Can't Remove HDDTools Virus

feverdog71 · December 22, 2010

Hi,

I ran MBAM, and it found some malicious files and removed them, but HDDTools is still wreaking havoc on my computer.

Would appreciate any help you can give me.

Thanks

negster22 · December 22, 2010

Hi and Welcome feverdog71,

Can You please copy/paste the MBAM log that shows the threats that were removed.

Also, I need You to try and run the scans in this topic:

http://forums.malwarebytes.org/index.php?showtopic=9573

Then copy/paste all requested logs (do NOT attach them) into your next reply.

Download OTL and save it on your desktop:

http://oldtimer.geekstogo.com/OTL.exe

Close all open windows on the Task Bar. Click the OTL icon (for Vista or Win 7, right click the icon and Run as Administrator) to start the program.
In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
Now click Run Scan at Top left and let the program run uninterrupted. The scan may take 5-10 minutes.
Do NOT touch your keyboard until the scan is done!!
It will produce two (2) logs on your desktop, one will pop up called OTL.txt; the other will be named Extras.txt.
Copy/Paste OTL.txt and attach Extras.txt into your next reply,
Exit OTL by clicking the X at top right.

feverdog71 · December 22, 2010

Thanks for the quick reply. A couple of things to note....... Defogger never asked to reboot. It kept going back to the disable/re-enable dialog box. And secondly, gmer bombed out during the scan and went to the blue screen. I didn't try to run it again.

MBAM LOG

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5363

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/21/2010 10:41:55 PM

mbam-log-2010-12-21 (22-41-55).txt

Scan type: Full scan (C:\|)

Objects scanned: 196916

Time elapsed: 57 minute(s), 19 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 08:13 on 22/12/2010 (Owner)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\documents and settings\all users\application data\ygguuiaahy.dll (Trojan.FakeAlert.Gen) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\all users\application data\ygguuiaahy.dll (Trojan.FakeAlert.Gen) -> Delete on reboot.

DDS (Ver_10-12-12.02) - NTFSx86

Run by Owner at 8:15:43.90 on Wed 12/22/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.137 [GMT -6:00]

AV: CA Anti-Virus *Enabled/Updated* {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe

C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe

C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.517\QOELoader.exe

C:\Program Files\CA\CA Internet Security Suite\casc.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe

C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

DDS (Ver_10-12-12.02)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 10/3/2008 09:53:13 PM

System Uptime: 12/22/2010 07:41:20 AM (1 hours ago)

Motherboard: Dell Computer Corp. | | 0N6381

Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 72 GiB total, 35.476 GiB free.

D: is CDROM ()

E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {00000000-0000-0000-0000-000000000000}

Description: Ethernet Controller

Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_019D1028&REV_02\4&1C660DD6&0&40F0

Manufacturer:

Name: Ethernet Controller

PNP Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_019D1028&REV_02\4&1C660DD6&0&40F0

Service:

