22 10:10:58 | 000,000,000 | ---- | M] () -- C:\install.rdf[2010/10/21 10:25:04 | 000,717,956 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2010/10/21 10:25:04 | 000,618,026 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2010/10/21 10:25:04 | 000,104,340 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2010/10/21 03:19:04 | 000,002,828 | -HS- | M] () -- C:\Windows\SysWow64\KGyGaAvL.sys[2010/10/21 02:31:38 | 000,170,721 | ---- | M] () -- C:\Users\Erica\Desktop\2008-06-16-0chart.jpg[2010/10/21 02:30:31 | 000,040,207 | ---- | M] () -- C:\Users\Erica\Desktop\fbc0a7d90c1fe13fad981952f863e52c.jpg[2010/10/21 01:42:21 | 000,002,975 | ---- | M] () -- C:\Users\Erica\Desktop\HiJackThis.lnk[2010/10/19 02:46:14 | 000,045,568 | ---- | M] () -- C:\Users\Erica\Desktop\HistMidterm.doc[2010/10/18 16:00:47 | 000,200,208 | ---- | M] () -- C:\Users\Erica\Desktop\desktop3.jpg[2010/10/18 15:55:31 | 000,345,682 | ---- | M] () -- C:\Users\Erica\Desktop\desktop.jpg[2010/10/18 05:36:21 | 000,040,960 | ---- | M] () -- C:\Users\Erica\Desktop\STEROIDS_Real.doc[2010/10/14 08:36:40 | 000,349,240 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2010/10/14 03:06:03 | 000,001,033 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk[2010/10/12 01:46:50 | 000,042,496 | ---- | M] () -- C:\Users\Erica\Desktop\mygrocerylist.doc[2010/10/10 22:48:30 | 000,039,424 | ---- | M] () -- C:\Users\Erica\Desktop\GroceryList.doc[2010/10/10 22:47:51 | 001,068,440 | ---- | M] () -- C:\Users\Erica\Desktop\Turkey and Hummingbirds.JPG[2010/10/10 14:01:21 | 000,032,256 | ---- | M] () -- C:\Users\Erica\Desktop\midterm exam.doc[2010/10/06 00:10:28 | 000,001,919 | ---- | M] () -- C:\Users\Erica\Desktop\LimeWire 5.5.16.lnk========== Files Created - No Company Name ==========[2010/10/22 16:36:19 | 000,034,560 | ---- | C] () -- C:\Windows\SysWow64\drivers\Normandy.sys[2010/10/22 10:39:28 | 000,001,011 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk[2010/10/22 10:16:08 | 000,001,044 | ---- | C] () -- C:\Users\Public\Documents\Videos - Shortcut.lnk[2010/10/22 10:10:58 | 000,000,000 | ---- | C] () -- C:\install.rdf[2010/10/21 02:31:38 | 000,170,721 | ---- | C] () -- C:\Users\Erica\Desktop\2008-06-16-0chart.jpg[2010/10/21 02:30:30 | 000,040,207 | ---- | C] () -- C:\Users\Erica\Desktop\fbc0a7d90c1fe13fad981952f863e52c.jpg[2010/10/21 01:42:21 | 000,002,975 | ---- | C] () -- C:\Users\Erica\Desktop\HiJackThis.lnk[2010/10/18 16:00:47 | 000,200,208 | ---- | C] () -- C:\Users\Erica\Desktop\desktop3.jpg[2010/10/18 15:55:31 | 000,345,682 | ---- | C] () -- C:\Users\Erica\Desktop\desktop.jpg[2010/10/18 05:36:20 | 000,040,960 | ---- | C] () -- C:\Users\Erica\Desktop\STEROIDS_Real.doc[2010/10/16 01:47:19 | 000,045,568 | ---- | C] () -- C:\Users\Erica\Desktop\HistMidterm.doc[2010/10/10 22:53:16 | 000,042,496 | ---- | C] () -- C:\Users\Erica\Desktop\mygrocerylist.doc[2010/10/10 22:48:30 | 000,039,424 | ---- | C] () -- C:\Users\Erica\Desktop\GroceryList.doc[2010/10/10 22:47:50 | 001,068,440 | ---- | C] () -- C:\Users\Erica\Desktop\Turkey and Hummingbirds.JPG[2010/10/10 14:01:21 | 000,032,256 | ---- | C] () -- C:\Users\Erica\Desktop\midterm exam.doc[2010/10/06 00:10:28 | 000,001,919 | ---- | C] () -- C:\Users\Erica\Desktop\LimeWire 5.5.16.lnk[2010/08/31 21:53:14 | 000,000,032 | ---- | C] () -- C:\Windows\DxPlayer.INI[2010/08/04 12:44:16 | 000,000,000 | ---- | C] () -- C:\Users\Erica\AppData\Local\Jjapisidu.bin[2010/08/04 12:44:15 | 000,000,120 | ---- | C] () -- C:\Users\Erica\AppData\Local\Sgeyikixezibece.dat[2010/06/15 04:01:24 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\intelbth.dll[2010/06/15 04:01:24 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\ICE_JNIRegistry.dll[2010/05/03 11:50:11 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll[2010/04/26 11:22:21 | 000,000,004 | ---- | C] () -- C:\Users\Erica\AppData\Roaming\7ED082[2010/04/26 11:22:20 | 000,870,128 | ---- | C] () -- C:\Users\Erica\AppData\Roaming\mcs.rma[2010/04/23 20:40:55 | 000,034,308 | ---- | C] () -- C:\Windows\SysWow64\bassmod.dll[2010/02/15 03:35:10 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini[2010/01/10 05:27:55 | 000,000,262 | ---- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini[2009/12/28 02:51:16 | 000,004,608 | ---- | C] () -- C:\Users\Erica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2009/12/24 23:39:53 | 000,717,956 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2009/11/22 22:06:58 | 000,007,599 | ---- | C] () -- C:\Users\Erica\AppData\Local\Resmon.ResmonCfg[2009/10/24 18:52:13 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll[2009/10/24 18:52:12 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini[2009/10/24 18:52:10 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll[2009/10/24 18:52:10 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll[2009/10/24 18:52:10 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll[2009/10/24 18:52:08 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll[2009/10/20 14:19:30 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll[2009/09/17 14:06:09 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll[2009/08/03 00:21:54 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll[2009/08/03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll[2009/08/03 00:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll[2009/08/03 00:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll[2009/07/31 17:44:37 | 000,000,008 | RHS- | C] () -- C:\Windows\SysWow64\0F7A2A70D8.sys[2009/07/31 17:39:34 | 000,002,828 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll[2009/05/28 16:49:51 | 000,046,592 | ---- | C] () -- C:\Windows\SysWow64\shellses.dll[2009/05/04 23:42:57 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI[2009/05/04 23:30:28 | 000,001,616 | ---- | C] () -- C:\Users\Erica\AppData\Roaming\wklnhst.dat[2009/04/28 17:26:41 | 000,001,915 | ---- | C] () -- C:\Windows\cdplayer.ini[2009/04/27 19:58:48 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini[2009/02/11 12:44:49 | 000,327,680 | ---- | C] () -- C:\Windows\SysWow64\pythoncom25.dll[2009/02/11 12:44:49 | 000,102,400 | ---- | C] () -- C:\Windows\SysWow64\pywintypes25.dll[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\SysWow64\OUTLPERF.INI[2001/08/29 19:57:40 | 000,155,648 | ---- | C] () -- C:\Windows\SysWow64\addurl41.DLL[2001/07/10 14:43:16 | 000,018,432 | ---- | C] () -- C:\Windows\SysWow64\winwatch.DLL========== LOP Check ==========[2010/03/29 19:45:56 | 000,000,000 | -HSD | M] -- C:\Users\Erica\AppData\Roaming\.#[2009/11/22 13:22:37 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\acccore[2009/11/22 13:22:37 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\avidemux[2009/11/22 13:22:38 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Leadertech[2010/10/21 01:52:34 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\LimeWire[2009/11/22 13:22:49 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Octoshape[2009/11/22 13:22:49 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\PictureMover[2010/03/13 20:24:29 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Publish Providers[2010/03/13 20:24:25 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Sony[2009/11/22 23:12:52 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\SystemRequirementsLab[2009/11/22 13:22:51 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Template[2010/06/24 13:16:28 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Thunderbird[2009/06/03 17:46:17 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\Unreal Streaming[2010/07/02 03:53:16 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\uTorrent[2009/11/22 13:22:52 | 000,000,000 | ---D | M] -- C:\Users\Erica\AppData\Roaming\WinBatch[2010/08/16 18:34:17 | 000,032,644 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2004/07/19 10:44:42 | 000,003,120 | -HS- | M] () -- C:\74108.ini[2009/10/10 20:27:34 | 000,003,120 | -HS- | M] () -- C:\74415.ini[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr[2009/11/22 15:56:09 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK[2009/12/29 01:32:28 | 000,000,013 | ---- | M] () -- C:\cpeExitCode.