WiredWX Christian Hobby Weather Tools
Would you like to react to this message? Create an account in a few clicks or log in to continue.

WiredWX Christian Hobby Weather ToolsLog in

 


descriptiontrojans removed but left with redirect virus Emptytrojans removed but left with redirect virus

more_horiz
last night i visited a site which avg blocked but after this my security programs were disabled and i couldnt open any apps i managed to get rid of some stuff in safe mode and then installed avast which found 3 more problems. i have since got rid of more using mbam, spybot and superantispyware but i am now left with google chrome crashing and firefox and IE8 redirecting me to random sites. i have ran OTL and this is the results

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/04/27 16:18:56 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
PRC - [2010/04/14 17:47:08 | 002,790,472 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/04/07 16:38:18 | 000,221,184 | ---- | M] (SnoopFree Software) -- C:\WINNT\SnoopFreeUI.exe
PRC - [2010/04/07 16:38:18 | 000,090,112 | ---- | M] () -- C:\WINNT\system32\SnoopFreeSvc.exe
PRC - [2010/04/01 19:00:32 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/11/09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/21 11:26:10 | 003,068,352 | ---- | M] (Kontiki Inc.) -- C:\Program Files\Kontiki\KService.exe
PRC - [2008/10/21 11:26:10 | 001,032,640 | ---- | M] (Kontiki Inc.) -- C:\Program Files\Kontiki\KHost.exe
PRC - [2008/08/19 14:26:44 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINNT\SOUNDMAN.EXE
PRC - [2008/06/19 17:42:44 | 002,808,832 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINNT\ALCWZRD.EXE
PRC - [2007/06/13 11:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe
PRC - [2007/03/22 12:09:16 | 004,540,120 | ---- | M] ( ) -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe
PRC - [2007/03/22 12:09:16 | 001,689,304 | ---- | M] ( ) -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
PRC - [2007/03/22 12:09:16 | 000,079,456 | ---- | M] () -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\defragActivityMonitor.exe


========== Modules (SafeList) ==========

MOD - [2010/04/27 16:18:56 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
MOD - [2010/04/07 16:38:18 | 000,045,056 | ---- | M] () -- C:\WINNT\SnoopFreeDll.dll
MOD - [2006/08/25 16:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/04/07 16:38:18 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\WINNT\system32\SnoopFreeSvc.exe -- (SnoopFreeSvc)
SRV - [2008/11/09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/10/21 11:26:10 | 003,068,352 | ---- | M] (Kontiki Inc.) [Auto | Running] -- C:\Program Files\Kontiki\KService.exe -- (KService)
SRV - [2007/03/22 12:09:16 | 001,689,304 | ---- | M] ( ) [Auto | Running] -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe -- (AshampooDefragService)
SRV - [2006/10/04 09:48:37 | 000,050,176 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINNT\system32\utilman.exe -- (UtilMan)


========== Driver Services (SafeList) ==========

DRV - [2010/04/14 17:35:47 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINNT\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/04/14 17:35:25 | 000,162,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINNT\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/04/14 17:31:39 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/04/14 17:31:12 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINNT\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/04/14 17:31:01 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINNT\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/04/14 17:30:45 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINNT\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/04/07 16:38:18 | 000,009,472 | ---- | M] () [Kernel | Boot | Running] -- C:\WINNT\System32\Drivers\SnopFree.sys -- (SnoopFree)
DRV - [2009/03/30 18:13:30 | 005,063,168 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/08/05 21:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\ambfilt.sys -- (Ambfilt)
DRV - [2007/05/08 11:35:43 | 000,073,928 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2007/02/28 21:56:07 | 000,015,440 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINNT\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV - [2007/01/13 11:33:18 | 005,672,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2006/01/04 16:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005/11/09 19:54:56 | 000,402,944 | ---- | M] (Belkin Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\BLKWGU.sys -- (BLKWGU(Belkin)) Belkin Wireless G USB Network Adapter(Belkin)
DRV - [2005/01/07 18:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\Hdaudbus.sys -- (HDAudBus)
DRV - [2005/01/07 18:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/10/24 22:40:58 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2003/06/19 13:05:04 | 000,049,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\usbhub20.sys -- (usbhub20)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/03 15:19:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/27 16:26:11 | 000,000,000 | ---D | M]