==== System Restore Points ===================

RP68: 9/23/2010 05:22:02 PM - System Checkpoint

RP69: 9/24/2010 10:27:54 PM - System Checkpoint

RP70: 9/26/2010 09:37:12 AM - System Checkpoint

RP71: 9/27/2010 05:03:54 PM - System Checkpoint

RP72: 9/28/2010 05:08:07 PM - System Checkpoint

RP73: 9/28/2010 08:30:15 PM - Software Distribution Service 3.0

RP74: 9/30/2010 05:06:12 PM - System Checkpoint

RP75: 10/2/2010 08:23:53 AM - System Checkpoint

RP76: 10/3/2010 08:52:01 AM - System Checkpoint

RP77: 10/4/2010 05:10:38 PM - System Checkpoint

RP78: 10/5/2010 09:00:07 PM - System Checkpoint

RP79: 10/5/2010 10:16:21 PM - Software Distribution Service 3.0

RP80: 10/7/2010 05:04:07 PM - System Checkpoint

RP81: 10/8/2010 05:14:17 PM - System Checkpoint

RP82: 10/9/2010 06:40:56 PM - System Checkpoint

RP83: 10/11/2010 04:59:13 PM - System Checkpoint

RP84: 10/12/2010 05:26:51 PM - System Checkpoint

RP85: 10/14/2010 08:05:05 PM - System Checkpoint

RP86: 10/15/2010 03:00:46 AM - Software Distribution Service 3.0

RP87: 10/16/2010 08:42:30 AM - System Checkpoint

RP88: 10/17/2010 11:38:17 AM - System Checkpoint

RP89: 10/18/2010 12:21:24 PM - System Checkpoint

RP90: 10/19/2010 07:15:29 PM - System Checkpoint

RP91: 10/20/2010 07:18:48 PM - System Checkpoint

RP92: 10/22/2010 05:02:44 PM - System Checkpoint

RP93: 10/23/2010 07:40:42 PM - System Checkpoint

RP94: 10/26/2010 05:25:18 PM - System Checkpoint

RP95: 10/28/2010 05:31:47 PM - System Checkpoint

RP96: 10/29/2010 07:43:08 PM - System Checkpoint

RP97: 10/31/2010 09:26:43 AM - System Checkpoint

RP98: 11/1/2010 07:08:46 PM - System Checkpoint

RP99: 11/2/2010 07:23:59 PM - System Checkpoint

RP100: 11/5/2010 06:54:27 PM - System Checkpoint

RP101: 11/7/2010 07:49:06 AM - System Checkpoint

RP102: 11/9/2010 05:10:03 PM - System Checkpoint

RP103: 11/10/2010 05:16:08 PM - System Checkpoint

RP104: 11/10/2010 08:28:27 PM - Software Distribution Service 3.0

RP105: 11/11/2010 08:35:39 PM - System Checkpoint

RP106: 11/13/2010 07:24:55 AM - System Checkpoint

RP107: 11/14/2010 07:42:26 AM - System Checkpoint

RP108: 11/15/2010 07:05:38 PM - System Checkpoint

RP109: 11/16/2010 08:38:10 PM - System Checkpoint

RP110: 11/17/2010 09:08:34 PM - System Checkpoint

RP111: 11/19/2010 08:34:31 PM - System Checkpoint

RP112: 11/21/2010 08:59:58 AM - System Checkpoint

RP113: 11/22/2010 01:01:07 PM - System Checkpoint

RP114: 11/23/2010 04:57:35 PM - System Checkpoint

RP115: 11/24/2010 06:13:15 PM - System Checkpoint

RP116: 11/26/2010 08:32:28 AM - System Checkpoint

RP117: 11/27/2010 09:02:57 AM - System Checkpoint

RP118: 11/28/2010 09:30:52 AM - System Checkpoint

RP119: 12/2/2010 08:47:26 PM - System Checkpoint

RP120: 12/4/2010 08:38:51 AM - System Checkpoint

RP121: 12/5/2010 01:34:14 PM - System Checkpoint

RP122: 12/6/2010 09:04:27 PM - System Checkpoint

RP123: 12/9/2010 05:05:45 PM - System Checkpoint

RP124: 12/10/2010 08:25:31 PM - System Checkpoint

RP125: 12/12/2010 07:45:50 AM - System Checkpoint

RP126: 12/13/2010 05:17:38 PM - System Checkpoint

RP127: 12/14/2010 08:08:19 PM - Software Distribution Service 3.0

RP128: 12/15/2010 08:27:21 PM - System Checkpoint

RP129: 12/16/2010 08:33:22 PM - System Checkpoint

RP130: 12/18/2010 08:56:57 AM - System Checkpoint

RP131: 12/18/2010 11:33:44 AM - Software Distribution Service 3.0

RP132: 12/21/2010 10:57:20 AM - System Checkpoint

==== Installed Programs ======================

Acrobat.com

Ad-Aware

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.3.3

AiO_Scan_CDA

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft Software Suite

Bonjour

BroadJump Client Foundation

CA Anti-Spam

CA Anti-Spyware

CA Anti-Virus

CA Internet Security Suite

CA Pest Patrol Realtime Protection

CCleaner

Conexant D850 56K V.9x DFVc Modem

D-Link PCI Fast Ethernet Adapter

Dell ResourceCD

Desktop Maestro 3.0

DVD Shrink 3.2

Frontline Registry Cleaner

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

HP Photosmart, Officejet and Deskjet 7.0.A

Intel® Extreme Graphics 2 Driver

iTunes

Java Auto Updater

Java 6 Update 20

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Office Professional Edition 2003