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt[2010/03/27 17:39:48 | 000,000,375 | ---- | M] () -- C:\FINIS_IT.TXT[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini[2010/10/24 22:57:40 | 536,256,511 | -HS- | M] () -- C:\hiberfil.sys[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini[2010/10/22 10:10:58 | 000,000,000 | ---- | M] () -- C:\install.rdf[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll[2010/03/28 15:59:06 | 000,001,086 | -H-- | M] () -- C:\IPH.PH[2009/12/12 18:14:28 | 003,362,647 | ---- | M] () -- C:\mcdbp.log[2010/10/24 22:57:47 | 2146,668,543 | -HS- | M] () -- C:\pagefile.sys[2009/10/10 20:27:20 | 000,000,024 | ---- | M] () -- C:\sara.reg[2009/02/11 13:13:21 | 000,000,361 | ---- | M] () -- C:\updatedatfix.log[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI< %systemroot%\*. /mp /s >< %systemroot%\System32\config\*.sav >< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >"NoAutoRebootWithLoggedOnUsers" = 1< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >========== Alternate Data Streams ==========@Alternate Data Stream - 187 bytes -> C:\ProgramData\Temp:DFC5A2B2@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:A8ADE5D8< End of report >____________________________________________________OTL Extras logfile created on: 10/22/2010 4:40:30 PM - Run 1OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\Erica\Downloads64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstationInternet Explorer (Version = 8.0.7600.16385)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy6.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 73.00% Memory free12.00 Gb Paging File | 10.00 Gb Available in Paging File | 85.00% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 582.97 Gb Total Space | 353.15 Gb Free Space | 60.58% Space Free | Partition Type: NTFSDrive D: | 13.20 Gb Total Space | 1.77 Gb Free Space | 13.40% Space Free | Partition Type: NTFSDrive J: | 4.18 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDFDrive K: | 7.72 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFSComputer Name: ERICA-PC | User Name: Erica | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days========== Extra Registry (SafeList) ==================== File Associations ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].url[@ = InternetShortcut] -- C:\Windows\system32\ieframe.DLL (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation).url [@ = InternetShortcut] -- C:\Windows\system32\ieframe.DLL (Microsoft Corporation)[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)========== Shell Spawning ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %* File not foundcmdfile [open] -- "%1" %* File not foundcomfile [open] -- "%1" %* File not foundexefile [open] -- "%1" %* File not foundhelpfile [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %* File not foundregfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1" File not foundscrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /S File not foundtxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not foundDirectory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 164bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 064bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]========== Firewall Settings ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"DisableNotifications" = 0"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"DisableNotifications" = 0"EnableFirewall" = 1========== Authorized Applications List ==================== HKEY_LOCAL_MACHINE Uninstall List ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)"{2D7ED2A0-9553-412B-939F-D6E0AEB2ABE1}" = ISO Recorder"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022"{39600969-41C3-4658-876E-16F108FC5C92}" = ISO Recorder"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour"{4FFA2088-8317-3B14-93CD-4C699DB37843}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729"{5F02C14D-A630-4771-8409-0BA89FCCA8D6}" = iTunes"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{95C9C76F-ECF3-40FA-94F8-5DDFB6BAF40D}" = Microsoft Security Essentials"{B0EFB716-085B-4564-8060-212E41F5CE50}" = Windows Live ID Sign-in Assistant"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053"{D2F7994F-661E-46D1-A1DF-67F2887AAA7E}" = HP MediaSmart SmartMenu"{D86B6C32-49BD-4A02-9C43-14E497018498}" = Windows 7 Manager"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64"lvdrivers_11.90" = Logitech QuickCam Driver Package"Microsoft Security Essentials" = Microsoft Security Essentials"NVIDIA Display Control