Help Getting Started - having issues

dmb8886 · April 11, 2011

Let me start by saying I have to run my computer in Safe Mode. It goes kind of crazy when I run it in normal mode and I have trouble being able to run most programs. I haven't used regular mode in a while and don't remember specifics, but I am hoping to troubleshoot using safe made without networking (had some issues with safe w/networking as well). So I am using a separate computer to download the necessary programs and then I use a USB to transfer the downloaded program files to my infected computer.

So I installed MBAM and tried running quick scan and it just disappeared almost right away. Program closed. I saw some information regarding this issue but didn't quite understand. I have McAfee on my system but the instructions that i thought I was supposed to reference:

http://forums.malwarebytes.org/index.php?showtopic=10138&st=0&p=162098entry162098

Didn't make much sense to me as I don't see where I would disable "Access Protection". I'm not even sure this is what I should be looking at. Should I continue with the rest of the instructions on the "infected what do I do now" page, so DeFogger, DDS, and GMER?

Thanks in advance!

dmb8886 · April 12, 2011

Still need assistance.

But wanted to update the situation. From looking through the forum and being anxious to start doing something, I looked around and it seemed like the directions were to continue on with the following steps in the instructions even if you can't do something.

So I did the following all once again in Safe Mode. I Disabled CD-ROM Emulation Software with DeFogger. Then I ran the DDS script. See attached files. Then I ran the GMER rootkit and it was taking hours and hours and ran overnight, it must have froze my computer with a "virtual memory too low" error. So I wasn't able to save that information and didn't try again since it take literally like a half day for it to scan all the files.

Below is the contents of the DDS.txt, and I have attached the zip file for the attach.txt.

Thanks!

--------------------

.

DDS (Ver_11-03-05.01) - NTFSx86 MINIMAL

Run by Steve H at 18:00:42.15 on Mon 04/11/2011

Internet Explorer: 8.0.6001.18702

AV: McAfee VirusScan *Disabled/Outdated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *Enabled*

.

============== Running Processes ===============

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://www.dell4me.com/myway

mSearch Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

mWinlogon: Shell=explorer.exe rundll32.exe

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll

BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6253\SiteAdv.dll

BHO: : {2678e36f-5420-4945-b34f-a1ab2f9a6ff6} - c:\program files\msn gaming zone\meqos83122.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_04\bin\ssv.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6253\SiteAdv.dll

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl

uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [EPSON Artisan 700(Network)] c:\windows\system32\spool\drivers\w32x86\3\e_fatiena.exe /fu "c:\windows\temp\E_S8D.tmp" /EF "HKCU"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre1.6.0_04\bin\jusched.exe"

mRun: [intelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe

mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [EPSON Stylus Photo 820 Series] c:\windows\system32\spool\drivers\w32x86\3\E_S0EIC1.EXE /P29 "EPSON Stylus Photo 820 Series" /O6 "USB002" /M "Stylus Photo 820"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey

mRun: [siteAdvisor] c:\program files\siteadvisor\6172\SiteAdv.exe

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [DropBoxUtility] "c:\program files\dropbox\dropbox\DropBox.exe" /s

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRunOnce: [innoSetupRegFile.0000000001] "c:\windows\is-4NL2M.exe" /REG

mRunOnce: [innoSetupRegFile.0000000002] "c:\windows\is-62QBE.exe" /REG /REGSVRMODE

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\docume~1\steveh~1\startm~1\programs\startup\pmbmed~1.lnk - c:\program files\sony\sony picture utility\pmbcore\SPUVolumeWatcher.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dlbcserv.lnk - c:\program files\dell photo printer 720\dlbcserv.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wirele~1.lnk - c:\program files\dell wireless\PRISMCFG.exe

uPolicies-system: EnableProfileQuota = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\progra~1\yahoo!\messen~1\YPager.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6253\SiteAdv.dll

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: 75.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

=============== File Associations ===============

.

.com=csfile

.

=============== Created Last 30 ================

.

2011-04-10 23:47:37 -------- d-----w- c:\docume~1\steveh~1\applic~1\Malwarebytes

2011-04-10 23:47:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-10 23:47:02 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2011-04-10 23:46:57 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-04-10 23:46:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-04-10 20:30:55 709456 ----a-w- c:\windows\is-62QBE.exe

.

