Another 'Internet Security 2010' issue

homerun_homer · 19-01-2010 10:21am #1

As requested in the other topic.

I originally used Rkill to stop the program and installed Malwarebytes, but I couldn't update it as had no internet on my sister's laptop (reading boards and help pages on my own laptop connected to internet while trying to fix hers). Ran a quick scan, removed virus', then without rebooting ran a full scan and rebooted after it cleared what it found.

The 2010 Internet security message is gone but clearly there is still a virus on the machine. Not sure if the below helps at this point of whether you will need me to do anything else, but going off instructions on the last thread here are my log files.

OTM log file;

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: orl
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes

User: Owner

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 0.00 mb

OTM by OldTimer - Version 3.1.6.0 log created on 01182010_235646

Files moved on Reboot...

Registry entries deleted on Reboot...

homerun_homer · 19-01-2010 10:22am

exeHelper by Raktor
Build 20091220
Run at 00:07:15 on 01/19/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Deleting file C:\WINDOWS\system32\41.exe
Error deleting C:\WINDOWS\system32\41.exe - Set for removal on reboot - PLEASE REBOOT
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

ActorSeeksJob · 19-01-2010 2:06pm

Hi

Step 1 : Safety precautions

Looking at your system now, one or more of the identified infections is a backdoor Trojan.

If this computer is ever used for on-line banking, I suggest you do the following immediately:

1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

2. From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Backup Your Registry with ERUNT

Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Download SysRestorePoint to your desktop and unzip it to it's own folder.

Double click SysRestorePoint.exe so that we can make a new system restore point.
A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program.

Step 2 : The fix

A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

Please download LSPFix from here.
Run the LSPFix.exe that you have just finished downloading.
Check the I know what I'm doing box.
In the Keep box you should see one or more instances of helper32.dll
Select every instance of helper32.dll and move each one to the Remove box by clicking the >> button.
When you are done click Finish>>.

If that file isn't there, move onto the next step anyway

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="explorer.exe"
"Userinit"="C:\\WINDOWS\\system32\\Userinit.exe,"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-

:Services
ndisdrv

:Files
%HOMEDRIVE%\Internet Security 2010.lnk /s
%systemroot%\System32\winlogon32.exe
%systemroot%\System32\smss32.exe
%systemroot%\System32\AVR10.exe
%systemroot%\System32\helper32.dll
%systemroot%\System32\winlogon32.exe
%systemroot%\System32\smss32.exe
%systemroot%\System32\warning.html
%systemroot%\system32\IS15.exe
%systemroot%\System32\winhelper86.dll
%HOMEDRIVE%\trhh.exe
%systemroot%\lsass.exe 
%systemroot%\odbn0.exe
%systemroot%\System32\sdra64.exe
%systemroot%\System32\41.exe
%systemroot%\System32\153.exe
%systemroot%\System32\292.exe
%systemroot%\system32\2876.exe
%systemroot%\System32\2995.exe
%systemroot%\System32\3902.exe
%systemroot%\System32\4827.exe
%systemroot%\System32\5436.exe
%systemroot%\System32\5705.exe
%systemroot%\System32\6334.exe
%systemroot%\System32\7376.exe
%systemroot%\System32\11478.exe
%systemroot%\System32\11942.exe
%systemroot%\system32\12662.exe
%systemroot%\System32\13931.exe
%systemroot%\system32\14070.exe
%systemroot%\System32\14604.exe
%systemroot%\System32\15724.exe
%systemroot%\System32\16827.exe
%systemroot%\System32\16944.exe
%systemroot%\system32\17125.exe
%systemroot%\System32\18467.exe
%systemroot%\System32\19169.exe
%systemroot%\system32\19905.exe
%systemroot%\system32\21386.exe
%systemroot%\system32\22934.exe
%systemroot%\System32\23281.exe
%systemroot%\system32\24242.exe
%systemroot%\System32\24464.exe
%systemroot%\system32\24478.exe
%systemroot%\System32\26308.exe
%systemroot%\System32\26500.exe
%systemroot%\System32\26962.exe
%systemroot%\system32\27213.exe
%systemroot%\System32\28145.exe
%systemroot%\system32\28466.exe
%systemroot%\System32\29358.exe
%systemroot%\System32\32391.exe
%systemroot%\System32\32439.exe
%systemroot%\system32\ndisdrv.sys
%HOMEDRIVE%\s
%PROGRAMFILES%\InternetSecurity2010
%systemroot%\System32\lowsec

:Commands
[purity]
[CREATERESTOREPOINT] 
[resethosts]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, it wont take long. Reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

One final scan

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Open OTL click the Quick Scan button, post that log with the MBAM one and tell me how its running.

homerun_homer · 19-01-2010 7:52pm

OTL logfile created on: 19/01/2010 19:29:33 - Run 1
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\orl\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.00 Mb Total Physical Memory | 158.00 Mb Available Physical Memory | 35.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.77 Gb Total Space | 14.51 Gb Free Space | 37.42% Space Free | Partition Type: NTFS

Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PQ3LZ12
Current User Name: orl
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
PRC - [2009/07/13 13:03:10 | 00,292,128 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/06/19 14:57:23 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/04/14 00:12:41 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/12 03:00:36 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
PRC - [2006/08/06 15:39:05 | 00,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2005/12/08 15:39:08 | 00,975,360 | ---- | M] (Packard Bell BV) -- C:\APPS\SMP\SMPSYS.EXE
PRC - [2005/09/30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/09/14 12:47:44 | 00,167,936 | ---- | M] (S3 Graphics Co., Ltd.) -- C:\WINDOWS\system32\VTTrayp.exe
PRC - [2005/08/23 14:51:58 | 00,221,184 | R--- | M] () -- C:\WINDOWS\system32\drivers\Icon.exe
PRC - [2005/08/17 17:39:58 | 00,090,112 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/06/29 18:09:42 | 17,605,160 | ---- | M] () -- C:\APPS\skype\phone\Skype.exe
PRC - [2005/05/11 12:52:04 | 00,737,381 | ---- | M] (Cyberlink) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
PRC - [2005/05/11 12:52:00 | 00,061,440 | ---- | M] (Cyberlink) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
PRC - [2005/05/11 12:50:34 | 00,110,672 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe
PRC - [2005/05/11 12:50:14 | 00,221,266 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
PRC - [2005/05/11 12:48:02 | 00,127,118 | ---- | M] (CyberLink Corp.) -- C:\APPS\Powercinema\PCMService.exe
PRC - [2005/05/10 18:53:26 | 00,061,440 | ---- | M] ( ) -- C:\WINDOWS\system32\slmdmsr.exe
PRC - [2005/03/10 17:44:34 | 00,098,394 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2005/03/10 17:43:30 | 00,688,218 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PRC - [2005/03/08 02:33:28 | 00,053,248 | ---- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe
PRC - [2005/01/07 11:01:52 | 00,049,152 | ---- | M] () -- c:\APPS\HIDSERVICE\HidService.exe
PRC - [2004/04/08 07:38:26 | 01,135,728 | ---- | M] (America Online, Inc.) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2003/12/17 15:50:44 | 00,028,672 | R--- | M] () -- C:\WINDOWS\system32\drivers\STDSB.exe
PRC - [2003/03/26 14:17:14 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE
PRC - [2003/03/26 14:16:04 | 00,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXPPS.EXE