[2010/04/03 15:19:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Geo\Application Data\Mozilla\Extensions
[2010/04/27 16:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Geo\Application Data\Mozilla\Firefox\Profiles\9yxxtgwz.default\extensions
[2010/04/05 15:54:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Geo\Application Data\Mozilla\Firefox\Profiles\9yxxtgwz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/07 17:33:53 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Geo\Application Data\Mozilla\Firefox\Profiles\9yxxtgwz.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/04/27 16:28:23 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/27 16:26:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/27 16:25:45 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/04/01 17:56:49 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/01 17:56:50 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/01 17:56:50 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/01 17:56:50 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/04/27 06:24:41 | 000,391,995 | R--- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 13564 more lines...
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [AlcWzrd] C:\WINNT\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINNT\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKLM..\Run: [SnoopFreeUI] C:\WINNT\SnoopFreeUI.exe (SnoopFree Software)
O4 - HKLM..\Run: [SoundMan] C:\WINNT\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ashampoo Magical Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe ( )
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe (Belkin Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINNT\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\wzcnotif: DllName - wzcdlg.dll - C:\WINNT\System32\wzcdlg.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINNT\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINNT\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/14 21:26:57 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINNT\system32\ias [2010/02/14 22:05:27 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: AnyDVD - hkey= - key= - C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe (SlySoft, Inc.)

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NBF - Service
SafeBootNet: nbf.sys - Driver
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6A5110B5-E14B-4268-A065-EF89FF33C325} - regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINNT\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINNT\system32\Rundll32.exe c:\WINNT\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {A00BF2EB-56EE-4fde-B5EA-6A8FA425B2A5} - W2KAppComp
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINNT\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINNT\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINNT\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINNT\system32\rundll32.exe" "C:\WINNT\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
Drivers32: aux - C:\WINNT\System32\mmdrv.dll (Microsoft Corporation)
Drivers32: aux2 - File not found
Drivers32: aux3 - File not found
Drivers32: aux4 - File not found
Drivers32: aux5 - File not found
Drivers32: aux6 - File not found
Drivers32: aux7 - File not found
Drivers32: aux8 - File not found
Drivers32: aux9 - File not found
Drivers32: midi1 - File not found
Drivers32: midi2 - File not found
Drivers32: midi3 - File not found
Drivers32: midi4 - File not found
Drivers32: midi5 - File not found
Drivers32: midi6 - File not found
Drivers32: midi7 - File not found
Drivers32: midi8 - File not found
Drivers32: midi9 - File not found
Drivers32: mixer1 - File not found
Drivers32: mixer2 - File not found
Drivers32: mixer3 - File not found
Drivers32: mixer4 - File not found
Drivers32: mixer5 - File not found
Drivers32: mixer6 - File not found
Drivers32: mixer7 - File not found
Drivers32: mixer8 - File not found
Drivers32: mixer9 - File not found
Drivers32: msacm.ac3acm - C:\WINNT\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINNT\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINNT\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINNT\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINNT\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINNT\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINNT\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINNT\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINNT\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINNT\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv50 - C:\WINNT\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.wmv3 - C:\WINNT\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINNT\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINNT\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: wave1 - File not found
Drivers32: wave2 - File not found
Drivers32: wave3 - File not found
Drivers32: wave4 - File not found
Drivers32: wave5 - File not found
Drivers32: wave6 - File not found
Drivers32: wave7 - File not found
Drivers32: wave8 - File not found
Drivers32: wave9 - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17465059307421696)