==================== Find3M ====================

.

============= FINISH: 18:03:01.64 ===============

Attach.zip

Elise · April 13, 2011

Hi, and :welcome:

Please Download Rootkit Unhooker Save it to your desktop.

Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
Wait till the scanner has finished and then click File, Save Report.
Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note - if you get the following warning, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Click on Cancel, then Accept.

dmb8886 · April 13, 2011

I got an error message when double clicking on the application saying "Error loading/opening driver" and my only option is OK an then it doesn't open.

Elise · April 13, 2011

Yes, I thought that might happen. Please try this instead.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

dmb8886 · April 13, 2011

Since I'm using Safe mode, and it asked about a windows recover console, should I restart it with "safe mode with networking"?

Elise · April 13, 2011

Yes, use that. If it will not work. use normal safe mode and just opt not to install the recovery console.

dmb8886 · April 13, 2011

Started running and got through about 30 some odd steps I thin, then it started deleting some files. Then it deleted about 10 folders and seemed to stop on that step. I waited a while, but nothing happened. Should I close the window? And if so should I re-run it and start again?

Elise · April 14, 2011

Give it a bit more time and if it still hangs, reboot manually. It should run again at startup.

dmb8886 · April 14, 2011

Hi Elise,

It didn't run again on startup, so I re-ran the program. Something I noticed if I hovered my mouse over the combofix icon on my system tray it says this:

"Warning! Y ou have exceeded your profile space by 1011665 KB"

It also prompted me to download a newer version of combofix but I said no since I just downloaded it yesterday and there was nothing about that in the instructions you posted. This time it seemed to get stuck at "completed stage 50", so I closed it and rebooted again and again it didn't run on startup. What should I do next? Should I try in safe mode without networking? Thanks!

dmb8886 · April 14, 2011

Also to note, when it booted up again that same combofix icon was in my system try with that same warning, only the number was slightly different this time.

dmb8886 · April 14, 2011

Wow, so I went to restart again and I got a message saying "Enumerating Profile Space" in a windows with all these files going crazy.

It says "Profile Storage Space" with a message saying "You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage."

Then below that is shows the files in my profile by file name and size. My only option is to click on the "OK" button.

Elise · April 14, 2011

This means you have stored too many personal data.

Try to save pictures/music or other personal data outside your profile (documents and settings folder).

dmb8886 · April 14, 2011

It was only like 7-8 GB in My Documents and I have a 71 GB hard drive, does that make sense?

It says Current Profile size is 2,413,737 and that my maximum profile size is 10,240 KB. How is that possible? So I can only have 10MB?

dmb8886 · April 14, 2011

I read in some forums to create a file in notepad called undopolicy.reg with the following:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"EnableProfileQuota"=-

"ProfileQuotaMessage"=-

"MaxProfileSize"=-

"IncludeRegInProQuota"=-

"WarnUser"=-

"WarnUserTimeout"=-

Then save and run and it will fix this issue, do you approve to do this?

Elise · April 14, 2011

Is this your own computer?

dmb8886 · April 14, 2011

Yes, home computer, my own. Not even sure why I have profiles set up, must have been an accident a while back something I did.

Elise · April 14, 2011

You can run the proposed registry script, but please be very careful when editing the registry and never do so without proper backup.

BACKUP THE REGISTRY

---------------------------

Backup Your Registry with ERUNT

Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

dmb8886 · April 14, 2011

I defer to you, do you think that's the best next step? If so I will do it. Otherwise I'm all ears.

Elise · April 14, 2011

You can safely do that if you don't want to use the Profile quota anymore. XP has not really an easy way to do this. But, if you want to do it "two in one", I can give you a combofix script for it. In that case a separate backup with Erunt is not necessary (its included).

First download combofix as instructed before, then run it, see steps below.

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:


Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableProfileQuota"=-
"ProfileQuotaMessage"=-
"MaxProfileSize"=-
"IncludeRegInProQuota"=-
"WarnUser"=-
"WarnUserTimeout"=-

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

dmb8886 · April 15, 2011

Sorry I ended up running the original registry editor after backing up with ERUNT. It solved that problem, so I was able to restart, however I then re-ran combofix again left for a while and came back and it was stuck on stage 50 again. So I tried for the first time re-starting and running in safe mode without networking, and same thing, stuck on Stage 50.

