Please help. My PC seems to be infected with the Google Redirect Virus

mwright12 · June 7, 2011

Hello, My PC appears to be infected with the Google Redirect Virus. Both Malwarebytes and AVG can't find anything, however when I run HitMan Pro it finds Malware at C:Windows/System 32/KdbFiw.dll The problem is that Hitman Pro fails to clean the virus upon reboot. The symptoms I have is that my Google searchs are often redirected to unwanted sites. Attached are the log files per your instructions. I really appreciate any help. Thank you in advance.

art.zip

attach.zip

dds.zip

SpySentinel · June 7, 2011

Hi mwright12,

Welcome to the Malwarebytes Forum

Step #1

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Step #2

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

mwright12 · June 8, 2011

Hi Matt,

I uploaded the TDSS and comboFix files yesterday but now they're not visible. Here they are again. BTW, The PC is working much better. Need to know if you think it's clean now and can I enable the CD drivers. ComboFix log.txt TDSSKiller.2.5.4.0_07.06.2011_16.26.32_log.txtenable the drivers.

SpySentinel · June 9, 2011

Hi mwright12,

The bulk of the infection has been taken care of, however there are some leftovers that need to be addressed first.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\documents and settings\XP_Pro\Local Settings\Application Data\txu2eftu.exe
c:\documents and settings\XP_Pro\Local Settings\Application Data\9cmk8hyz.exe
c:\documents and settings\XP_Pro\Local Settings\Application Data\um0tnw4sr.bat
c:\documents and settings\XP_Pro\Local Settings\Application Data\jilb6bw5.exe
c:\documents and settings\XP_Pro\Local Settings\Application Data\tlzsmw3rr.bat
c:\windows\Ohupevopebasus.bin

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

mwright12 · June 9, 2011

Hi Matt,

Here you go. Thank you for taking the time to help me.

ComboFix _ CF Script log.txt

SpySentinel · June 10, 2011

Hi mwright12,

You're very welcome

Launch Malwarebytes' Anti-Malware

Please check for updates, and if an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy & Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
2. Click on to download the ESET Smart Installer. Save it to your desktop.
3. Double click on the icon on your desktop.
4. Check
5. Click the button.
6. Accept any security warnings from your browser.
7. Check
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the button.
13. Push
  
  You can refer to this animation by neomage if needed.

mwright12 · June 10, 2011

Hi Matt,

Here are the files from MBAM and ESET.

Malwarebytes' Anti-Malware 1.50

www.malwarebytes.org

Database version: 6826

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/10/2011 8:13:37 AM

mbam-log-2011-06-10 (08-13-37).txt

Scan type: Quick scan

Objects scanned: 150359

Time elapsed: 2 minute(s), 22 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

ESETScan.txt

SpySentinel · June 11, 2011

Hi mwright12,

This infection family will hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

mwright12 · June 12, 2011

Hi Matt,

Here are the OTL logs. BTW, This system is running so much better. You are the best.

OTL. TXT

OTL logfile created on: 6/12/2011 3:40:06 PM - Run 1

OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\XP_Pro\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.24 Gb Total Physical Memory | 2.56 Gb Available Physical Memory | 79.05% Memory free

5.08 Gb Paging File | 4.53 Gb Available in Paging File | 89.09% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 465.75 Gb Total Space | 391.08 Gb Free Space | 83.97% Space Free | Partition Type: NTFS

Drive F: | 111.76 Gb Total Space | 15.51 Gb Free Space | 13.87% Space Free | Partition Type: FAT32

Computer Name: FEB2011 | User Name: XP_Pro | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\XP_Pro\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()

PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe (Cyberlink Corp.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\XP_Pro\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)

SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (BcmSqlStartupSvc) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )

DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )

DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )

DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )

DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)

DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)

DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/09 11:01:54 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2011/06/09 10:40:38 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [HitmanPro35] C:\Program Files\Hitman Pro 3.5\HitmanPro35[1].exe (SurfRight B.V.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [RemoteControl] C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe (Cyberlink Corp.)

O4 - Startup: C:\Documents and Settings\XP_Pro\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\XP_Pro\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Domains: bing.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: doccentral.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: fnismls.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: getmedianow.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: live.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: paragonrels.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: rdesk.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: rexplorer.net ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: safemls.net ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: showingtime.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: sitexdata.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: spellchecker.net ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: transactionpoint.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: trpoint.com ([]* in Trusted Sites)

O15 - HKCU\..Trusted Domains: xmlsweb.com ([]* in Trusted Sites)

O16 - DPF: {0854D220-A90A-466D-BC02-6683183802B7} http://imls.fnismls.com/Paragon/Codebase/FNISPrintControl.cab (PrintPreview Class)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1297173648109 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1297213929890 (MUWebControl Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011/02/08 22:44:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O35 - HKCU\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKCU\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/12 15:34:02 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\XP_Pro\Desktop\OTL.exe

[2011/06/10 08:16:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011/06/09 11:01:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011

[2011/06/09 11:01:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG

[2011/06/09 10:39:02 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2011/06/07 16:43:01 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2011/06/07 16:41:01 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2011/06/07 16:41:01 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2011/06/07 16:41:01 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2011/06/07 16:40:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2011/06/07 16:32:19 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011/06/07 16:29:15 | 004,116,742 | R--- | C] (Swearware) -- C:\Documents and Settings\XP_Pro\Desktop\ComboFix.exe

[2011/06/07 10:19:21 | 000,000,000 | R--D | C] -- C:\Documents and Settings\XP_Pro\My Documents\My Videos