========== Modules (SafeList) ==========

MOD - [2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
MOD - [2008/04/14 00:11:56 | 00,019,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\linkinfo.dll

========== Win32 Services (SafeList) ==========

SRV - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/05/02 09:22:52 | 00,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2007/06/27 18:22:44 | 00,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2005/10/06 17:12:30 | 00,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)
SRV - [2005/09/30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2005/05/11 12:52:00 | 00,061,440 | ---- | M] (Cyberlink) [Auto | Running] -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/05/11 12:50:34 | 00,110,672 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/05/11 12:50:14 | 00,221,266 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2005/05/10 18:53:26 | 00,061,440 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slmdmsr.exe -- (SLService)
SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/01/07 11:01:52 | 00,049,152 | ---- | M] () [Auto | Running] -- c:\APPS\HIDSERVICE\HidService.exe -- (GenericHidService)
SRV - [2004/04/08 07:38:26 | 01,135,728 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)
SRV - [2003/03/26 14:17:14 | 00,303,104 | ---- | M] (Lexmark International, Inc.) [Auto | Running] -- C:\WINDOWS\system32\LEXBCES.EXE -- (LexBceS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2010/01/19 19:17:25 | 00,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PBUKV2) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - C:\WINDOWS\System32\pbukv2.dll File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PBUKV2) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - C:\WINDOWS\System32\pbukv2.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PBUKV2) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - C:\WINDOWS\System32\pbukv2.dll File not found
O4 - HKLM..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [smss32.exe] C:\WINDOWS\System32\smss32.exe File not found
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\MSN Messenger\MsnMsgr.Exe File not found
O4 - HKCU..\Run: [Skype] C:\APPS\SKYPE\PHONE\SKYPE.EXE ()
O4 - HKCU..\Run: [SmpcSys] C:\APPS\SMP\SMPSYS.EXE (Packard Bell BV)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} http://0-site.ebrary.com.mislibsrv.lit.ie/lib/limerickit/support/plugins/ebraryRdr.cab (Infotl Control)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://orlaith1978.spaces.live.com//PhotoUpload/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/FacebookPhotoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://go.divx.com/plugin/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper: C:\Documents and Settings\orl\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O29 - HKLM SecurityProviders - (digiwet.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/01/19 19:15:36 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/19 19:15:01 | 00,547,328 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
[2010/01/19 19:10:17 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/01/19 19:09:46 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/01/19 19:08:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\erunt
[2010/01/19 19:04:35 | 00,439,808 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\TFC.exe
[2010/01/19 19:04:24 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\orl\Desktop\erunt-setup.exe
[2010/01/19 00:05:46 | 00,186,880 | ---- | C] (CEXX.ORG) -- C:\Documents and Settings\orl\Desktop\LSPFix.exe
[2010/01/18 23:50:27 | 00,000,000 | ---D | C] -- C:\_OTM
[2010/01/18 23:47:31 | 00,503,296 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTM.exe
[2010/01/18 23:47:31 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\orl\Desktop\SysRestorePoint.exe
[2010/01/18 23:33:04 | 00,000,000 | ---D | C] -- C:\!KillBox
[2010/01/18 23:33:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\KillBox
[2010/01/18 22:47:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\My Wedding
[2010/01/18 21:43:07 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/18 21:43:05 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/16 12:49:34 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/18 14:22:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/02/28 20:43:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/07/03 15:42:41 | 00,015,000 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[2004/08/10 16:04:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2004/08/10 15:46:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/08/10 15:46:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\tasks\Master CD_DVD Creator.job
[2010/01/19 19:22:37 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/19 19:21:38 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/19 19:21:35 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/19 19:21:33 | 46,928,6912 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/19 19:20:50 | 05,505,024 | -H-- | M] () -- C:\Documents and Settings\orl\NTUSER.DAT
[2010/01/19 19:20:50 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\orl\ntuser.ini
[2010/01/19 19:17:25 | 00,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
[2010/01/19 19:09:46 | 00,000,614 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\NTREGOPT.lnk
[2010/01/19 19:09:46 | 00,000,595 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\ERUNT.lnk
[2010/01/19 16:15:42 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\orl\Desktop\erunt-setup.exe
[2010/01/19 16:13:54 | 00,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\TFC.exe
[2010/01/19 00:06:48 | 00,290,816 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\exeHelper.com
[2010/01/19 00:05:04 | 00,186,880 | ---- | M] (CEXX.ORG) -- C:\Documents and Settings\orl\Desktop\LSPFix.exe
[2010/01/18 23:59:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe.vir
[2010/01/18 23:45:56 | 00,503,296 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTM.exe
[2010/01/18 21:43:09 | 00,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/18 20:19:30 | 00,263,168 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\rkill.com
[2010/01/17 11:42:47 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/01/16 12:49:34 | 00,001,737 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\HijackThis.lnk