So after all that, restarted again in safe mode w/networking. I now attempted to do what you wrote above with the CFScript.txt and dragged it into ComboFix.exe (I actually deleted the combofix file I had been using and downloaded a new version just to start fresh). And yet AGAIN its stuck on completed stage 50. So annoying!!

What do I do? I can't seem to get anywhere.

Elise · April 15, 2011

In that case, please run the following scan. Run it from Safe Mode, but try to use your own useraccount.

OTL

-----

Please download OTL from one of the following mirrors:

- This is THE Mirror

[*]Save it to your desktop.

[*]Double click on the icon on your desktop.

[*]Click the "Scan All Users" checkbox.

[*]Push the Quick Scan button.

[*]Two reports will open, copy and paste them in a reply here:

OTListIt.txt <-- Will be opened
Extra.txt <-- Will be minimized

dmb8886 · April 15, 2011

Hi Elise, the name of the first text file was OTL.txt instead of OTListlt.txt, hope that doesn't make a difference. Also one thing to note, since I noticed the file below and some others talk about "last 30 days", I got infected like a year or two ago and haven't used my computer for a long time, not sure if that matter but just want to let you know all possible information. Here are the reports:

OTL logfile created on: 4/15/2011 8:47:43 AM - Run 1

OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Steve H\Desktop

Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 365.00 Mb Available Physical Memory | 72.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 95.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 71.10 Gb Total Space | 14.76 Gb Free Space | 20.77% Space Free | Partition Type: NTFS

Drive E: | 495.22 Mb Total Space | 202.93 Mb Free Space | 40.98% Space Free | Partition Type: FAT

Computer Name: STEVE | User Name: Steve H | Logged in as Administrator.

Boot Mode: SafeMode | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/15 09:43:58 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve H\Desktop\OTL.exe

PRC - [2009/01/08 21:30:26 | 000,797,864 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe

PRC - [2007/06/13 05:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2011/04/15 09:43:58 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve H\Desktop\OTL.exe

MOD - [2006/08/25 10:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

MOD - [2001/07/07 18:35:24 | 000,106,547 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\SunnComm Shared\msscript.OCX

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (Viewpoint Manager Service)

SRV - File not found [Disabled | Stopped] -- -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)

SRV - [2009/04/01 14:21:30 | 000,365,072 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)

SRV - [2009/03/25 11:05:48 | 000,144,704 | ---- | M] (McAfee, Inc.) [unknown | Stopped] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)

SRV - [2009/03/24 00:03:18 | 000,606,736 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)

SRV - [2009/03/19 11:42:02 | 000,884,360 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)

SRV - [2009/02/06 17:02:14 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009/01/09 12:31:16 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- c:\program files\common files\mcafee\mna\mcnasvc.exe -- (McNASvc)

SRV - [2009/01/09 10:22:10 | 000,026,640 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\McAfee\MSK\MskSrver.exe -- (MSK80Service)

SRV - [2009/01/09 09:06:52 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)

SRV - [2009/01/08 21:30:26 | 000,797,864 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)

SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Stopped] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)

SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)

SRV - [2006/12/19 19:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Stopped] -- C:\Program Files\Common Files\EPSON\eEBAPI\eEBSvc.exe -- (EpsonBidirectionalService)

SRV - [2004/10/04 14:12:50 | 000,057,344 | ---- | M] (Conexant Systems, Inc.) [Disabled | Stopped] -- C:\WINDOWS\system32\PRISMSVC.exe -- (PRISMSVC)

SRV - [2004/08/04 05:00:00 | 000,093,696 | ---- | M] (Sigma Designs Inc) [Auto | Stopped] -- C:\WINDOWS\system32\sofatnet.exe -- (sofatnet)

SRV - [2004/08/04 05:00:00 | 000,045,056 | ---- | M] (X-Ways Software Technology) [Auto | Stopped] -- C:\WINDOWS\system32\EvdoServer.dll -- (EvdoServer)

SRV - [2004/04/07 12:07:32 | 001,135,728 | ---- | M] (America Online, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)

========== Driver Services (SafeList) ==========

DRV - [2009/06/18 12:54:10 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\C.tmp -- (MEMSWEEP2)