Panel" = NVIDIA Display Control Panel"NVIDIA Drivers" = NVIDIA Drivers"PC-Doctor for Windows" = Hardware Diagnostic Tools[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148"{03BF5CB1-B72E-4CA6-A278-F65680F05420}" = HP Picasso Media Center Add-In"{148E08FF-D7C4-46ED-8D4D-601C67FE0AFD}" = Rosetta Stone Version 3"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works"{16489F4A-8911-4C0A-9980-80A759D9E8D7}" = LoggerPro3"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{1896E712-2B3D-45eb-BCE9-542742A51032}" = PictureMover"{19506BDB-4EA7-491F-E8AB-E97109FDB296}" = muvee Reveal"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java 6 Update 21"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com"{2D20B02D-BDBD-4AAE-9608-61D5E69FB3F0}" = Track Prince"{2E5EEBB7-8B61-4FCC-AF7F-C2E0AC4583BB}" = Rapidshare Auto Downloader 3.7.1"{31228E31-2BFF-11D2-8866-00805F0D9D40}" = QPST"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZero Preloader"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion"{38058455-8C21-4C2F-B2F6-14ED166039CB}" = HP Total Care Setup"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid"{5BD0CB24-11AF-4BA8-A198-38D25257C656}" = LightScribe Template Labeler"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail"{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}" = Juno Preloader"{64B9E2F5-558E-4C56-B419-A1679518F6E7}" = HP Customer Experience Enhancements"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library"{6B976ADF-8AE8-434E-B282-A06C7F624D2F}" = Python 2.5.2"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance"{7F10292C-A190-4176-A665-A1ED3478DF86}" = LightScribe System Software"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{84348753-D7BE-496A-B4F9-363403CEEC2E}" = Video Messenger"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)"{97ABD26A-3249-46CB-B2E2-F66E64B2E480}" = HP Demo"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library"{D575FBAA-D6D6-4221-A2C4-67541DB7AB5E}_is1" = Device Doctor 1.0.0.1"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery"{D8B5B7C3-47B1-40FA-8251-59C74A543880}" = Dragon Age: Origins Character Creator"{DA6FAB8D-E87A-4E8E-A3D3-B7B9F479C725}" = forteManager"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD"{E11158F5-734F-4EEB-B5E6-BE4230AF1C2B}" = Aion"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime"{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}" = NVIDIA System Monitor"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022"Ace DivX Player_is1" = Ace DivX Player v2.1"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin"AIM_7" = AIM 7"Avidemux 2.5" = Avidemux 2.5"Browser Defender_is1" = Browser Defender 2.0.6.15"CCleaner" = CCleaner"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows"Defraggler" = Defraggler"DeleteProdRunControl_US" = IBM ViaVoice Command and Control Runtime 5.3"Driver Cleaner Pro" = DH Driver Cleaner Professional Edition"DSL Speed V6.3_is1" = DSL Speed V6.3"Foxit PDF Editor" = Foxit PDF Editor"FoxyTunesForFirefox" = FoxyTunes for Firefox"Free DVD Creator (by minidvdsoft)_is1" = Free DVD Creator version 2.0"FxFoto" = FxFoto by Triscape"InstallShield_{16489F4A-8911-4C0A-9980-80A759D9E8D7}" = Logger Pro 3.8.2 Demo"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD"InstallShield_{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}" = NVIDIA System Monitor"Magic DVD Ripper_is1" = Magic DVD Ripper V5.4.2"Magic ISO Maker v5.5 (build 0276)" = Magic ISO Maker v5.5 (build 0276)"MagicDisc 2.7.106" = MagicDisc 2.7.106"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware"Mozilla Firefox (3.6.11)" = Mozilla Firefox (3.6.11)"Mozilla Sunbird (0.9)" = Mozilla Sunbird (0.9)"Mozilla Thunderbird (3.1.5)" = Mozilla Thunderbird (3.1.5)"msulvc06" = MSUlvc06 Lossless Video Codec 0.6.0 (Remove Only)"Oblivion mod manager_is1" = Oblivion mod manager 1.1.12"RealPlayer 12.0" = RealPlayer"RealPlayer 6.0" = RealPlayer"SoftwareUpdUtility" = Download Updater (AOL LLC)"Spyware Doctor" = Spyware Doctor 7.0"SystemRequirementsLab" = System Requirements Lab"TriscapeFxFoto" = Triscape FxFoto"Unofficial Oblivion Patch_is1" = Unofficial Oblivion Patch v3.2.0"uTorrent" = Link to post Share on other sites More sharing options...