========== Files Created - No Company Name ==========

[2010/01/19 19:09:46 | 00,000,614 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\NTREGOPT.lnk
[2010/01/19 19:09:46 | 00,000,595 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\ERUNT.lnk
[2010/01/19 00:07:08 | 00,290,816 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\exeHelper.com
[2010/01/18 23:40:43 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\41.exe.vir
[2010/01/18 21:43:09 | 00,000,699 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/18 20:29:35 | 00,263,168 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\rkill.com
[2010/01/16 12:49:34 | 00,001,737 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\HijackThis.lnk
[2009/04/12 21:31:10 | 00,137,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\ethgqasu.sys
[2007/03/19 17:43:26 | 00,000,026 | ---- | C] () -- C:\WINDOWS\dvdSanta.INI
[2007/01/23 22:06:58 | 00,000,024 | ---- | C] () -- C:\WINDOWS\System32\sysogg.dll
[2007/01/23 22:00:31 | 00,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2007/01/18 20:37:09 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/09/14 20:41:53 | 00,000,296 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2006/08/11 18:04:57 | 00,000,126 | ---- | C] () -- C:\Documents and Settings\orl\Local Settings\Application Data\fusioncache.dat
[2006/08/09 21:10:49 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/06 15:39:58 | 00,001,039 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/06 15:36:33 | 00,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/06 15:36:31 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/06 15:18:57 | 00,069,120 | ---- | C] () -- C:\Documents and Settings\orl\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/07/03 16:13:28 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/07/03 15:53:10 | 00,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2006/07/03 15:52:41 | 00,002,424 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI
[2006/07/03 15:45:54 | 00,007,585 | ---- | C] () -- C:\WINDOWS\HDReg.ini
[2006/07/03 15:42:41 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2006/07/03 15:42:41 | 00,225,280 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2006/07/03 15:33:26 | 00,221,184 | ---- | C] () -- C:\WINDOWS\System32\slmdmsp.dll
[2006/07/03 15:33:26 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\slmdmgx.dll
[2006/07/03 15:33:26 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\slmdmco.dll
[2006/07/03 15:31:53 | 00,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2006/07/03 15:30:32 | 00,011,279 | R--- | C] () -- C:\WINDOWS\System32\drivers\STDSB.sys
[2006/07/03 15:30:32 | 00,003,584 | R--- | C] () -- C:\WINDOWS\System32\drivers\mxkeybd.dll
[2006/07/03 15:30:31 | 00,001,495 | R--- | C] () -- C:\WINDOWS\System32\drivers\HotKey.ini
[2005/06/17 10:41:00 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2005/05/20 13:05:02 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 16:13:32 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/06/23 13:14:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/03/26 14:19:44 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBLLCNP.DLL
[2002/11/13 15:40:22 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxblvs.dll

========== LOP Check ==========

[2006/07/03 15:51:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OD2
[2006/07/03 15:45:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/04 19:34:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2006/11/29 21:51:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Canon
[2006/11/07 16:47:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Leadertech
[2006/08/05 19:53:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\OD2
[2007/09/18 15:24:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Opera
[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\Tasks\Master CD_DVD Creator.job

========== Purity Check ==========

< End of report >
[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\tasks\Master CD_DVD Creator.job
[2010/01/19 19:22:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2010/01/19 19:22:37 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/19 19:21:38 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/19 19:21:35 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/19 19:20:50 | 05,505,024 | -H-- | M] () -- C:\Documents and Settings\orl\NTUSER.DAT
[2010/01/19 19:20:50 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\orl\ntuser.ini
[2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
[2010/01/19 19:09:51 | 00,000,000 | ---D | M] -- C:\Program Files\ERUNT
[2010/01/19 19:09:46 | 00,000,614 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\NTREGOPT.lnk
[2010/01/19 19:09:46 | 00,000,595 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\ERUNT.lnk
[2010/01/19 16:15:42 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\orl\Desktop\erunt-setup.exe
[2010/01/19 16:13:54 | 00,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\TFC.exe
[2010/01/19 00:06:48 | 00,290,816 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\exeHelper.com
[2010/01/19 00:05:04 | 00,186,880 | ---- | M] (CEXX.ORG) -- C:\Documents and Settings\orl\Desktop\LSPFix.exe
[2010/01/18 23:45:56 | 00,503,296 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTM.exe
[2010/01/18 23:11:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Local Settings\Application Data\Microsoft
[2010/01/18 21:43:10 | 00,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/18 21:43:09 | 00,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/18 20:19:30 | 00,263,168 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\rkill.com
[2010/01/17 11:42:47 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/01/16 12:49:34 | 00,001,737 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\HijackThis.lnk
[2010/01/16 12:49:34 | 00,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2009/12/28 21:38:29 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\Top table.doc
[2009/12/23 21:22:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\U3
[2009/12/23 17:28:21 | 06,285,336 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\attachments_2009_12_23.zip
[2009/11/25 21:25:39 | 00,046,016 | ---- | M] () -- C:\Documents and Settings\orl\Application Data\GDIPFONTCACHEV1.DAT
[2009/10/12 16:54:25 | 00,069,120 | ---- | M] () -- C:\Documents and Settings\orl\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/24 12:20:57 | 00,046,016 | ---- | M] () -- C:\Documents and Settings\orl\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/04/18 14:22:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/02/28 20:43:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/25 13:18:54 | 00,001,755 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/08/11 18:04:57 | 00,000,126 | ---- | M] () -- C:\Documents and Settings\orl\Local Settings\Application Data\fusioncache.dat
[2006/08/10 22:02:12 | 05,362,698 | -H-- | M] () -- C:\Documents and Settings\orl\Local Settings\Application Data\IconCache.db
[2006/06/29 13:58:52 | 00,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 13:53:56 | 00,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 00,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 14:39:28 | 00,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2004/08/10 16:04:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2004/08/10 15:47:10 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\orl\Application Data\desktop.ini
[2004/08/10 15:47:10 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2004/08/10 15:46:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/08/10 15:46:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\tasks\Master CD_DVD Creator.job
[2010/01/19 19:22:37 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/19 19:21:38 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/19 19:21:35 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/19 19:21:33 | 46,928,6912 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/19 19:20:50 | 05,505,024 | -H-- | M] () -- C:\Documents and Settings\orl\NTUSER.DAT
[2010/01/19 19:20:50 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\orl\ntuser.ini
[2010/01/19 19:17:25 | 00,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
[2010/01/19 19:09:46 | 00,000,614 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\NTREGOPT.lnk
[2010/01/19 19:09:46 | 00,000,595 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\ERUNT.lnk
[2010/01/19 16:15:42 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\orl\Desktop\erunt-setup.exe
[2010/01/19 16:13:54 | 00,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\TFC.exe
[2010/01/19 00:06:48 | 00,290,816 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\exeHelper.com
[2010/01/19 00:05:04 | 00,186,880 | ---- | M] (CEXX.ORG) -- C:\Documents and Settings\orl\Desktop\LSPFix.exe
[2010/01/18 23:59:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe.vir
[2010/01/18 23:45:56 | 00,503,296 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTM.exe
[2010/01/18 21:43:09 | 00,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/18 20:19:30 | 00,263,168 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\rkill.com
[2010/01/17 11:42:47 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/01/16 12:49:34 | 00,001,737 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\HijackThis.lnk
[2009/12/30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/30 14:54:58 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/28 21:38:29 | 00,027,648 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\Top table.doc
[2009/12/23 17:28:21 | 06,285,336 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\attachments_2009_12_23.zip