DRV - [2009/03/25 11:06:30 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)

DRV - [2009/03/25 11:06:28 | 000,214,024 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)

DRV - [2009/03/25 11:06:28 | 000,079,880 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)

DRV - [2009/03/25 11:06:28 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)

DRV - [2009/03/25 11:05:54 | 000,034,216 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)

DRV - [2008/10/23 14:08:54 | 000,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)

DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)

DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)

DRV - [2004/09/27 00:42:00 | 000,345,184 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PRISMA02.sys -- (DELL_A02)

DRV - [2004/09/17 14:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)

DRV - [2004/06/16 03:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53)

DRV - [2004/03/06 04:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52)

DRV - [2004/03/06 04:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51)

DRV - [2004/03/06 04:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt)

DRV - [2003/01/10 16:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

DRV - [2002/01/10 10:49:47 | 000,038,176 | ---- | M] () [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\SbcpHid.sys -- (SbcpHid)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2009/08/02 13:53:46 | 000,318,817 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.123topsearch.com

O1 - Hosts: 127.0.0.1 123topsearch.com

O1 - Hosts: 127.0.0.1 www.132.com

O1 - Hosts: 127.0.0.1 132.com

O1 - Hosts: 127.0.0.1 www.136136.net

O1 - Hosts: 127.0.0.1 136136.net

O1 - Hosts: 127.0.0.1 www.163ns.com

O1 - Hosts: 127.0.0.1 163ns.com

O1 - Hosts: 10935 more lines...

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll ()

O2 - BHO: () - {2678E36F-5420-4945-B34F-A1AB2F9A6FF6} - File not found

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)

O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll ()

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()

O4 - HKLM..\Run: [DropBoxUtility] C:\Program Files\DropBox\DropBox\DropBox.exe (DropShots)

O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )

O4 - HKLM..\Run: [EPSON Stylus Photo 820 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe ()

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006..\Run: [AIM] File not found

O4 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)

O4 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006..\Run: [EPSON Artisan 700(Network)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIENA.EXE (SEIKO EPSON CORPORATION)

O4 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless USB 2.0 WLAN Card Utility.lnk = C:\Program Files\Dell Wireless\PRISMCFG.exe (Dell Inc.)

O4 - Startup: C:\Documents and Settings\Steve H\Start Menu\Programs\Startup\PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)

F3 - HKU\.DEFAULT WinNT: Run - (C:\WINDOWS\system32\msflpr.exe) - C:\WINDOWS\system32\msflpr.exe (-)

F3 - HKU\S-1-5-18 WinNT: Run - (C:\WINDOWS\system32\msflpr.exe) - C:\WINDOWS\system32\msflpr.exe (-)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-2800077679-1126426613-1149524522-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found

O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O9 - Extra Button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YPager.exe ()

O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YPager.exe ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03)

O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 207.172.3.8 207.172.3.9

O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll ()

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (rundll32.exe) - File not found

O24 - Desktop WallPaper: C:\Documents and Settings\Steve H\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Steve H\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2004/08/10 13:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2011/04/10 16:02:10 | 000,000,093 | RHS- | M] () - E:\autorun.inf -- [ FAT ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/15 08:43:39 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Steve H\Desktop\OTL.exe

[2011/04/14 18:51:50 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2011/04/14 18:51:50 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2011/04/14 18:51:50 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2011/04/14 18:51:50 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2011/04/14 18:51:45 | 000,000,000 | --SD | C] -- C:\ComboFix

[2011/04/14 14:05:02 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2011/04/14 14:05:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT

[2011/04/14 14:04:40 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Steve H\Desktop\erunt-setup.exe

[2011/04/14 13:17:45 | 000,000,000 | ---D | C] -- C:\DvdComposer

[2011/04/14 13:15:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve H\My Documents\My Music

[2011/04/13 15:41:20 | 000,000,000 | ---D | C] -- C:\cmdcons

[2011/04/13 14:04:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2011/04/13 14:03:17 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011/04/10 18:47:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve H\Application Data\Malwarebytes

[2011/04/10 18:47:06 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2011/04/10 18:47:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011/04/10 18:47:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2011/04/10 18:46:57 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011/04/10 18:46:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011/04/10 16:03:49 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Steve H\Desktop\mbam-setup.exe