Microsoft Primary Interoperability Assemblies 2005

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Move Networks Media Player for Internet Explorer

Mozilla Firefox (3.0.19)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Napster

Napster Burn Engine

Nero - Burning Rom

Nero 7 Essentials

Nikon View 6

PowerDVD 5.3

QFolder

QuickTime

RealPlayer

RealUpgrade 1.0

RPS CRT

Scan

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953838)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956390)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB963027)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969897)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972260)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974455)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB976325)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

SoundMAX

Spybot - Search & Destroy

SpywareBlaster 4.1

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB975364)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB980182)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Update for Windows XP (KB976749)

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

VoiceOver Kit

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

12/21/2010 11:45:22 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

12/21/2010 11:39:02 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

12/21/2010 11:38:02 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

12/21/2010 11:37:32 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

12/21/2010 11:37:02 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

12/20/2010 08:55:28 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde

12/20/2010 08:55:18 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.

12/19/2010 07:33:11 AM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service UmxAgent with arguments "-Service" in order to run the server: {9B58BB29-3745-44A2-9E8B-B09C1DB53243}

12/19/2010 07:32:17 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service PPCtlPriv with arguments "" in order to run the server: {F974178A-A284-440A-BEFC-5B0D11BCDB68}

12/19/2010 07:32:17 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service CaCCProvSP with arguments "" in order to run the server: {AACF4A1C-BC69-4359-9518-DF3F77E462BF}

12/19/2010 07:31:18 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

12/19/2010 07:31:02 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

12/19/2010 07:30:46 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec KmxAgent KmxStart MRxSmb NetBIOS NetBT OMCI RasAcd Rdbss Tcpip VET-FILT VET-REC VETEFILE VETMONNT

12/19/2010 07:30:46 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

12/19/2010 07:30:46 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.

12/19/2010 07:30:46 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

12/19/2010 07:30:46 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

12/19/2010 07:30:46 AM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

12/19/2010 07:30:46 AM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

12/19/2010 07:30:41 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service UmxPol with arguments "-Service" in order to run the server: {4C89C3FD-5F94-4678-BBB5-F64759C3C54A}

12/16/2010 05:05:38 PM, error: Service Control Manager [7022] - The SSDP Discovery Service service hung on starting.

12/16/2010 05:05:38 PM, error: Service Control Manager [7001] - The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: After starting, the service hung in a start-pending state.

12/16/2010 05:05:37 PM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

12/16/2010 04:33:58 PM, error: Service Control Manager [7000] - The PPCtlPriv service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

12/16/2010 04:33:57 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PPCtlPriv service to connect.

12/16/2010 04:33:55 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service PPCtlPriv with arguments "" in order to run the server: {F974178A-A284-440A-BEFC-5B0D11BCDB68}

12/15/2010 04:30:36 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.

12/15/2010 04:30:36 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

12/15/2010 04:30:34 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}

12/15/2010 04:28:17 PM, error: Service Control Manager [7000] - The CaCCProvSP service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

12/15/2010 04:28:16 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the CaCCProvSP service to connect.

12/15/2010 04:28:11 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service CaCCProvSP with arguments "" in order to run the server: {AACF4A1C-BC69-4359-9518-DF3F77E462BF}

12/15/2010 04:25:34 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

12/15/2010 04:25:34 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

12/15/2010 04:24:12 PM, error: Service Control Manager [7000] - The Security Services Driver (x86) service failed to start due to the following error: The system cannot find the file specified.

==== End Of File ===========================

feverdog71 · December 22, 2010

OTL logfile created on: 12/22/2010 09:00:20 AM - Run 1

OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\Owner\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 193.00 Mb Available Physical Memory | 38.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 46.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 71.54 Gb Total Space | 35.40 Gb Free Space | 49.49% Space Free | Partition Type: NTFS

Computer Name: THOMAS-9F9D90E9 | User Name: Owner | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/22 08:57:47 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

PRC - [2010/12/21 09:42:55 | 000,377,856 | ---- | M] (Optimization Corporation) -- C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe

PRC - [2010/12/21 09:42:27 | 000,534,016 | ---- | M] (MOSE software) -- C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe

PRC - [2010/06/30 15:52:56 | 000,374,096 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\casc.exe

PRC - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010/05/27 16:16:41 | 000,288,080 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe

PRC - [2010/05/27 16:16:41 | 000,271,696 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\cavrid.exe

PRC - [2010/05/27 16:16:40 | 000,222,544 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe

PRC - [2010/05/27 16:16:39 | 000,333,136 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe

PRC - [2010/03/08 16:52:51 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2010/03/01 20:03:24 | 001,029,456 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

PRC - [2010/03/01 20:03:24 | 000,524,632 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

PRC - [2009/11/10 16:34:47 | 000,259,312 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

PRC - [2009/11/10 16:34:47 | 000,128,240 | ---- | M] (Computer Associates International, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe

PRC - [2009/09/16 18:36:46 | 000,014,064 | ---- | M] (CA) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.517\QOELoader.exe

PRC - [2009/07/29 12:49:14 | 000,283,888 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe

PRC - [2009/06/15 10:32:26 | 000,760,664 | ---- | M] (CA) -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

PRC - [2009/04/01 09:45:52 | 000,875,000 | ---- | M] (CA) -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

PRC - [2009/04/01 09:45:52 | 000,207,352 | ---- | M] (CA) -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

PRC - [2009/03/05 15:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/12/04 10:47:38 | 000,144,696 | ---- | M] (Computer Associates International, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe

PRC - [2006/03/03 20:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe

PRC - [2004/10/14 13:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe

========== Modules (SafeList) ==========

MOD - [2010/12/22 08:57:47 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

MOD - [2009/09/16 18:36:46 | 000,087,280 | ---- | M] (CA) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.517\QOEHook.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)

SRV - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010/05/27 16:16:41 | 000,288,080 | ---- | M] (CA, Inc.) [Auto | Running] -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe -- (VETMSGNT)

SRV - [2010/05/27 16:16:40 | 000,222,544 | ---- | M] (CA, Inc.) [On_Demand | Running] -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe -- (PPCtlPriv)

SRV - [2010/03/01 20:03:24 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2009/11/10 16:34:47 | 000,259,312 | ---- | M] (CA, Inc.) [On_Demand | Running] -- C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe -- (CaCCProvSP)

SRV - [2009/11/10 16:34:47 | 000,128,240 | ---- | M] (Computer Associates International, Inc.) [Auto | Running] -- C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe -- (ccSchedulerSVC)

SRV - [2009/07/29 12:49:14 | 000,283,888 | ---- | M] (CA, Inc.) [Auto | Running] -- C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe -- (ITMRTSVC)

SRV - [2009/06/15 10:32:26 | 000,760,664 | ---- | M] (CA) [Auto | Running] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe -- (UmxCfg)

SRV - [2009/04/01 09:45:52 | 000,875,000 | ---- | M] (CA) [Auto | Running] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe -- (UmxAgent)

SRV - [2009/04/01 09:45:52 | 000,207,352 | ---- | M] (CA) [Auto | Running] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe -- (UmxPol)

SRV - [2007/12/04 10:47:38 | 000,144,696 | ---- | M] (Computer Associates International, Inc.) [Auto | Running] -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe -- (CAISafe)

SRV - [2006/03/03 20:03:10 | 000,069,632 | ---- | M] (HP) [unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\DRIVERS\rp_skt32.sys -- (RPSKT) Security Services Driver (x86)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)

DRV - [2010/06/03 16:52:44 | 000,746,216 | ---- | M] (Computer Associates International, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\vetefile.sys -- (VETEFILE)

DRV - [2010/06/03 16:52:44 | 000,130,280 | ---- | M] (Computer Associates International, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\veteboot.sys -- (VETEBOOT)

DRV - [2009/10/29 15:59:08 | 000,161,008 | ---- | M] (Computer Associates International, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\vetmonnt.sys -- (VETMONNT)

DRV - [2009/10/29 15:59:08 | 000,021,488 | ---- | M] (Computer Associates International, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\vetfddnt.sys -- (VETFDDNT)

DRV - [2009/10/29 15:59:08 | 000,021,104 | ---- | M] (Computer Associates International, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\vet-rec.sys -- (VET-REC)

DRV - [2009/10/29 15:59:07 | 000,026,352 | ---- | M] (Computer Associates International, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\vet-filt.sys -- (VET-FILT)

DRV - [2009/06/08 10:02:02 | 000,108,024 | ---- | M] (CA) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\kmxstart.sys -- (KmxStart)