========== LOP Check ==========

[2006/07/03 15:51:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OD2
[2006/07/03 15:45:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/04 19:34:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2006/11/29 21:51:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Canon
[2006/11/07 16:47:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Leadertech
[2006/08/05 19:53:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\OD2
[2007/09/18 15:24:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Opera
[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\Tasks\Master CD_DVD Creator.job

========== Purity Check ==========

< End of report >

homerun_homer · 19-01-2010 9:46pm

Malwarebytes' Anti-Malware 1.44
Database version: 3600
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

19/01/2010 21:42:00
mbam-log-2010-01-19 (21-42-00).txt

Scan type: Quick Scan
Objects scanned: 110398
Time elapsed: 5 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

homerun_homer · 19-01-2010 9:50pm

OTL logfile created on: 19/01/2010 21:45:53 - Run 2
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\orl\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.00 Mb Total Physical Memory | 155.00 Mb Available Physical Memory | 35.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.77 Gb Total Space | 14.49 Gb Free Space | 37.37% Space Free | Partition Type: NTFS

Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PQ3LZ12
Current User Name: orl
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
PRC - [2009/07/13 13:03:10 | 00,292,128 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/06/19 14:57:23 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/04/14 00:12:41 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/12 03:00:36 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
PRC - [2006/08/06 15:39:05 | 00,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2005/12/08 15:39:08 | 00,975,360 | ---- | M] (Packard Bell BV) -- C:\APPS\SMP\SMPSYS.EXE
PRC - [2005/09/30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/09/14 12:47:44 | 00,167,936 | ---- | M] (S3 Graphics Co., Ltd.) -- C:\WINDOWS\system32\VTTrayp.exe
PRC - [2005/08/23 14:51:58 | 00,221,184 | R--- | M] () -- C:\WINDOWS\system32\drivers\Icon.exe
PRC - [2005/08/17 17:39:58 | 00,090,112 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/06/29 18:09:42 | 17,605,160 | ---- | M] () -- C:\APPS\skype\phone\Skype.exe
PRC - [2005/05/11 12:52:04 | 00,737,381 | ---- | M] (Cyberlink) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
PRC - [2005/05/11 12:52:00 | 00,061,440 | ---- | M] (Cyberlink) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
PRC - [2005/05/11 12:50:34 | 00,110,672 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe
PRC - [2005/05/11 12:50:14 | 00,221,266 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
PRC - [2005/05/11 12:48:02 | 00,127,118 | ---- | M] (CyberLink Corp.) -- C:\APPS\Powercinema\PCMService.exe
PRC - [2005/05/10 18:53:26 | 00,061,440 | ---- | M] ( ) -- C:\WINDOWS\system32\slmdmsr.exe
PRC - [2005/03/10 17:44:34 | 00,098,394 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2005/03/10 17:43:30 | 00,688,218 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PRC - [2005/03/08 02:33:28 | 00,053,248 | ---- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe
PRC - [2005/01/07 11:01:52 | 00,049,152 | ---- | M] () -- c:\APPS\HIDSERVICE\HidService.exe
PRC - [2004/04/08 07:38:26 | 01,135,728 | ---- | M] (America Online, Inc.) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2003/12/17 15:50:44 | 00,028,672 | R--- | M] () -- C:\WINDOWS\system32\drivers\STDSB.exe
PRC - [2003/03/26 14:17:14 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE
PRC - [2003/03/26 14:16:04 | 00,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXPPS.EXE