[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/15 09:43:58 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve H\Desktop\OTL.exe

[2011/04/15 08:45:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/04/15 08:44:04 | 000,025,957 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF

[2011/04/14 20:00:00 | 004,321,202 | R--- | M] () -- C:\Documents and Settings\Steve H\Desktop\ComboFix.exe

[2011/04/14 15:11:14 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Steve H\Desktop\erunt-setup.exe

[2011/04/14 14:11:50 | 000,000,249 | ---- | M] () -- C:\Documents and Settings\Steve H\Desktop\undopolicy.reg

[2011/04/14 13:16:08 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/04/14 13:15:44 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn

[2011/04/14 13:15:44 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for

[2011/04/14 13:11:36 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2011/04/13 15:41:26 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2011/04/13 15:32:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/04/13 14:41:58 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Steve H\Desktop\RKUnhookerLE.EXE

[2011/04/12 13:30:18 | 000,002,821 | ---- | M] () -- C:\Documents and Settings\Steve H\Desktop\Attach.zip

[2011/04/11 17:57:11 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Steve H\defogger_reenable

[2011/04/10 20:20:24 | 000,301,568 | ---- | M] () -- C:\Documents and Settings\Steve H\Desktop\b8ct3i3r.exe

[2011/04/10 20:19:14 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Steve H\Desktop\dds.scr

[2011/04/10 20:18:08 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Steve H\Desktop\Defogger.exe

[2011/04/05 19:15:22 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Steve H\Desktop\mbam-setup.exe

[2011/03/27 16:36:02 | 000,095,232 | ---- | M] () -- C:\Documents and Settings\Steve H\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/03/27 15:10:20 | 000,176,128 | ---- | M] () -- C:\Documents and Settings\Steve H\My Documents\db2.mdb

[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/14 18:51:50 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/04/14 18:51:50 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011/04/14 18:51:50 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/04/14 18:51:50 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/04/14 18:51:50 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/04/14 18:51:10 | 004,321,202 | R--- | C] () -- C:\Documents and Settings\Steve H\Desktop\ComboFix.exe

[2011/04/14 14:11:50 | 000,000,249 | ---- | C] () -- C:\Documents and Settings\Steve H\Desktop\undopolicy.reg

[2011/04/14 13:15:44 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn

[2011/04/14 13:15:44 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for

[2011/04/13 15:41:26 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2011/04/13 15:41:22 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2011/04/13 13:39:34 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\Steve H\Desktop\RKUnhookerLE.EXE

[2011/04/12 13:30:18 | 000,002,821 | ---- | C] () -- C:\Documents and Settings\Steve H\Desktop\Attach.zip

[2011/04/11 17:57:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Steve H\defogger_reenable

[2011/04/11 17:53:47 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Steve H\Desktop\dds.scr

[2011/04/11 17:53:47 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Steve H\Desktop\Defogger.exe

[2011/04/11 17:53:46 | 000,301,568 | ---- | C] () -- C:\Documents and Settings\Steve H\Desktop\b8ct3i3r.exe

[2011/03/17 19:05:41 | 000,176,128 | ---- | C] () -- C:\Documents and Settings\Steve H\My Documents\db2.mdb

[2010/03/07 17:02:19 | 000,000,444 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/03/07 15:21:39 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2008/11/17 18:29:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\EEventManager.INI

[2008/10/13 18:37:02 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\E_ADDNET.DAT

[2008/10/13 17:21:05 | 000,073,220 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat

[2008/10/13 17:21:05 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat

[2008/10/13 17:21:05 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat

[2008/10/13 17:21:05 | 000,001,137 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat

[2008/10/13 17:21:05 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat

[2008/10/13 17:21:05 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat

[2008/10/13 17:21:05 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat

[2008/10/13 17:21:05 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2008/10/13 17:21:04 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat

[2008/10/13 17:21:04 | 000,029,114 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat

[2008/10/13 17:21:04 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat

[2008/10/13 17:21:04 | 000,021,021 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat

[2008/10/13 17:21:04 | 000,015,670 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat

[2008/10/13 17:21:04 | 000,013,280 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat

[2008/10/13 17:21:04 | 000,010,673 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat

[2008/10/13 17:21:04 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat

[2008/10/13 17:16:17 | 000,000,077 | ---- | C] () -- C:\WINDOWS\EPART700.ini

[2008/07/09 21:20:52 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Steve H\Local Settings\Application Data\fusioncache.dat

[2008/07/06 18:13:30 | 000,691,545 | ---- | C] () -- C:\WINDOWS\unins000.exe

[2008/07/06 18:13:30 | 000,002,542 | ---- | C] () -- C:\WINDOWS\unins000.dat

[2007/11/20 00:57:22 | 002,482,688 | ---- | C] () -- C:\WINDOWS\System32\ffmpeg.exe

[2007/11/18 02:45:54 | 012,525,568 | ---- | C] () -- C:\WINDOWS\System32\mencoder.exe

[2006/08/05 21:31:44 | 000,000,367 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini

[2006/06/23 07:37:23 | 000,001,753 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache

[2006/05/21 22:02:01 | 000,000,145 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT3.DAT

[2006/02/25 20:35:47 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\tvqenc.dll

[2006/02/25 20:35:45 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll

[2005/10/28 18:36:51 | 000,000,036 | ---- | C] () -- C:\WINDOWS\webica.ini

[2005/09/22 20:04:18 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2005/09/17 18:11:39 | 000,000,347 | ---- | C] () -- C:\WINDOWS\dellstat.ini

[2005/09/17 18:11:10 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll

[2005/09/17 18:11:08 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini

[2005/09/14 19:09:03 | 000,095,232 | ---- | C] () -- C:\Documents and Settings\Steve H\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2005/09/05 12:31:17 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2005/09/04 12:22:05 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\02A8DA4698.sys

[2005/08/25 21:41:23 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2005/08/25 21:33:25 | 000,000,528 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2005/08/25 21:29:29 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2005/08/25 21:00:40 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe

[2005/08/25 21:00:32 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

[2005/08/25 21:00:06 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\CoPrism.dll

[2005/08/25 21:00:04 | 000,000,375 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2005/08/23 17:05:46 | 000,225,280 | ---- | C] () -- C:\WINDOWS\System32\qtmlClient.dll

[2005/08/09 17:13:59 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\DivXsm.exe

[2005/08/09 17:12:28 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2005/01/28 08:08:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

[2004/08/10 13:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2004/08/10 13:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2004/08/10 13:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2004/08/10 13:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2004/08/10 12:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2004/08/10 12:57:15 | 000,307,600 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2004/08/10 12:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/10 12:51:20 | 000,384,596 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004/08/10 12:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/10 12:51:20 | 000,054,280 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004/08/10 12:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/10 12:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/10 12:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004/08/10 12:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2004/08/10 12:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/10 12:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/10 12:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/10 12:50:56 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2002/01/10 10:49:47 | 000,038,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\SbcpHid.sys

========== LOP Check ==========

[2009/02/12 23:46:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON

[2005/08/25 21:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Prism

[2009/08/09 13:23:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure

[2008/02/18 13:04:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft

[2007/10/29 17:14:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2005/09/01 22:43:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\.bittorrent

[2005/08/30 21:04:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\Aim

[2008/10/16 03:24:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\Epson

[2007/10/05 15:26:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\ICAClient

[2005/08/30 22:07:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\Leadertech

[2006/01/29 16:40:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\Nikon

[2007/03/24 19:46:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Steve H\Application Data\Viewpoint

[2009/07/15 02:35:25 | 000,000,354 | ---- | M] () -- C:\WINDOWS\Tasks\McDefragTask.job

[2009/08/01 01:00:54 | 000,000,356 | ---- | M] () -- C:\WINDOWS\Tasks\McQcTask.job

[2009/08/10 09:20:49 | 000,000,442 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure Program Check.job

[2009/08/10 09:20:49 | 000,000,382 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure Startup.job

[2009/08/09 19:36:36 | 000,000,376 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure.job

[2009/08/10 09:20:49 | 000,000,244 | -H-- | M] () -- C:\WINDOWS\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job

[2009/08/10 09:20:48 | 000,000,288 | -H-- | M] () -- C:\WINDOWS\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

========== Purity Check ==========

< End of report >

EXTRAS.TXT

OTL Extras logfile created on: 4/15/2011 8:47:43 AM - Run 1