========== Files/Folders - Created Within 30 Days ==========

[2010/04/27 16:30:26 | 000,000,000 | ---D | C] -- C:\WINNT\System32\appmgmt
[2010/04/27 16:27:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Geo\Recent
[2010/04/27 16:26:11 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\deployJava1.dll
[2010/04/27 16:26:11 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaws.exe
[2010/04/27 16:26:11 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javacpl.cpl
[2010/04/27 16:26:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaw.exe
[2010/04/27 16:26:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\java.exe
[2010/04/27 16:18:52 | 000,563,712 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
[2010/04/27 05:53:02 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/04/27 02:35:49 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/04/27 02:34:42 | 000,019,024 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswFsBlk.sys
[2010/04/27 02:34:41 | 000,162,768 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2010/04/27 02:34:39 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2010/04/27 02:34:38 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2010/04/27 02:34:35 | 000,100,432 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2010/04/27 02:34:35 | 000,094,800 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2010/04/27 02:34:35 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2010/04/27 02:34:08 | 000,153,184 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\aswBoot.exe
[2010/04/27 02:34:08 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\avastSS.scr
[2010/04/27 02:33:46 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/04/27 02:33:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/04/27 02:16:19 | 000,000,000 | ---D | C] -- C:\WINNT\System32\avgrsstx.dll
[2010/04/27 01:46:18 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\mouclass.sys
[2010/04/27 01:44:26 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/04/27 01:42:20 | 000,000,000 | ---D | C] -- C:\WINNT\ERDNT
[2010/04/27 01:17:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/04/27 01:17:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/04/24 15:24:12 | 000,000,000 | ---D | C] -- C:\Kontiki
[2010/04/24 15:13:29 | 000,000,000 | ---D | C] -- C:\WINNT\Minidump
[2010/04/16 16:08:09 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/04/07 16:38:18 | 000,221,184 | ---- | C] (SnoopFree Software) -- C:\WINNT\SnoopFreeUI.exe
[2010/04/03 15:19:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Geo\Application Data\Mozilla
[2010/04/02 17:54:23 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\spmsgXP_2k3.dll
[2010/04/02 17:53:53 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\WdfCoInstaller01007.dll
[2010/04/02 17:49:31 | 000,000,000 | ---D | C] -- C:\Program Files\NetRatingsNetSight
[2010/04/01 23:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/03/30 22:34:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Geo\Application Data\WinRAR
[2010/03/30 22:10:45 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[6 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/04/27 16:34:02 | 000,000,968 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1202660629-725345543-1000UA.job
[2010/04/27 16:25:44 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\deployJava1.dll
[2010/04/27 16:25:44 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaws.exe
[2010/04/27 16:25:44 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaw.exe
[2010/04/27 16:25:44 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\java.exe
[2010/04/27 16:25:44 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javacpl.cpl
[2010/04/27 16:18:56 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
[2010/04/27 07:34:02 | 000,000,916 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1202660629-725345543-1000Core.job
[2010/04/27 06:24:41 | 000,391,995 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts
[2010/04/27 06:10:42 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\Geo\Desktop\HiJackThis.lnk
[2010/04/27 06:09:07 | 000,002,228 | ---- | M] () -- C:\WINNT\System32\wpa.dbl
[2010/04/27 06:08:10 | 000,000,006 | -H-- | M] () -- C:\WINNT\tasks\SA.DAT
[2010/04/27 06:07:16 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat
[2010/04/27 06:06:32 | 006,291,456 | -H-- | M] () -- C:\Documents and Settings\Geo\NTUSER.DAT
[2010/04/27 06:06:32 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Geo\ntuser.ini
[2010/04/27 06:06:26 | 005,364,128 | -H-- | M] () -- C:\Documents and Settings\Geo\Local Settings\Application Data\IconCache.db
[2010/04/27 02:34:43 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/04/27 02:34:36 | 000,002,626 | ---- | M] () -- C:\WINNT\System32\CONFIG.NT
[2010/04/27 02:03:04 | 000,000,227 | ---- | M] () -- C:\WINNT\system.ini
[2010/04/27 02:02:27 | 000,000,027 | ---- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100427-062441.backup
[2010/04/27 01:44:33 | 000,000,277 | RHS- | M] () -- C:\boot.ini
[2010/04/27 00:26:32 | 000,010,166 | -HS- | M] () -- C:\Documents and Settings\Geo\Local Settings\Application Data\6Kw2
[2010/04/27 00:26:32 | 000,010,166 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\6Kw2
[2010/04/25 13:53:44 | 000,310,613 | ---- | M] () -- C:\Documents and Settings\Geo\My Documents\FIFA 2010.pdf
[2010/04/21 07:35:42 | 000,002,268 | ---- | M] () -- C:\Documents and Settings\Geo\Desktop\Google Chrome.lnk
[2010/04/16 16:08:12 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\Geo\Desktop\CCleaner.lnk
[2010/04/16 12:58:05 | 000,000,040 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/04/14 23:00:16 | 000,081,920 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINNT\ALCFDRTM.VER
[2010/04/14 17:47:23 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\avastSS.scr
[2010/04/14 17:47:03 | 000,153,184 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\aswBoot.exe
[2010/04/14 17:35:47 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2010/04/14 17:35:25 | 000,162,768 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2010/04/14 17:31:39 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2010/04/14 17:31:12 | 000,100,432 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2010/04/14 17:31:09 | 000,094,800 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2010/04/14 17:31:01 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswFsBlk.sys
[2010/04/14 17:30:45 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2010/04/07 16:38:18 | 000,221,184 | ---- | M] (SnoopFree Software) -- C:\WINNT\SnoopFreeUI.exe
[2010/04/07 16:38:18 | 000,090,112 | ---- | M] () -- C:\WINNT\System32\SnoopFreeSvc.exe
[2010/04/07 16:38:18 | 000,045,056 | ---- | M] () -- C:\WINNT\SnoopFreeDll.dll
[2010/04/07 16:38:18 | 000,009,472 | ---- | M] () -- C:\WINNT\System32\drivers\SnopFree.sys
[2010/04/03 15:19:12 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/04/02 20:30:12 | 000,385,955 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100402-210656.backup
[2010/04/02 20:29:19 | 000,385,955 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100402-203012.backup
[2010/04/02 17:54:39 | 000,000,000 | -H-- | M] () -- C:\WINNT\System32\drivers\Msft_Kernel_nielprt_01007.Wdf
[2010/04/02 17:54:33 | 000,000,000 | -H-- | M] () -- C:\WINNT\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/03/30 17:14:31 | 000,516,596 | ---- | M] () -- C:\WINNT\System32\PerfStringBackup.INI
[2010/03/30 17:14:31 | 000,438,082 | ---- | M] () -- C:\WINNT\System32\perfh009.dat
[2010/03/30 17:14:31 | 000,069,442 | ---- | M] () -- C:\WINNT\System32\perfc009.dat
[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbam.sys
[2010/03/29 17:59:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbamswissarmy.sys
[2010/03/28 19:37:32 | 000,381,011 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100402-202919.backup
[6 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
========== Files Created - No Company Name ==========