========== Modules (SafeList) ==========

MOD - [2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/05/02 09:22:52 | 00,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2007/06/27 18:22:44 | 00,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2005/10/06 17:12:30 | 00,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)
SRV - [2005/09/30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2005/05/11 12:52:00 | 00,061,440 | ---- | M] (Cyberlink) [Auto | Running] -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/05/11 12:50:34 | 00,110,672 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/05/11 12:50:14 | 00,221,266 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2005/05/10 18:53:26 | 00,061,440 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slmdmsr.exe -- (SLService)
SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/01/07 11:01:52 | 00,049,152 | ---- | M] () [Auto | Running] -- c:\APPS\HIDSERVICE\HidService.exe -- (GenericHidService)
SRV - [2004/04/08 07:38:26 | 01,135,728 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)
SRV - [2003/03/26 14:17:14 | 00,303,104 | ---- | M] (Lexmark International, Inc.) [Auto | Running] -- C:\WINDOWS\system32\LEXBCES.EXE -- (LexBceS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2010/01/19 19:17:25 | 00,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PBUKV2) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - C:\WINDOWS\System32\pbukv2.dll File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PBUKV2) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - C:\WINDOWS\System32\pbukv2.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PBUKV2) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - C:\WINDOWS\System32\pbukv2.dll File not found
O4 - HKLM..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\MSN Messenger\MsnMsgr.Exe File not found
O4 - HKCU..\Run: [Skype] C:\APPS\SKYPE\PHONE\SKYPE.EXE ()
O4 - HKCU..\Run: [SmpcSys] C:\APPS\SMP\SMPSYS.EXE (Packard Bell BV)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} http://0-site.ebrary.com.mislibsrv.lit.ie/lib/limerickit/support/plugins/ebraryRdr.cab (Infotl Control)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://orlaith1978.spaces.live.com//PhotoUpload/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/FacebookPhotoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://go.divx.com/plugin/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop BackupWallPaper: C:\Documents and Settings\orl\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O29 - HKLM SecurityProviders - (digiwet.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{d95b7781-052f-11df-8223-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{d95b7781-052f-11df-8223-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d95b7781-052f-11df-8223-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/01/19 21:29:51 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/19 21:29:48 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/19 21:29:48 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/19 19:15:36 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/19 19:15:01 | 00,547,328 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
[2010/01/19 19:10:17 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/01/19 19:09:46 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/01/19 19:08:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\erunt
[2010/01/19 19:04:35 | 00,439,808 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\TFC.exe
[2010/01/19 19:04:24 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\orl\Desktop\erunt-setup.exe
[2010/01/19 00:05:46 | 00,186,880 | ---- | C] (CEXX.ORG) -- C:\Documents and Settings\orl\Desktop\LSPFix.exe
[2010/01/18 23:50:27 | 00,000,000 | ---D | C] -- C:\_OTM
[2010/01/18 23:47:31 | 00,503,296 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTM.exe
[2010/01/18 23:47:31 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\orl\Desktop\SysRestorePoint.exe
[2010/01/18 23:33:04 | 00,000,000 | ---D | C] -- C:\!KillBox
[2010/01/18 23:33:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\KillBox
[2010/01/18 22:47:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\My Wedding
[2010/01/16 12:49:34 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/18 14:22:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/02/28 20:43:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/07/03 15:42:41 | 00,015,000 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[2004/08/10 16:04:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2004/08/10 15:46:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/08/10 15:46:50 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/01/19 21:43:58 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/19 21:43:46 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/19 21:43:44 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/19 21:43:42 | 46,928,6912 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/19 21:42:41 | 05,505,024 | -H-- | M] () -- C:\Documents and Settings\orl\NTUSER.DAT
[2010/01/19 21:42:41 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\orl\ntuser.ini
[2010/01/19 21:29:53 | 00,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\tasks\Master CD_DVD Creator.job
[2010/01/19 19:17:25 | 00,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTL.exe
[2010/01/19 19:09:46 | 00,000,614 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\NTREGOPT.lnk
[2010/01/19 19:09:46 | 00,000,595 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\ERUNT.lnk
[2010/01/19 16:15:42 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\orl\Desktop\erunt-setup.exe
[2010/01/19 16:13:54 | 00,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\TFC.exe
[2010/01/19 00:06:48 | 00,290,816 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\exeHelper.com
[2010/01/19 00:05:04 | 00,186,880 | ---- | M] (CEXX.ORG) -- C:\Documents and Settings\orl\Desktop\LSPFix.exe
[2010/01/18 23:59:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe.vir
[2010/01/18 23:45:56 | 00,503,296 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\OTM.exe
[2010/01/18 20:19:30 | 00,263,168 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\rkill.com
[2010/01/17 11:42:47 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/01/16 12:49:34 | 00,001,737 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\HijackThis.lnk
[2010/01/07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2010/01/19 21:29:53 | 00,000,699 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/19 19:09:46 | 00,000,614 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\NTREGOPT.lnk
[2010/01/19 19:09:46 | 00,000,595 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\ERUNT.lnk
[2010/01/19 00:07:08 | 00,290,816 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\exeHelper.com
[2010/01/18 23:40:43 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\41.exe.vir
[2010/01/18 20:29:35 | 00,263,168 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\rkill.com
[2010/01/16 12:49:34 | 00,001,737 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\HijackThis.lnk
[2009/04/12 21:31:10 | 00,137,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\ethgqasu.sys
[2007/03/19 17:43:26 | 00,000,026 | ---- | C] () -- C:\WINDOWS\dvdSanta.INI
[2007/01/23 22:06:58 | 00,000,024 | ---- | C] () -- C:\WINDOWS\System32\sysogg.dll
[2007/01/23 22:00:31 | 00,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2007/01/18 20:37:09 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/09/14 20:41:53 | 00,000,296 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2006/08/11 18:04:57 | 00,000,126 | ---- | C] () -- C:\Documents and Settings\orl\Local Settings\Application Data\fusioncache.dat
[2006/08/09 21:10:49 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/06 15:39:58 | 00,001,039 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/06 15:36:33 | 00,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/06 15:36:31 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/06 15:18:57 | 00,069,120 | ---- | C] () -- C:\Documents and Settings\orl\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/07/03 16:13:28 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/07/03 15:53:10 | 00,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2006/07/03 15:52:41 | 00,002,424 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI
[2006/07/03 15:45:54 | 00,007,585 | ---- | C] () -- C:\WINDOWS\HDReg.ini
[2006/07/03 15:42:41 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2006/07/03 15:42:41 | 00,225,280 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2006/07/03 15:33:26 | 00,221,184 | ---- | C] () -- C:\WINDOWS\System32\slmdmsp.dll
[2006/07/03 15:33:26 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\slmdmgx.dll
[2006/07/03 15:33:26 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\slmdmco.dll
[2006/07/03 15:31:53 | 00,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2006/07/03 15:30:32 | 00,011,279 | R--- | C] () -- C:\WINDOWS\System32\drivers\STDSB.sys
[2006/07/03 15:30:32 | 00,003,584 | R--- | C] () -- C:\WINDOWS\System32\drivers\mxkeybd.dll
[2006/07/03 15:30:31 | 00,001,495 | R--- | C] () -- C:\WINDOWS\System32\drivers\HotKey.ini
[2005/06/17 10:41:00 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2005/05/20 13:05:02 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 16:13:32 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/06/23 13:14:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/03/26 14:19:44 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBLLCNP.DLL
[2002/11/13 15:40:22 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxblvs.dll

========== LOP Check ==========

[2006/07/03 15:51:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OD2
[2006/07/03 15:45:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/04 19:34:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2006/11/29 21:51:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Canon
[2006/11/07 16:47:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Leadertech
[2006/08/05 19:53:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\OD2
[2007/09/18 15:24:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Opera
[2010/01/19 19:30:01 | 00,000,224 | ---- | M] () -- C:\WINDOWS\Tasks\Master CD_DVD Creator.job

========== Purity Check ==========

< End of report >

ActorSeeksJob · 20-01-2010 12:02am

hi

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O4 - HKLM..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe ()
O29 - HKLM SecurityProviders - (digiwet.dll) - File not found
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26602806-03e1-11dd-9478-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{26602809-03e1-11dd-9478-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{555df7a2-187a-11dd-9494-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{555df7a3-187a-11dd-9494-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f808-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f809-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f80a-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8450f80d-9708-11de-970d-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9266a57e-e7aa-11db-9314-00038a000015}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{d95b7781-052f-11df-8223-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{d95b7781-052f-11df-8223-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d95b7781-052f-11df-8223-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea80-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea81-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{df91ea82-0599-11dd-947a-00038a000015}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
[2006/07/03 15:42:41 | 00,015,000 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys
[2010/01/18 23:59:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe.vir

:Services

:Reg

:Files

:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases

[*]Click on My Computer under Scan.
[*]Once the scan is complete, it will display the results. Click on View Scan Report.
[*]You will see a list of infected items there. Click on Save Report As....
[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

homerun_homer · 20-01-2010 8:30pm

Malwarebytes' Anti-Malware 1.44
Database version: 3600
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20/01/2010 20:23:39
mbam-log-2010-01-20 (20-23-39).txt

Scan type: Quick Scan
Objects scanned: 110331
Time elapsed: 6 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dll,schannel.dll,digest.dll,msnsspc.dll,) Good: (msapsspc.dll, ,schannel.dll, ,digest.dll, ,msnsspc.dll, ,.dll) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

homerun_homer · 24-01-2010 8:27pm

Malwarebytes still picks up virus' and my sister ran the Kapersky scan on all critical areas and it came up clear but she didn't get me the report.

ASJ112 · 24-01-2010 9:35pm

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

homerun_homer · 26-01-2010 6:57pm

My sister installed AVG between my last post and now and it couldn't be fully uninstalled.