DRV - [2009/04/25 19:04:36 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)

DRV - [2009/04/01 09:45:50 | 000,205,304 | ---- | M] (CA) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KmxCfg.sys -- (KmxCfg)

DRV - [2009/04/01 09:45:50 | 000,073,720 | ---- | M] (CA) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\KmxAgent.sys -- (KmxAgent)

DRV - [2009/03/10 12:57:01 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)

DRV - [2009/03/10 12:56:52 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)

DRV - [2004/12/01 19:33:00 | 000,043,008 | R--- | M] (D-Link ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dlkfet5b.sys -- (FETNDISB)

DRV - [2004/09/17 08:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)

DRV - [2004/03/22 11:24:00 | 000,004,272 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bvrp_pci.sys -- (bvrp_pci)

DRV - [2003/11/17 14:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)

DRV - [2003/11/17 14:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2003/11/17 14:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)

DRV - [2001/04/16 13:54:26 | 000,044,227 | ---- | M] (ahead software gmbh

im stoeckmaedle 6

76307 karlsbad, germany

Fax: ++49-7248-911-888

e-mail: info@nero.com) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NeroCD2k.sys -- (NeroCd2k)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=7.0unattached&bm=ho_central"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C}:1.9.1

FF - HKLM\software\mozilla\Firefox\Extensions\\{720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C}: C:\Documents and Settings\Owner\Local Settings\Application Data\{720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C} [2010/12/18 11:23:17 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/05 14:47:09 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/14 19:47:02 | 000,000,000 | ---D | M]

[2009/01/19 20:16:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions

[2010/06/26 06:16:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\3vhpv9aw.default\extensions

[2010/04/07 19:10:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\3vhpv9aw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/12/19 09:21:23 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/06/23 15:40:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010/06/23 15:38:42 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/06/20 09:51:14 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)

O4 - HKLM..\Run: [CAPPActiveProtection] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe (CA, Inc.)

O4 - HKLM..\Run: [CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)

O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe (CA, Inc.)

O4 - HKLM..\Run: [KernelFaultCheck] File not found

O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [QOELOADER] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-7.0.0.517\QOELoader.exe (CA)

O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\Run: [bKNILMsCGe.exe] C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe (MOSE software)

O4 - HKCU..\Run: [qGy6kOdgyFFL] C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe (Optimization Corporation)

O4 - HKCU..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)

O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2...78f/wvc1dmo.cab (Reg Error: Key error.)

O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A...01F/wmvadvd.cab (Reg Error: Key error.)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1223159523942 (MUWebControl Class)

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 97.64.168.12 97.64.183.165

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O20 - Winlogon\Notify\PFW: DllName - UmxWnp.Dll - C:\WINDOWS\System32\UmxWNP.dll (CA)

O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/10/03 20:51:12 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{45fc2ef5-c0e1-11dd-a693-001cf0ca2f1c}\Shell - "" = AutoRun

O33 - MountPoints2\{45fc2ef5-c0e1-11dd-a693-001cf0ca2f1c}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{45fc2ef5-c0e1-11dd-a693-001cf0ca2f1c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/22 08:57:46 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

[2010/12/22 08:41:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe

[2010/12/22 07:47:33 | 000,459,264 | ---- | C] (MediaPlayer software) -- C:\Documents and Settings\All Users\Application Data\Ygguuiaahy.dll

[2010/12/21 13:02:42 | 007,622,280 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe

[2010/12/21 09:42:55 | 000,377,856 | ---- | C] (Optimization Corporation) -- C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe

[2010/12/21 09:42:37 | 000,534,016 | ---- | C] (MOSE software) -- C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe

[2010/12/21 09:40:48 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Owner\Desktop\test.exe

[2010/12/20 19:07:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FrontLine Registry Cleaner

[2010/12/20 19:06:57 | 000,000,000 | ---D | C] -- C:\Program Files\Frontline Registry Cleaner

[2010/12/18 11:23:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C}

[2010/12/18 11:20:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\dOhOb06511

[2010/12/14 17:17:03 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys

[2010/12/14 17:14:04 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe

[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/22 08:57:47 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

[2010/12/22 08:49:10 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/12/22 08:39:46 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/12/22 08:39:32 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/12/22 08:35:24 | 000,000,216 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\dfrg

[2010/12/22 08:35:24 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\dfrgr

[2010/12/22 08:32:00 | 000,459,264 | ---- | M] (MediaPlayer software) -- C:\Documents and Settings\All Users\Application Data\Ygguuiaahy.dll

[2010/12/22 08:30:13 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1409082233-1417001333-725345543-1003.job

[2010/12/22 08:29:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/12/22 08:29:49 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys

[2010/12/22 08:26:41 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\gmer.exe

[2010/12/22 08:20:20 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Microsoft Office Word 2003.lnk

[2010/12/22 08:15:36 | 000,624,128 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr

[2010/12/22 08:11:45 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Owner\defogger_reenable

[2010/12/22 08:10:43 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k7

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k6

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k5

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k4

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k3

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k2

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k1

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k0

[2010/12/21 22:46:39 | 000,000,192 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k0

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k7

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k6

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k5

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k4

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k3

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k2

[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k1

[2010/12/21 19:59:25 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/12/21 13:02:40 | 007,622,280 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe

[2010/12/21 13:01:07 | 000,660,815 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\rkill.exe

[2010/12/21 09:44:01 | 000,000,823 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Disk Repair.lnk

[2010/12/21 09:43:30 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL

[2010/12/21 09:42:55 | 000,377,856 | ---- | M] (Optimization Corporation) -- C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe

[2010/12/21 09:42:27 | 000,534,016 | ---- | M] (MOSE software) -- C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe

[2010/12/20 21:16:27 | 000,014,006 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\cc_20101220_211617.reg

[2010/12/20 20:10:46 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2010/12/20 19:08:00 | 000,000,436 | ---- | M] () -- C:\WINDOWS\tasks\FrontLine Registry Cleaner Scheduled Scan - Owner.job

[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/12/20 18:04:05 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Emomozecahexofip.bin

[2010/12/20 17:44:43 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/12/18 11:23:31 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Dcuqutehobek.dat

[2010/12/16 17:32:26 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2010/12/16 17:23:05 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1409082233-1417001333-725345543-1003.job

[2010/12/15 20:38:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/12/15 16:23:47 | 000,192,976 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/12/14 20:15:46 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/12/06 19:31:17 | 000,002,758 | ---- | M] () -- C:\WINDOWS\cdplayer.ini

[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/22 08:26:39 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\gmer.exe

[2010/12/22 08:15:35 | 000,624,128 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr

[2010/12/22 08:11:45 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Owner\defogger_reenable

[2010/12/22 08:10:53 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe

[2010/12/21 13:43:26 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/12/21 13:01:05 | 000,660,815 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\rkill.exe

[2010/12/21 12:07:38 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\dfrgr

[2010/12/21 12:07:35 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\dfrg

[2010/12/21 09:44:01 | 000,000,823 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Disk Repair.lnk

[2010/12/21 09:43:30 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL

[2010/12/20 21:16:24 | 000,014,006 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\cc_20101220_211617.reg

[2010/12/20 19:35:44 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/12/20 19:08:00 | 000,000,436 | ---- | C] () -- C:\WINDOWS\tasks\FrontLine Registry Cleaner Scheduled Scan - Owner.job

[2010/12/20 17:44:39 | 534,827,008 | -HS- | C] () -- C:\hiberfil.sys

[2010/12/18 11:23:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Emomozecahexofip.bin

[2010/12/18 11:23:31 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Dcuqutehobek.dat

[2010/12/14 20:09:32 | 000,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2010/04/04 15:45:09 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009/08/05 19:38:01 | 000,000,021 | ---- | C] () -- C:\WINDOWS\CS_setup.ini

[2009/01/16 19:09:20 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008/10/27 19:43:43 | 000,002,758 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2008/10/04 19:21:43 | 000,011,776 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008/10/04 16:02:46 | 000,061,440 | R--- | C] () -- C:\WINDOWS\System32\vuins32.dll

[2008/10/03 21:19:25 | 000,004,272 | R--- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys

[2008/10/03 21:15:28 | 000,002,806 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

[2008/10/03 13:43:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2006/01/04 02:12:04 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll

[2004/08/12 07:58:15 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll

[2004/08/12 07:58:15 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll

[2004/08/12 07:58:15 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll

[2004/08/12 07:58:15 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll

[2004/08/12 07:58:15 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll

[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001/07/07 02:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

========== LOP Check ==========

[2009/09/16 18:40:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA

[2008/10/22 15:21:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\cdebubch

[2010/12/18 11:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\dOhOb06511

[2010/12/20 19:07:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FrontLine Registry Cleaner

[2008/11/19 19:13:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster

[2010/08/19 19:45:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/06/13 14:53:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Update

[2010/06/05 18:25:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Visual Networks

[2010/07/04 19:04:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2009/01/24 19:57:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

[2008/11/04 20:17:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Desktop Maestro

[2009/08/05 19:42:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Nikon

[2010/12/20 20:10:46 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

[2010/12/20 19:08:00 | 000,000,436 | ---- | M] () -- C:\WINDOWS\Tasks\FrontLine Registry Cleaner Scheduled Scan - Owner.job

========== Purity Check ==========

========== Files - Unicode (All) ==========

[2009/04/24 21:00:37 | 000,000,040 | ---- | M] ()(C:\WINDOWS\System32\????????????????????4???????????????????????) -- C:\WINDOWS\System32\?????????????????????????

???????????????????

[2009/04/24 21:00:37 | 000,000,040 | ---- | C] ()(C:\WINDOWS\System32\????????????????????4???????????????????????) -- C:\WINDOWS\System32\?????????????????????????

???????????????????

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0D786AE3

< End of report >

negster22 · December 22, 2010

Hi feverdog71,

The OTL log gave me a good idea of the extent to which HDDTools has infected your system so we'll try to reverse that now.

You have a lot of security programs running that are known to interfere with fixes!!

It's essential that You disable Adwatch and Teatimer for the duration of the clean-up or any fixes we make will have no impact or be reversed!! They keep the good out along with the bad!!

First, disable Spybot's TeaTimer or any fixes we make in HjiackThis will be reversed. This is a two step process.

First:

- Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)

- Choose Exit Spybot S&D Resident

Second:

- Open Spybot S&D

- Click Mode, check Advanced Mode

- Go To Left Panel, Click Tools, then also in left panel, click Resident

Uncheck the following:Resident "TeaTimer" (Protection of over-all system settings) Active.

Disable AD-AWARE AD-WATCH

* Start Ad-Aware

* Click the Ad-Watch tab

* Click the Settings button

* Ensure all highlighted options bellow are unchecked:(some settings may be used or changed only in the Pro version)

Under the General tab

o Processes Protection

o Registry Protection

o Network Protection

Under the Detection Layers tab:

o Spyware heuristics

o AntiVirus engine

* OK your way out, and close the main Ad-Aware window.

* Shut down Ad-Aware and Ad-Watch Live! by right clicking on the system tray icon, and selecting Exit Ad-Aware.

* OK the change.

We're going to rerun OTL with a script that fixes the infected load points and files on your system as follows:

Disable the active protection component of your antivirus by following the directions that apply here:
http://www.bleepingcomputer.com/forums/topic114351.html
Close all open windows on the Task Bar. Click the OTL icon (for Vista or Win 7, right click the icon and Run as Administrator) to restart the OTL program.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:File
C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe
C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe
C:\Documents and Settings\All Users\Application Data\Ygguuiaahy.dll
C:\Documents and Settings\Owner\Desktop\test.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\{720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C}
C:\Documents and Settings\All Users\Application Data\dOhOb06511
:OTL
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [bKNILMsCGe.exe] C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe (MOSE software)
O4 - HKCU..\Run: [qGy6kOdgyFFL] C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe (Optimization Corporation)
  ipconfig /flushdns /c
 :Commands
	  [purity]
	  [resethosts]
	  [emptytemp]
	  [emptyflash]
	  [createrestorepoint]
	  [reboot]

Now click Run Fix and let the program run uninterrupted.
Let the program run unhindered, and reboot the PC when it is done
Copy/Paste OTL Log in your next reply

Do You have any idea what these multiple "k" drivers are as they were installed the same time your system was infected and their quantity and creation date makes them appear suspicious?:

[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k7
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k6
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k5
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k4
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k3
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k2
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k1
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k0
[2010/12/21 22:46:39 | 000,000,192 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k0
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k7
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k6
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k5
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k4
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k3
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k2
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k1

feverdog71 · December 22, 2010

I would say the k drivers were part of the virus. Nothing I intentionally loaded.

So far so good. Looks like it's gone. I was getting that wave sound every 30 seconds or so (sounds like a suction cup for lack of a better description) but I ran my spyware program and seems to have gotten rid of it.

I went ahead and enabled my anti-virus so let me know if I will need to disable it for anything else.

Here's the report ......

All processes killed

Error: Unable to interpret <:File> in the current context!

Error: Unable to interpret <C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe> in the current context!

Error: Unable to interpret <C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe> in the current context!

Error: Unable to interpret <C:\Documents and Settings\All Users\Application Data\Ygguuiaahy.dll> in the current context!

Error: Unable to interpret <C:\Documents and Settings\Owner\Desktop\test.exe> in the current context!

Error: Unable to interpret <C:\Documents and Settings\Owner\Local Settings\Application Data\{720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C}> in the current context!

Error: Unable to interpret <C:\Documents and Settings\All Users\Application Data\dOhOb06511> in the current context!

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TkBellExe deleted successfully.

C:\Program Files\Common Files\Real\Update_OB\realsched.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\bKNILMsCGe.exe deleted successfully.

C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\qGy6kOdgyFFL deleted successfully.

C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe moved successfully.

========== COMMANDS ==========

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 2801698 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->FireFox cache emptied: 3084640 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 41620 bytes

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 80693095 bytes

->Flash cache emptied: 8765 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 197543913 bytes

->Flash cache emptied: 15173 bytes

User: Owner

->Temp folder emptied: 451696415 bytes

->Temporary Internet Files folder emptied: 145271287 bytes

->Java cache emptied: 538 bytes

->FireFox cache emptied: 38314328 bytes

->Flash cache emptied: 85074 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2172533 bytes

%systemroot%\System32 .tmp files removed: 587281 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 3120489 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 50206216 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 7224 bytes

Total Files Cleaned = 931.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

->Flash cache emptied: 0 bytes

User: LocalService

->Flash cache emptied: 0 bytes

User: NetworkService

->Flash cache emptied: 0 bytes

User: Owner

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Error starting restore point: System Restore is disabled.

Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.18.0 log created on 12222010_125242

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

negster22 · December 22, 2010

Good Job!!

Please keep Teatimer and Adwatch disabled.

We're going to rerun OTL with a new script to make some more fixes as follows:

Disable the active protection component of your antivirus by following the directions that apply here:
http://www.bleepingcomputer.com/forums/topic114351.html
Close all open windows on the Task Bar. Click the OTL icon (for Vista or Win 7, right click the icon and Run as Administrator) to restart the OTL program.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Files
C:\Documents and Settings\All Users\Application Data\qGy6kOdgyFFL.exe
C:\Documents and Settings\All Users\Application Data\bKNILMsCGe.exe
C:\Documents and Settings\All Users\Application Data\Ygguuiaahy.dll
C:\Documents and Settings\Owner\Desktop\test.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\{720E9D1B-4A29-4186-8EC8-1ABF64ABAF7C}
C:\Documents and Settings\All Users\Application Data\dOhOb06511
:OTL
[2010/12/21 12:07:38 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\dfrgr
[2010/12/21 12:07:35 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\dfrg
[2010/12/21 09:44:01 | 000,000,823 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Disk Repair.lnk
[2010/12/18 11:23:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Emomozecahexofip.bin
[2010/12/18 11:23:31 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Dcuqutehobek.dat
2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k7
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k6
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k5
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k4
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k3
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k2
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k1
[2010/12/21 22:46:40 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k0
[2010/12/21 22:46:39 | 000,000,192 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k0
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k7
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k6
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k5
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k4
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k3
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k2
[2010/12/21 22:46:39 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k1
:Commands
[reboot]

Now click Run Fix and let the program run uninterrupted.
Let the program run unhindered, and reboot the PC when it is done
Copy/Paste OTL Log in your next reply

Is FrontLine Registry Cleaner something you installed because I do no advocate the use of Registry Cleaners as they usually do more harm than good and they are absolutely unnecessary!

Please post the new OTL log and run a new and fully updated MBAM scan (there's a new version out so You may have to upgrade internally) and post the MBAM log!!!

feverdog71 · December 22, 2010

OTL log .............