Gammo Posted October 25, 2010 ID:333512 Share Posted October 25, 2010 Hi,Run OTLUnder the Custom Scans/Fixes box at the bottom, paste in the following:OTLIE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://myfastwebsearch.com/IE - HKU\S-1-5-21-1667923554-884477421-1395814810-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555FF - prefs.js..keyword.URL: "http://search.freecause.com/search?fr=freecause&ourmark=3&type=62133&p="[2010/10/24 13:53:27 | 000,000,000 | ---D | M] (InboxDollars) -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}[2010/10/24 13:53:34 | 000,001,734 | ---- | M] () -- C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\searchplugins\search-the-web.xmlO4 - Startup: C:\Users\Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.cmd ()O33 - MountPoints2\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\Shell - "" = AutoRunO33 - MountPoints2\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\Shell\AutoRun\command - "" = J:\OblivionLauncher.exe -- [2006/02/27 10:15:50 | 001,662,976 | R--- | M] (Bethesda Softworks)O33 - MountPoints2\{fb3716e2-e768-11de-b196-8d7db381dac3}\Shell - "" = AutoRunO33 - MountPoints2\{fb3716e2-e768-11de-b196-8d7db381dac3}\Shell\AutoRun\command - "" = K:\autorun.exe -- [2009/07/16 18:13:07 | 001,246,440 | R--- | M] (BioWare)[2010/08/04 12:44:16 | 000,000,000 | ---- | C] () -- C:\Users\Erica\AppData\Local\Jjapisidu.bin[2010/08/04 12:44:15 | 000,000,120 | ---- | C] () -- C:\Users\Erica\AppData\Local\Sgeyikixezibece.dat:Services:Reg:Filesipconfig /flushdns /c:Commands[purity][resethosts][emptytemp][emptyflash][createrestorepoint][reboot]Then click the Run Fix button at the topLet the program run unhindered, reboot the PC when it is done~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'd like us to scan your machine with ESET OnlineScanHold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScanClick the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check Click the button.Accept any security warnings from your browser.Check Push the Start button.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.Push the button.Push Link to post Share on other sites More sharing options...