ComboFix 10-01-26.01 - orl 26/01/2010 18:17:22.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.447.178 [GMT 0:00]
Running from: c:\documents and settings\orl\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-3575659886-1655123198-1239249821-1003
c:\windows\system32\drivers\eicon.txt
c:\windows\system32\Thumbs.db

c:\windows\system32\DRIVERS\atapi.sys . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-12-26 to 2010-01-26 )))))))))))))))))))))))))))))))
.

2010-01-25 19:34 . 2010-01-25 21:30

d

w- C:\$AVG
2010-01-25 19:34 . 2010-01-25 19:34 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-25 19:34 . 2010-01-25 19:34 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-25 19:34 . 2010-01-25 19:34 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-25 19:34 . 2010-01-25 19:34 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-25 19:33 . 2010-01-26 18:02

d

w- c:\windows\system32\drivers\Avg
2010-01-25 19:33 . 2010-01-25 19:48

d

w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-01-25 19:32 . 2010-01-25 19:32

d

w- c:\program files\AVG
2010-01-25 19:32 . 2010-01-26 18:01

d

w- c:\documents and settings\All Users\Application Data\avg9
2010-01-19 21:29 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 21:29 . 2010-01-19 21:32

d

w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 21:29 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 19:15 . 2010-01-19 19:15

d

w- C:\_OTL
2010-01-19 19:09 . 2010-01-19 19:09

d

w- c:\program files\ERUNT
2010-01-18 23:50 . 2010-01-18 23:50

d

w- C:\_OTM
2010-01-18 23:33 . 2010-01-18 23:35

d

w- C:\!KillBox
2010-01-16 12:49 . 2010-01-16 12:49

d

w- c:\program files\Trend Micro
2010-01-16 07:38 . 2009-11-21 15:51 471552

w- c:\windows\system32\dllcache\aclayers.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 18:35 . 2007-01-27 15:17

d

w- c:\documents and settings\All Users\Application Data\Skype
2010-01-19 21:32 . 2010-01-19 21:32 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-23 21:22 . 2007-04-10 21:29

d

w- c:\documents and settings\orl\Application Data\U3
2009-12-21 19:14 . 2004-08-10 15:38 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-25 13:01 . 2010-01-25 19:48 1230080 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-11-21 15:51 . 2004-08-10 15:37 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 16:40 . 2009-04-12 21:31 137312 ----a-w- c:\windows\system32\drivers\ethgqasu.sys
2009-10-29 16:39 . 2009-10-29 16:39 13824 ----a-w- c:\windows\system32\soaqxavn.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 13:01 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-12-08 975360]
"Skype"="c:\apps\SKYPE\PHONE\SKYPE.EXE" [2005-06-29 17605160]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-19 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"VTTimer"="VTTimer.exe" [2005-03-08 53248]
"VTTrayp"="VTtrayp.exe" [2005-09-14 167936]
"STDSB"="c:\windows\system32\drivers\STDSB.exe" [2003-12-17 28672]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-06 180269]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-25 2033432]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-01-25 19:34 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, .dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\soaqxavn.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [25/01/2010 19:34 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [25/01/2010 19:34 360584]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [25/01/2010 19:32 285392]
R2 MTC0007_STDSB;Scroll Bar Driver;c:\windows\system32\drivers\STDSB.sys [03/07/2006 15:30 11279]
S1 ethgqasu;ethgqasu;c:\windows\system32\drivers\ethgqasu.sys [12/04/2009 21:31 137312]
S2 STDSB;STDSB;c:\windows\system32\drivers\STDSB.sys [03/07/2006 15:30 11279]
.
Contents of the 'Scheduled Tasks' folder

2009-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2010-01-26 c:\windows\Tasks\Master CD_DVD Creator.job
- c:\apps\SMP\MCDCHECK.EXE [2005-11-08 14:26]
.
.

Supplementary Scan

.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
AddRemove-Dynamic Toolbar_is1 - c:\program files\Dynamic Toolbar\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 18:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

DLLs Loaded Under Running Processes

- - - - - - - > 'explorer.exe'(2524)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.

Other Running Processes

.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\apps\HIDSERVICE\HIDSERVICE.exe
c:\windows\system32\slmdmsr.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\apps\Powercinema\Kernel\TV\CLSched.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\VTTimer.exe
c:\windows\system32\VTtrayp.exe
c:\windows\SOUNDMAN.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-26 18:41:51 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-26 18:41

Pre-Run: 15,050,145,792 bytes free
Post-Run: 15,383,543,808 bytes free

- - End Of File - - 3F59182BD660662D9CD1D30AFDBB7FF5

ASJ112 · 27-01-2010 12:06am

hi

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Driver::
ethgqasu

File::
c:\windows\system32\drivers\ethgqasu.sys
c:\windows\system32\drivers\ethgqasu.sys
c:\windows\system32\soaqxavn.exe

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\soaqxavn.exe"=-

KillAll::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

homerun_homer · 27-01-2010 6:41pm

ComboFix 10-01-26.01 - orl 27/01/2010 18:23:14.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.447.167 [GMT 0:00]
Running from: c:\documents and settings\orl\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\orl\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\drivers\ethgqasu.sys"
"c:\windows\system32\soaqxavn.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ethgqasu.sys
c:\windows\system32\soaqxavn.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

\Service_ethgqasu

((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-25 19:34 . 2010-01-27 18:16

d

w- C:\$AVG
2010-01-25 19:32 . 2010-01-25 19:32

d

w- c:\program files\AVG
2010-01-25 19:32 . 2010-01-27 18:16

d

w- c:\documents and settings\All Users\Application Data\avg9
2010-01-19 21:29 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 21:29 . 2010-01-19 21:32

d

w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 21:29 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 19:15 . 2010-01-19 19:15

d

w- C:\_OTL
2010-01-19 19:09 . 2010-01-19 19:09

d

w- c:\program files\ERUNT
2010-01-18 23:50 . 2010-01-18 23:50

d

w- C:\_OTM
2010-01-18 23:33 . 2010-01-18 23:35

d

w- C:\!KillBox
2010-01-16 12:49 . 2010-01-16 12:49

d

w- c:\program files\Trend Micro
2010-01-16 07:38 . 2009-11-21 15:51 471552

w- c:\windows\system32\dllcache\aclayers.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-27 18:32 . 2007-01-27 15:17

d

w- c:\documents and settings\All Users\Application Data\Skype
2010-01-19 21:32 . 2010-01-19 21:32 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-23 21:22 . 2007-04-10 21:29

d

w- c:\documents and settings\orl\Application Data\U3
2009-12-21 19:14 . 2004-08-10 15:38 916480

w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-10 15:37 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-12-08 975360]
"Skype"="c:\apps\SKYPE\PHONE\SKYPE.EXE" [2005-06-29 17605160]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-19 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
"VTTimer"="VTTimer.exe" [2005-03-08 53248]
"VTTrayp"="VTtrayp.exe" [2005-09-14 167936]
"STDSB"="c:\windows\system32\drivers\STDSB.exe" [2003-12-17 28672]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-06 180269]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, .dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=

R2 MTC0007_STDSB;Scroll Bar Driver;c:\windows\system32\drivers\STDSB.sys [03/07/2006 15:30 11279]
S2 STDSB;STDSB;c:\windows\system32\drivers\STDSB.sys [03/07/2006 15:30 11279]
.
Contents of the 'Scheduled Tasks' folder

2009-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2010-01-26 c:\windows\Tasks\Master CD_DVD Creator.job
- c:\apps\SMP\MCDCHECK.EXE [2005-11-08 14:26]
.
.