[2010/04/27 02:34:43 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/04/27 00:00:45 | 000,010,166 | -HS- | C] () -- C:\Documents and Settings\Geo\Local Settings\Application Data\6Kw2
[2010/04/27 00:00:45 | 000,010,166 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\6Kw2
[2010/04/25 13:53:44 | 000,310,613 | ---- | C] () -- C:\Documents and Settings\Geo\My Documents\FIFA 2010.pdf
[2010/04/16 16:08:12 | 000,001,548 | ---- | C] () -- C:\Documents and Settings\Geo\Desktop\CCleaner.lnk
[2010/04/07 16:38:18 | 000,045,056 | ---- | C] () -- C:\WINNT\SnoopFreeDll.dll
[2010/04/07 16:38:18 | 000,009,472 | ---- | C] () -- C:\WINNT\System32\drivers\SnopFree.sys
[2010/04/07 16:38:17 | 000,090,112 | ---- | C] () -- C:\WINNT\System32\SnoopFreeSvc.exe
[2010/04/03 15:19:12 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/04/02 17:54:39 | 000,000,000 | -H-- | C] () -- C:\WINNT\System32\drivers\Msft_Kernel_nielprt_01007.Wdf
[2010/04/02 17:54:33 | 000,000,000 | -H-- | C] () -- C:\WINNT\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/02/15 03:35:42 | 000,765,952 | ---- | C] () -- C:\WINNT\System32\xvidcore.dll
[2010/02/15 03:35:42 | 000,180,224 | ---- | C] () -- C:\WINNT\System32\xvidvfw.dll
[2010/02/15 03:35:40 | 000,010,752 | ---- | C] () -- C:\WINNT\System32\ff_vfw.dll
[2010/02/15 03:35:40 | 000,000,547 | ---- | C] () -- C:\WINNT\System32\ff_vfw.dll.manifest
[2010/02/15 01:01:53 | 000,204,800 | ---- | C] () -- C:\WINNT\System32\igfxCoIn_v4764.dll
[2010/02/15 00:48:13 | 000,000,169 | ---- | C] () -- C:\WINNT\RtlRack.ini
[2010/02/14 22:01:35 | 000,001,793 | ---- | C] () -- C:\WINNT\System32\fxsperf.ini
[2010/02/14 21:33:15 | 000,000,132 | ---- | C] () -- C:\WINNT\ODBC.INI
[2005/07/11 23:44:42 | 000,015,872 | ---- | C] () -- C:\WINNT\System32\InsDrvZD64.DLL
[2004/03/23 01:38:00 | 000,028,672 | ---- | C] () -- C:\WINNT\System32\InsDrvZD.dll
[2003/06/18 13:00:00 | 000,176,400 | ---- | C] () -- C:\WINNT\System32\qcut.dll
[1999/09/25 11:36:24 | 000,088,816 | ---- | C] () -- C:\WINNT\System32\drivers\lvcam.sys
[1999/09/25 11:36:22 | 000,017,424 | ---- | C] () -- C:\WINNT\System32\drivers\lvsound.sys