[2011/06/06 14:39:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2011/06/06 14:39:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011/06/06 14:39:41 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011/06/06 14:39:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011/05/17 07:48:51 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/12 15:34:02 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\XP_Pro\Desktop\OTL.exe

[2011/06/12 15:28:29 | 000,606,105 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Desktop\unhide.exe

[2011/06/12 09:27:41 | 118,237,717 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm

[2011/06/11 08:23:21 | 000,483,364 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/06/11 08:23:21 | 000,086,948 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/06/11 08:19:57 | 000,017,480 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011/06/11 08:19:25 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/06/11 08:19:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/06/09 11:43:08 | 000,000,192 | ---- | M] () -- C:\WINDOWS\System32\.crusader

[2011/06/09 11:01:55 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk

[2011/06/09 10:40:38 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011/06/09 10:24:28 | 004,116,742 | R--- | M] (Swearware) -- C:\Documents and Settings\XP_Pro\Desktop\ComboFix.exe

[2011/06/07 16:43:04 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2011/06/07 16:26:00 | 001,305,136 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Desktop\tdsskiller.zip

[2011/06/07 12:28:53 | 000,003,526 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Desktop\attach.zip

[2011/06/07 12:28:47 | 000,003,281 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Desktop\dds.zip

[2011/06/07 12:28:37 | 000,047,492 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Desktop\art.zip

[2011/06/07 10:12:58 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\XP_Pro\defogger_reenable

[2011/06/06 14:39:44 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2011/06/02 12:04:34 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2011/05/31 14:55:20 | 000,001,015 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Start Menu\Programs\Startup\Dropbox.lnk

[2011/05/31 14:55:19 | 000,001,015 | ---- | M] () -- C:\Documents and Settings\XP_Pro\Desktop\Dropbox.lnk

[2011/05/31 14:31:29 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Hxitujikapakuk.dat

[2011/05/31 13:07:08 | 000,056,532 | ---- | M] () -- C:\WINDOWS\System32\mlfcache.dat

[2011/05/17 07:48:51 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2011/05/16 22:37:08 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/12 15:28:29 | 000,606,105 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Desktop\unhide.exe

[2011/06/12 09:27:41 | 118,237,717 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm

[2011/06/09 11:01:55 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk

[2011/06/07 16:43:04 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2011/06/07 16:43:03 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2011/06/07 16:41:01 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/06/07 16:41:01 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/06/07 16:41:01 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011/06/07 16:41:01 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/06/07 16:41:01 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/06/07 16:25:25 | 001,305,136 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Desktop\tdsskiller.zip

[2011/06/07 12:28:53 | 000,003,526 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Desktop\attach.zip

[2011/06/07 12:28:47 | 000,003,281 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Desktop\dds.zip

[2011/06/07 12:28:37 | 000,047,492 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Desktop\art.zip

[2011/06/07 10:12:58 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\XP_Pro\defogger_reenable

[2011/06/06 14:39:44 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2011/05/31 13:07:08 | 000,056,532 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2011/05/10 07:16:56 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Hxitujikapakuk.dat

[2011/05/08 13:31:29 | 000,017,124 | -HS- | C] () -- C:\Documents and Settings\XP_Pro\Local Settings\Application Data\l47ped1ewgn77csu18023716

[2011/05/08 13:31:29 | 000,017,124 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\l47ped1ewgn77csu18023716

[2011/04/06 19:02:05 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/04/06 18:47:48 | 000,090,112 | RHS- | C] () -- C:\WINDOWS\System32\kbdfiw.dll

[2011/04/04 11:40:11 | 000,017,480 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011/03/30 11:08:11 | 000,014,634 | -HS- | C] () -- C:\Documents and Settings\XP_Pro\Local Settings\Application Data\r0t835ni0n1t18aj4n071sa4s7m

[2011/03/30 11:08:11 | 000,014,634 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\r0t835ni0n1t18aj4n071sa4s7m

[2011/03/29 22:33:28 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Application Data\124tre.ini

[2011/03/21 09:22:33 | 000,011,776 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/03/07 16:14:26 | 000,038,483 | ---- | C] () -- C:\Documents and Settings\XP_Pro\Application Data\Comma Separated Values (Windows).ADR

[2011/02/22 09:34:00 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2011/02/19 13:11:23 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2011/02/19 12:23:51 | 000,130,349 | ---- | C] () -- C:\WINDOWS\hpoins13.dat

[2011/02/19 12:23:50 | 000,000,811 | ---- | C] () -- C:\WINDOWS\hpomdl13.dat

[2011/02/08 22:46:00 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2011/02/08 22:42:13 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2011/02/08 06:59:49 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2011/02/08 06:57:11 | 000,267,800 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2004/08/04 06:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004/08/04 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/04 06:00:00 | 000,483,364 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004/08/04 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/04 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/04 06:00:00 | 000,086,948 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004/08/04 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/04 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/04 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/04 06:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/04 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004/08/04 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/06/09 11:02:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10

[2011/04/21 18:20:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files

[2011/04/04 11:42:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro

[2011/06/09 11:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData

[2011/02/19 12:50:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2011/04/21 18:21:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XP_Pro\Application Data\AVG10

[2011/06/11 08:19:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XP_Pro\Application Data\Dropbox

[2011/04/07 09:14:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\XP_Pro\Application Data\ElevatedDiagnostics

========== Purity Check ==========

< End of report >

EXTRA.TXT

OTL Extras logfile created on: 6/12/2011 3:40:06 PM - Run 1