daydreams3 Posted October 26, 2010 Author ID:333792 Share Posted October 26, 2010 Thanks again for all your help. I did as asked and here is the OTL log. The ESET scan found no threats (yay) so thus gave me no option to "list threats"________________________________________________________All processes killed========== OTL ==========HKU\S-1-5-21-1667923554-884477421-1395814810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!HKU\S-1-5-21-1667923554-884477421-1395814810-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!Prefs.js: "http://search.freecause.com/search?fr=freecause&ourmark=3&type=62133&p=" removed from keyword.URLC:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\META-INF folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\components folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome\skin\weather folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome\skin\gray03 folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome\skin folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome\content\locale folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome\content\flashradio folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome\content folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26}\chrome folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\extensions\{771f3037-9885-4423-b50f-a5ede4854e26} folder moved successfully.C:\Users\Erica\AppData\Roaming\Mozilla\Firefox\Profiles\63z50b6t.default\searchplugins\search-the-web.xml moved successfully.C:\Users\Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.cmd moved successfully.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\ not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2138963e-a82e-11de-a6a2-00248c6d6aaf}\ not found.File move failed. J:\OblivionLauncher.exe scheduled to be moved on reboot.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb3716e2-e768-11de-b196-8d7db381dac3}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb3716e2-e768-11de-b196-8d7db381dac3}\ not found.Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fb3716e2-e768-11de-b196-8d7db381dac3}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fb3716e2-e768-11de-b196-8d7db381dac3}\ not found.File move failed. K:\autorun.exe scheduled to be moved on reboot.C:\Users\Erica\AppData\Local\Jjapisidu.bin moved successfully.C:\Users\Erica\AppData\Local\Sgeyikixezibece.dat moved successfully.========== SERVICES/DRIVERS ==================== REGISTRY ==================== FILES ==========< ipconfig /flushdns /c >Windows IP ConfigurationSuccessfully flushed the DNS Resolver Cache.C:\Users\Erica\Downloads\cmd.bat deleted successfully.C:\Users\Erica\Downloads\cmd.txt deleted successfully.========== COMMANDS ==========C:\Windows\System32\drivers\etc\Hosts moved successfully.HOSTS file reset successfully[EMPTYTEMP]User: All UsersUser: Default->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytesUser: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytesUser: Erica->Temp folder emptied: 153604 bytes->Temporary Internet Files folder emptied: 47400 bytes->Java cache emptied: 0 bytes->FireFox cache emptied: 94384907 bytes->Flash cache emptied: 932 bytesUser: Public%systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%\System32 .tmp files removed: 0 bytes%systemroot%\System32 (64bit) .tmp files removed: 0 bytes%systemroot%\System32\drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 540892 bytes%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytesRecycleBin emptied: 0 bytesTotal Files Cleaned = 91.00 mb[EMPTYFLASH]User: All UsersUser: DefaultUser: Default UserUser: Erica->Flash cache emptied: 0 bytesUser: PublicTotal Flash Files Cleaned = 0.00 mbRestore point Set: OTL Restore PointOTL by OldTimer - Version 3.2.16.0 log created on 10252010_144654Files\Folders moved on Reboot...File move failed. J:\OblivionLauncher.exe scheduled to be moved on reboot.File move failed. K:\autorun.exe scheduled to be moved on reboot.C:\Users\Erica\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.File\Folder C:\Windows\temp\TMP000000377FD5537D5BB72EB5 not found!Registry entries deleted on Reboot...___________________________ Link to post Share on other sites More sharing options...
Gammo Posted October 26, 2010 ID:333992 Share Posted October 26, 2010 Hi,Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. Open OTLUnder the Custom Scans/Fixes box at the bottom, paste the following::Commands[clearallrestorepoints]Click the Run Fix button at the topIt might ask you to reboot, if so click YES~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Download OTC to your desktop and run itA list of tool components used in the Cleanup of malware will be downloaded.If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.Click Yes to begin the Cleanup process and remove these components, including this application.You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Please download JavaRa to your desktop and unzip it to its own folderRun JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.Accept any prompts.Open JavaRa.exe again and select Search For Updates.Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep a backup of your important filesNow, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Make proper use of your anti-virus and firewallYou should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep all your software updatedIt is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Use a safer web browserInternet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Some other security programsIt is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.SpywareBlaster to help prevent spyware from installing in the first place.MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Be carefulHaving security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Slow computer?If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!Cheers,Gammo Link to post Share on other sites More sharing options...
daydreams3 Posted October 27, 2010 Author ID:334536 Share Posted October 27, 2010 I can't thank you enough. I've done all you said in your previous post and feel much more secure now. Thanks again, if there are any more issues I'll let you know but everything seems to be back up to speed! Link to post Share on other sites More sharing options...
Gammo Posted October 27, 2010 ID:334599 Share Posted October 27, 2010 Hi,You're welcome. Glad I could help. Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 30, 2010 ID:336884 Share Posted October 30, 2010 This case is resolved, and the topic now Closed.The procedures used here were only for -this system- and no other.If you are a casual viewer and are having issues, please create your own New Topic and follow forum procedures.See http://www.malwarebytes.org/forums/index.php?showtopic=9573 Link to post Share on other sites More sharing options...
Recommended Posts