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010/04/07 16:38:18 | 000,009,472 | ---- | M] () Unable to obtain MD5 -- C:\WINNT\system32\drivers\SnopFree.sys

< %systemroot%\System32\config\*.sav >
[2010/02/14 21:46:31 | 000,262,144 | ---- | M] () -- C:\WINNT\system32\config\default.sav
[2010/02/14 21:31:31 | 000,020,480 | ---- | M] () -- C:\WINNT\system32\config\security.sav
[2010/02/14 21:46:31 | 006,291,456 | ---- | M] () -- C:\WINNT\system32\config\software.sav
[2010/02/14 21:46:32 | 002,359,296 | ---- | M] () -- C:\WINNT\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2001/08/23 13:00:00 | 000,009,029 | ---- | M] () -- C:\WINNT\system32\ansi.sys
[2001/08/23 13:00:00 | 000,027,097 | ---- | M] () -- C:\WINNT\system32\country.sys
[2001/08/23 13:00:00 | 000,004,768 | ---- | M] () -- C:\WINNT\system32\himem.sys
[2001/08/23 13:00:00 | 000,042,809 | ---- | M] () -- C:\WINNT\system32\key01.sys
[2002/08/28 20:23:06 | 000,042,537 | ---- | M] () -- C:\WINNT\system32\keyboard.sys
[2001/08/23 13:00:00 | 000,027,866 | ---- | M] () -- C:\WINNT\system32\ntdos.sys
[2001/08/23 13:00:00 | 000,029,146 | ---- | M] () -- C:\WINNT\system32\ntdos404.sys
[2001/08/23 13:00:00 | 000,029,370 | ---- | M] () -- C:\WINNT\system32\ntdos411.sys
[2001/08/23 13:00:00 | 000,029,274 | ---- | M] () -- C:\WINNT\system32\ntdos412.sys
[2001/08/23 13:00:00 | 000,029,146 | ---- | M] () -- C:\WINNT\system32\ntdos804.sys
[2004/08/03 23:45:10 | 000,033,840 | ---- | M] () -- C:\WINNT\system32\ntio.sys
[2004/08/03 23:45:16 | 000,034,560 | ---- | M] () -- C:\WINNT\system32\ntio404.sys
[2004/08/03 23:45:12 | 000,035,648 | ---- | M] () -- C:\WINNT\system32\ntio411.sys
[2004/08/03 23:45:16 | 000,035,424 | ---- | M] () -- C:\WINNT\system32\ntio412.sys
[2004/08/03 23:45:14 | 000,034,560 | ---- | M] () -- C:\WINNT\system32\ntio804.sys
[2004/08/04 00:07:34 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\watchdog.sys
[2009/08/14 13:19:41 | 001,850,112 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\win32k.sys
[2004/01/13 20:30:00 | 000,017,151 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINNT\system32\ZDPNDIS5.SYS
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2004/08/04 01:56:42 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv01nt5.dll
[2004/08/04 01:56:42 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv02nt5.dll
[2004/08/04 01:56:42 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv05nt5.dll
[2004/08/04 01:56:42 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv07nt5.dll
[2004/08/04 01:56:42 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv08nt5.dll
[2004/08/04 01:56:42 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv09nt5.dll
[2004/08/04 01:56:42 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv11nt5.dll
[2004/08/04 01:56:42 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv01nt5.dll
[2004/08/04 01:56:42 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv02nt5.dll
[2004/08/04 01:56:42 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv04nt5.dll
[2004/08/04 01:56:42 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv06nt5.dll
[2004/08/04 01:56:42 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv10nt5.dll
[2004/08/04 01:56:42 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\ch7xxnt5.dll
[2004/08/04 01:56:46 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\siint5.dll
[2004/08/04 01:56:48 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\vchnt5.dll