Supplementary Scan

.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-27 18:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

DLLs Loaded Under Running Processes

- - - - - - - > 'explorer.exe'(520)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.

Other Running Processes

.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\apps\HIDSERVICE\HIDSERVICE.exe
c:\windows\system32\slmdmsr.exe
c:\windows\system32\wdfmgr.exe
c:\apps\Powercinema\Kernel\TV\CLSched.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\VTTimer.exe
c:\windows\system32\VTtrayp.exe
c:\windows\SOUNDMAN.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-27 18:36:53 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-27 18:36
ComboFix2.txt 2010-01-26 18:41

Pre-Run: 15,463,727,104 bytes free
Post-Run: 15,442,141,184 bytes free

- - End Of File - - 644A6B32CF5BEFE57F818569D18C0FBD

ASJ112 · 27-01-2010 10:30pm

open OTL click quick scan post that log

homerun_homer · 27-01-2010 11:18pm

OTL logfile created on: 27/01/2010 23:12:29 - Run 3
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\orl\Desktop\Antivirus software
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.00 Mb Total Physical Memory | 166.00 Mb Available Physical Memory | 37.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 38.77 Gb Total Space | 14.40 Gb Free Space | 37.15% Space Free | Partition Type: NTFS

Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PQ3LZ12
Current User Name: orl
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\Antivirus software\OTL.exe
PRC - [2009/07/13 13:03:10 | 00,292,128 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/06/19 14:57:23 | 00,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/04/14 00:12:41 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/12 03:00:36 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
PRC - [2006/08/06 15:39:05 | 00,180,269 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2005/12/08 15:39:08 | 00,975,360 | ---- | M] (Packard Bell BV) -- C:\APPS\SMP\SMPSYS.EXE
PRC - [2005/09/30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/09/14 12:47:44 | 00,167,936 | ---- | M] (S3 Graphics Co., Ltd.) -- C:\WINDOWS\system32\VTTrayp.exe
PRC - [2005/08/17 17:39:58 | 00,090,112 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/06/29 18:09:42 | 17,605,160 | ---- | M] () -- C:\APPS\skype\phone\Skype.exe
PRC - [2005/05/11 12:52:04 | 00,737,381 | ---- | M] (Cyberlink) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
PRC - [2005/05/11 12:52:00 | 00,061,440 | ---- | M] (Cyberlink) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
PRC - [2005/05/11 12:50:34 | 00,110,672 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe
PRC - [2005/05/11 12:50:14 | 00,221,266 | ---- | M] () -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
PRC - [2005/05/11 12:48:02 | 00,127,118 | ---- | M] (CyberLink Corp.) -- C:\APPS\Powercinema\PCMService.exe
PRC - [2005/05/10 18:53:26 | 00,061,440 | ---- | M] ( ) -- C:\WINDOWS\system32\slmdmsr.exe
PRC - [2005/03/10 17:44:34 | 00,098,394 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2005/03/10 17:43:30 | 00,688,218 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PRC - [2005/03/08 02:33:28 | 00,053,248 | ---- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe
PRC - [2005/01/07 11:01:52 | 00,049,152 | ---- | M] () -- c:\APPS\HIDSERVICE\HidService.exe
PRC - [2004/04/08 07:38:26 | 01,135,728 | ---- | M] (America Online, Inc.) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2003/12/17 15:50:44 | 00,028,672 | R--- | M] () -- C:\WINDOWS\system32\drivers\STDSB.exe
PRC - [2003/03/26 14:17:14 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE
PRC - [2003/03/26 14:16:04 | 00,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXPPS.EXE

========== Modules (SafeList) ==========

MOD - [2010/01/19 19:14:28 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\orl\Desktop\Antivirus software\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/07/13 13:02:50 | 00,542,496 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/05/02 09:22:52 | 00,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2007/06/27 18:22:44 | 00,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2005/10/06 17:12:30 | 00,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)
SRV - [2005/09/30 19:22:50 | 00,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2005/05/11 12:52:00 | 00,061,440 | ---- | M] (Cyberlink) [Auto | Running] -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe -- (CyberLink Media Library Service)
SRV - [2005/05/11 12:50:34 | 00,110,672 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2005/05/11 12:50:14 | 00,221,266 | ---- | M] () [Auto | Running] -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2005/05/10 18:53:26 | 00,061,440 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slmdmsr.exe -- (SLService)
SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/01/07 11:01:52 | 00,049,152 | ---- | M] () [Auto | Running] -- c:\APPS\HIDSERVICE\HidService.exe -- (GenericHidService)
SRV - [2004/04/08 07:38:26 | 01,135,728 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)
SRV - [2003/03/26 14:17:14 | 00,303,104 | ---- | M] (Lexmark International, Inc.) [Auto | Running] -- C:\WINDOWS\system32\LEXBCES.EXE -- (LexBceS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2010/01/27 18:31:47 | 00,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKCU..\Run: [Skype] C:\APPS\SKYPE\PHONE\SKYPE.EXE ()
O4 - HKCU..\Run: [SmpcSys] C:\APPS\SMP\SMPSYS.EXE (Packard Bell BV)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} http://0-site.ebrary.com.mislibsrv.lit.ie/lib/limerickit/support/plugins/ebraryRdr.cab (Infotl Control)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://orlaith1978.spaces.live.com//PhotoUpload/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/FacebookPhotoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://go.divx.com/plugin/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\orl\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\orl\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O29 - HKLM SecurityProviders - (.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/01/27 18:36:56 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/01/27 18:17:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/27 18:15:09 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/27 18:15:09 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/27 18:15:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/26 18:05:04 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/01/26 18:05:03 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/01/26 18:05:03 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/01/26 18:05:03 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/01/26 17:58:26 | 00,000,000 | ---D | C] -- C:\Qoobox
[2010/01/26 17:48:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\orl\Desktop\Antivirus software
[2010/01/25 19:34:35 | 00,000,000 | ---D | C] -- C:\$AVG
[2010/01/25 19:32:46 | 00,000,000 | ---D | C] -- C:\Program Files\AVG
[2010/01/25 19:32:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/01/19 21:29:51 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/19 21:29:48 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/19 21:29:48 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/19 19:15:36 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/19 19:10:17 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/01/19 19:09:46 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/01/18 23:50:27 | 00,000,000 | ---D | C] -- C:\_OTM
[2010/01/18 23:33:04 | 00,000,000 | ---D | C] -- C:\!KillBox
[2010/01/16 12:49:34 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/18 14:22:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple

========== Files - Modified Within 14 Days ==========

[2010/01/27 23:11:14 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/27 23:11:00 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/27 23:10:58 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/27 23:10:56 | 46,928,6912 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/27 18:40:31 | 05,505,024 | -H-- | M] () -- C:\Documents and Settings\orl\NTUSER.DAT
[2010/01/27 18:40:31 | 00,000,278 | -HS- | M] () -- C:\Documents and Settings\orl\ntuser.ini
[2010/01/27 18:32:05 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/01/27 18:31:47 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/26 18:00:02 | 00,000,224 | ---- | M] () -- C:\WINDOWS\tasks\Master CD_DVD Creator.job
[2010/01/26 17:56:32 | 03,837,151 | R--- | M] () -- C:\Documents and Settings\orl\Desktop\ComboFix.exe
[2010/01/25 20:00:27 | 00,053,248 | ---- | M] () -- C:\Documents and Settings\orl\My Documents\Knit your own tea cosy.doc
[2010/01/25 18:54:41 | 00,355,918 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\IMG00251.jpg
[2010/01/22 00:09:03 | 00,528,896 | ---- | M] () -- C:\Documents and Settings\orl\Desktop\No threats found.doc
[2010/01/19 21:29:53 | 00,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/17 11:44:00 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2010/01/27 18:17:55 | 46,928,6912 | -HS- | C] () -- C:\hiberfil.sys
[2010/01/26 18:05:04 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/01/26 18:05:03 | 00,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/01/26 18:05:03 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/01/26 18:05:03 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/01/26 18:05:03 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/01/26 17:56:00 | 03,837,151 | R--- | C] () -- C:\Documents and Settings\orl\Desktop\ComboFix.exe
[2010/01/25 20:00:27 | 00,053,248 | ---- | C] () -- C:\Documents and Settings\orl\My Documents\Knit your own tea cosy.doc
[2010/01/25 18:54:37 | 00,355,918 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\IMG00251.jpg
[2010/01/22 00:09:02 | 00,528,896 | ---- | C] () -- C:\Documents and Settings\orl\Desktop\No threats found.doc
[2010/01/19 21:29:53 | 00,000,699 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2007/03/19 17:43:26 | 00,000,026 | ---- | C] () -- C:\WINDOWS\dvdSanta.INI
[2007/01/23 22:06:58 | 00,000,024 | ---- | C] () -- C:\WINDOWS\System32\sysogg.dll
[2007/01/23 22:00:31 | 00,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2007/01/18 20:37:09 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/09/14 20:41:53 | 00,000,296 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2006/08/11 18:04:57 | 00,000,126 | ---- | C] () -- C:\Documents and Settings\orl\Local Settings\Application Data\fusioncache.dat
[2006/08/09 21:10:49 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/06 15:39:58 | 00,001,039 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/06 15:36:33 | 00,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/08/06 15:36:31 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/06 15:18:57 | 00,069,120 | ---- | C] () -- C:\Documents and Settings\orl\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/07/03 16:13:28 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/07/03 15:53:10 | 00,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2006/07/03 15:52:41 | 00,002,424 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI
[2006/07/03 15:45:54 | 00,007,585 | ---- | C] () -- C:\WINDOWS\HDReg.ini
[2006/07/03 15:42:41 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll
[2006/07/03 15:42:41 | 00,225,280 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll
[2006/07/03 15:33:26 | 00,221,184 | ---- | C] () -- C:\WINDOWS\System32\slmdmsp.dll
[2006/07/03 15:33:26 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\slmdmgx.dll
[2006/07/03 15:33:26 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\slmdmco.dll
[2006/07/03 15:31:53 | 00,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2006/07/03 15:30:32 | 00,011,279 | R--- | C] () -- C:\WINDOWS\System32\drivers\STDSB.sys
[2006/07/03 15:30:32 | 00,003,584 | R--- | C] () -- C:\WINDOWS\System32\drivers\mxkeybd.dll
[2006/07/03 15:30:31 | 00,001,495 | R--- | C] () -- C:\WINDOWS\System32\drivers\HotKey.ini
[2005/06/17 10:41:00 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2005/05/20 13:05:02 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 16:13:32 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/06/23 13:14:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/03/26 14:19:44 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBLLCNP.DLL
[2002/11/13 15:40:22 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxblvs.dll

========== LOP Check ==========

[2010/01/27 18:16:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2006/07/03 15:51:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OD2
[2006/07/03 15:45:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/04 19:34:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2006/11/29 21:51:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Canon
[2006/11/07 16:47:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Leadertech
[2006/08/05 19:53:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\OD2
[2007/09/18 15:24:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\orl\Application Data\Opera
[2010/01/26 18:00:02 | 00,000,224 | ---- | M] () -- C:\WINDOWS\Tasks\Master CD_DVD Creator.job

========== Purity Check ==========

< End of report >

ASJ112 · 28-01-2010 12:32am

hi

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O29 - HKLM SecurityProviders - (.dll) - File not found

:Services

:Reg

:Files

:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Your logs are clean

Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
Please follow the prompts to uninstall Combofix.
You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

Download OTC to your desktop and run it
Click Yes to beginning the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
Please read my guide on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

homerun_homer · 28-01-2010 7:18pm

Excellent - Thanks Very Much

'scorthy · 29-01-2010 1:02pm

Had (even might still have:mad:) this scareware IS2010. Not my PC but downloaded by the uninitiated. Bugger to get rid of. Great post above on how to get rid of it. I ran several anti-mal/spy/scareware & virus programmes and still when I went into the reg in safemode that bas!a"rd was there.
Also LSP helper32.dll
I posted before about not being able to get internet access on this infected PC - still can't. Will have to do a re-install.:(

Dim · 12-02-2010 7:40pm

I feel your pain ... just re-installed everything :mad: malware byte did not help

Another 'Internet Security 2010' issue

Comments