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2010/02/14 21:26:57 | 000,000,000 | -H-- | M] () -- C:\AUTOEXEC.BAT
[2010/04/27 01:44:33 | 000,000,277 | RHS- | M] () -- C:\boot.ini
[2010/02/14 21:26:57 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
[2010/02/14 21:26:57 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/04/27 16:27:38 | 000,012,366 | ---- | M] () -- C:\JavaRa.log
[2010/02/14 21:26:57 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/02/14 22:22:24 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/02/14 22:22:24 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/04/27 06:07:10 | 1585,446,912 | -HS- | M] () -- C:\pagefile.sys

< %PROGRAMFILES%\*. >
[2010/02/14 21:24:25 | 000,000,000 | ---D | M] -- C:\Program Files\Accessories
[2010/03/08 22:16:01 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/04/27 02:33:46 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2010/02/15 03:22:17 | 000,000,000 | ---D | M] -- C:\Program Files\Ashampoo
[2010/02/14 23:54:46 | 000,000,000 | ---D | M] -- C:\Program Files\Belkin
[2010/03/23 23:21:44 | 000,000,000 | ---D | M] -- C:\Program Files\CA Yahoo! Anti-Spy
[2010/04/16 16:08:12 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2010/04/27 01:56:34 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/02/14 21:25:37 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2010/02/15 03:29:29 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/02/14 22:40:38 | 000,000,000 | ---D | M] -- C:\Program Files\DVDlab
[2010/02/15 02:51:24 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/02/14 22:35:42 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2010/03/31 06:43:03 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/04/27 16:21:19 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/02/15 03:35:41 | 000,000,000 | ---D | M] -- C:\Program Files\K-Lite Codec Pack
[2010/03/17 00:26:54 | 000,000,000 | ---D | M] -- C:\Program Files\Kontiki
[2010/04/02 01:07:03 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/15 01:26:09 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2010/02/14 21:27:19 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2010/02/15 21:05:38 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/03/11 08:27:22 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/04/27 15:30:43 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/03/17 12:14:35 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2010/02/14 22:01:50 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2010/03/17 12:10:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2010/02/14 22:24:05 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/04/02 17:49:31 | 000,000,000 | ---D | M] -- C:\Program Files\NetRatingsNetSight
[2010/02/14 22:02:08 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
pah i give up.evertime i try to add the log posts it says connection has timed out

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
Hello.
If the log is too long, please attach the logs.

Guide for attaching:
http://www.GeekPolice.net/tutorials-guides-f13/how-to-upload-an-attatchment-t21024.htm

............................................................................................

Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
trojans removed but left with redirect virus DXwU4
trojans removed but left with redirect virus VvYDg

descriptiontrojans removed but left with redirect virus Emptylog file

more_horiz
ok i tried it but i get a message sayin ' the uploaded file is not valid '

Last edited by ThE_RoGuE on 27th April 2010, 10:05 pm; edited 1 time in total (Reason for editing : log file not attached)

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
Copy the log to a new Notepad file, save that and then try upload that.

............................................................................................

Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
trojans removed but left with redirect virus DXwU4
trojans removed but left with redirect virus VvYDg

descriptiontrojans removed but left with redirect virus EmptyRe: trojans removed but left with redirect virus

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum