MALWARE problem please help

2 posters

GeekPolice :: GeekPolice tech support archive :: Technical Support

MALWARE problem please help27th May 2011, 11:18 pm

Currently only able to connect to the internet in safe mode.
I ran all the pre-posting stuff in safe mode.
Whatever is in my machine has disabled my AVAST from running.
I sure hope you can help.
OTL LOG.....

Last edited by ajax_voodoo on 28th May 2011, 4:20 am; edited 1 time in total

Re: MALWARE problem please help28th May 2011, 4:19 am

OTL logfile created on: 5/27/2011 7:33:09 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Administrator.USER-4\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.53 Mb Total Physical Memory | 281.15 Mb Available Physical Memory | 54.96% Memory free
1.22 Gb Paging File | 1.04 Gb Available in Paging File | 85.30% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.24 Gb Total Space | 30.89 Gb Free Space | 53.96% Space Free | Partition Type: NTFS
Drive D: | 414.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: USER-4 | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/27 19:32:46 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.USER-4\My Documents\Downloads\OTL.com
PRC - [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/02/23 07:04:20 | 003,451,496 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2011/05/27 19:32:46 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.USER-4\My Documents\Downloads\OTL.com
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/02/23 07:04:19 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2004/03/18 16:55:48 | 000,065,536 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - [2011/02/23 06:56:55 | 000,371,544 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/02/23 06:56:45 | 000,301,528 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/02/23 06:55:49 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/02/23 06:55:47 | 000,102,232 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/02/23 06:55:10 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/02/23 06:54:57 | 000,030,680 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/02/23 06:54:55 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2008/04/13 11:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 15:41:36 | 000,606,684 | ---- | M] (LT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2001/08/17 07:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/29 05:39:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/05/27 19:29:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator.USER-4\Application Data\Mozilla\Extensions
[2011/04/18 15:12:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/04/29 05:39:19 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

Hosts file not found
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/04/14 16:06:35 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2000/08/09 05:00:56 | 000,036,864 | R--- | M] () - D:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2000/08/09 04:47:56 | 000,000,050 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2000/08/09 05:00:56 | 000,036,864 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Documents and Settings^User^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found
MsConfig - StartUpReg: HP Component Manager - hkey= - key= - C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: Ulead AutoDetector v2 - hkey= - key= - C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

Re: MALWARE problem please help28th May 2011, 4:23 am

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /HideWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Re: MALWARE problem please help28th May 2011, 4:25 am

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Error starting restore point: The function was called in safe mode.
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2011/05/27 19:32:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\My Documents\Downloads
[2011/05/27 19:30:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Application Data\Macromedia
[2011/05/27 19:30:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Application Data\Adobe
[2011/05/27 19:29:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Local Settings\Application Data\Mozilla
[2011/05/27 19:29:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Application Data\Mozilla
[2011/05/27 18:25:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Application Data\Malwarebytes
[2011/05/27 18:21:57 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator.USER-4\Application Data\Microsoft
[2011/05/27 18:21:57 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator.USER-4\SendTo
[2011/05/27 18:21:57 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator.USER-4\Application Data
[2011/05/27 18:21:57 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator.USER-4\Start Menu\Programs\Startup
[2011/05/27 18:21:57 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator.USER-4\Start Menu
[2011/05/27 18:21:57 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator.USER-4\Start Menu\Programs\Accessories
[2011/05/27 18:21:57 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator.USER-4\IETldCache
[2011/05/27 18:21:57 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator.USER-4\Cookies
[2011/05/27 18:21:57 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator.USER-4\Recent
[2011/05/27 18:21:57 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator.USER-4\PrintHood
[2011/05/27 18:21:57 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator.USER-4\NetHood
[2011/05/27 18:21:57 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator.USER-4\Local Settings
[2011/05/27 18:21:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\My Documents
[2011/05/27 18:21:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Local Settings\Application Data\Microsoft
[2011/05/27 18:21:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Favorites
[2011/05/27 18:21:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.USER-4\Desktop
[2011/05/27 18:21:56 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator.USER-4\Templates
[2011/05/27 08:59:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/05/27 04:21:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Identities
[2011/05/26 16:34:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/05/26 16:34:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/05/19 15:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\eBay
[2011/05/19 15:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\eBay
[2011/05/19 15:12:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\eBay
[2011/05/19 10:32:04 | 001,044,480 | R--- | C] (eHelp Corporation.) -- C:\WINDOWS\System32\roboex32.dll
[2011/05/19 10:32:04 | 000,049,152 | R--- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\System32\inetwh32.dll
[2011/05/13 20:06:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ulead.dat
[2011/05/12 00:11:09 | 001,056,768 | ---- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\ROBOEX32.DLL
[2011/05/12 00:11:09 | 000,026,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\CTL3DV2.DLL
[2011/05/12 00:11:07 | 000,049,152 | ---- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\INETWH32.dll
[2011/05/12 00:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ulead PhotoImpact 6
[2011/05/12 00:01:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Corel
[2011/05/12 00:01:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PhotoImpact X3
[2011/05/11 23:59:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ulead Systems
[2011/05/11 23:57:55 | 000,000,000 | ---D | C] -- C:\Program Files\Corel
[2011/05/11 22:13:28 | 000,000,000 | ---D | C] -- C:\Program Files\Ulead Systems
[2011/05/11 22:07:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2011/05/01 03:02:54 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2011/04/29 22:52:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\OE-Mail Recovery
[2011/04/29 22:52:30 | 000,000,000 | ---D | C] -- C:\Program Files\OE-Mail Recovery
[2011/04/28 03:07:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/27 19:26:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/27 18:18:00 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FFEA4426-2709-41B9-BD34-893515F62E02}.job
[2011/05/27 17:27:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/27 17:07:13 | 000,000,304 | -HS- | M] () -- C:\WINDOWS\tasks\Asgpruvix.job
[2011/05/27 17:07:13 | 000,000,302 | -HS- | M] () -- C:\WINDOWS\tasks\fpeqhbhnj.job
[2011/05/27 16:58:33 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/26 14:31:11 | 000,230,400 | ---- | M] () -- C:\WINDOWS\Xrejea.exe
[2011/05/26 00:53:52 | 000,005,014 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI
[2011/05/25 23:37:15 | 000,000,030 | ---- | M] () -- C:\WINDOWS\iedit.INI
[2011/05/19 15:13:19 | 000,001,770 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\eBay Turbo Lister 2.lnk
[2011/05/19 10:32:04 | 001,044,480 | R--- | M] (eHelp Corporation.) -- C:\WINDOWS\System32\roboex32.dll
[2011/05/19 10:32:04 | 000,049,152 | R--- | M] (Blue Sky Software Corporation.) -- C:\WINDOWS\System32\inetwh32.dll
[2011/05/12 07:53:05 | 000,214,472 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/12 00:11:58 | 000,001,789 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ulead Drop Spot.lnk
[2011/05/12 00:10:52 | 000,001,794 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact Album 6.lnk
[2011/05/12 00:10:48 | 000,001,794 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact 6.lnk
[2011/05/11 21:58:58 | 000,000,030 | ---- | M] () -- C:\WINDOWS\iedit_.INI
[2011/04/28 04:17:54 | 000,380,680 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/28 04:17:54 | 000,052,968 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/28 04:10:30 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2011/04/28 03:29:18 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/27 18:21:57 | 000,001,599 | ---- | C] () -- C:\Documents and Settings\Administrator.USER-4\Start Menu\Programs\Remote Assistance.lnk
[2011/05/26 16:36:24 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/26 14:34:43 | 000,000,304 | -HS- | C] () -- C:\WINDOWS\tasks\Asgpruvix.job
[2011/05/26 14:34:43 | 000,000,302 | -HS- | C] () -- C:\WINDOWS\tasks\fpeqhbhnj.job
[2011/05/26 14:32:05 | 000,230,400 | ---- | C] () -- C:\WINDOWS\Xrejea.exe
[2011/05/19 15:13:19 | 000,001,770 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\eBay Turbo Lister 2.lnk
[2011/05/12 23:34:09 | 000,000,030 | ---- | C] () -- C:\WINDOWS\iedit.INI
[2011/05/12 00:11:58 | 000,001,789 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ulead Drop Spot.lnk
[2011/05/12 00:10:52 | 000,001,794 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact Album 6.lnk
[2011/05/12 00:10:48 | 000,001,794 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact 6.lnk
[2011/05/12 00:10:46 | 000,005,014 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
[2011/04/28 03:29:18 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2011/04/21 22:20:07 | 000,650,752 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/04/21 22:20:07 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/04/18 19:46:04 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2011/04/18 17:57:02 | 000,104,183 | ---- | C] () -- C:\WINDOWS\hpoins04.dat
[2011/04/18 17:57:02 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat
[2011/04/18 17:18:55 | 000,000,030 | ---- | C] () -- C:\WINDOWS\iedit_.INI
[2011/04/14 16:10:05 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/04/14 16:02:51 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/04/14 08:34:44 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/04/14 08:33:27 | 000,214,472 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/01/28 12:54:06 | 000,048,640 | ---- | C] () -- C:\WINDOWS\fsViewer_acm.exe
[2011/01/28 12:53:52 | 000,051,200 | ---- | C] () -- C:\WINDOWS\fsViewer_h.dll
[2004/08/04 05:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,380,680 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,118,784 | ---- | C] () -- C:\WINDOWS\pronet.dll
[2004/08/04 05:00:00 | 000,052,968 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/03/16 17:00:00 | 000,007,420 | ---- | C] () -- C:\WINDOWS\UA000091.DLL

========== Custom Scans ==========

Re: MALWARE problem please help28th May 2011, 4:28 am

========== Custom Scans ==========

< %APPDATA%\Microsoft\*.* >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\winn32\*.* >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >
[2011/04/29 05:39:19 | 000,125,912 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\crashreporter.exe
[2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2011/04/29 05:39:23 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
[2011/04/29 05:39:24 | 000,261,080 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\updater.exe

< %ProgramFiles%\TinyProxy. >

< %systemroot%\system32\*.* /lockedfiles >
[2008/04/13 08:42:06 | 000,016,896 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\stdole2.tlb
[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
[2011/05/27 17:07:13 | 000,000,304 | -HS- | M] () Unable to obtain MD5 -- C:\WINDOWS\Tasks\Asgpruvix.job
[2011/05/27 17:07:13 | 000,000,302 | -HS- | M] () Unable to obtain MD5 -- C:\WINDOWS\Tasks\fpeqhbhnj.job

< %systemroot%\system32\drivers\*.* /lockedfiles >

< %PROGRAMFILES%\*. >
[2011/04/18 20:08:52 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2011/04/22 00:00:20 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2011/04/14 18:53:47 | 000,000,000 | ---D | M] -- C:\Program Files\AVAST Software
[2011/04/14 18:50:53 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2011/05/11 23:59:09 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2011/04/14 16:02:37 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2011/05/11 23:57:55 | 000,000,000 | ---D | M] -- C:\Program Files\Corel
[2011/05/19 15:12:46 | 000,000,000 | ---D | M] -- C:\Program Files\eBay
[2011/04/26 21:47:32 | 000,000,000 | ---D | M] -- C:\Program Files\File Secure Pro
[2011/04/28 02:42:47 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
[2011/04/27 01:04:15 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2011/04/21 22:24:18 | 000,000,000 | ---D | M] -- C:\Program Files\GRETECH
[2011/04/18 18:12:09 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2011/04/18 18:19:25 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2011/05/12 00:11:51 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2011/04/20 03:01:40 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2011/04/14 19:06:18 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2011/04/20 03:18:29 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/04/14 18:40:30 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2011/04/20 03:03:04 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011/04/14 16:06:49 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2011/04/21 12:18:27 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2011/04/15 15:11:44 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2011/04/29 05:39:47 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2011/04/14 16:00:51 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2011/04/14 16:01:25 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2011/04/20 03:00:47 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2011/04/14 18:29:19 | 000,000,000 | ---D | M] -- C:\Program

Re: MALWARE problem please help28th May 2011, 4:32 am

---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< End of report >

Re: MALWARE problem please help28th May 2011, 4:33 am

MBR LOG

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-27 21:11:46
-----------------------------
21:11:46.027 OS Version: Windows 5.1.2600 Service Pack 3
21:11:46.027 Number of processors: 1 586 0x806
21:11:46.027 ComputerName: USER-4 UserName:
21:11:50.022 Initialize success
21:11:52.436 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:11:52.456 Disk 0 Vendor: Maxtor_96147H8 BAC51KJ0 Size: 58623MB BusType: 3
21:11:52.476 Device \Driver\atapi -> DriverStartIo 8231253b
21:11:54.539 Disk 0 MBR read successfully
21:11:54.559 Disk 0 MBR scan
21:11:54.569 Disk 0 TDL4@MBR code has been found
21:11:54.589 Disk 0 Windows XP default MBR code found via API
21:11:54.609 Disk 0 MBR hidden
21:11:54.629 Disk 0 MBR [TDL4] **ROOTKIT**
21:11:54.649 Disk 0 trace - called modules:
21:11:54.669 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x823126f0]<<
21:11:54.689 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8238fab8]
21:11:54.709 3 CLASSPNP.SYS[f8595fd7] -> nt!IofCallDriver -> \Device\00000053[0x823de968]
21:11:54.729 5 ACPI.sys[f84ec620] -> nt!IofCallDriver -> [0x8236e940]
21:11:56.862 \Driver\atapi[0x823d6a68] -> IRP_MJ_CREATE -> 0x823126f0
21:11:56.972 Scan finished successfully
21:12:07.077 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator.USER-4\Desktop\MBR.dat"
21:12:07.097 The log file has been saved successfully to "C:\Documents and Settings\Administrator.USER-4\Desktop\aswMBR.txt"

Re: MALWARE problem please help28th May 2011, 4:33 am

Results of screen317's Security Check version 0.99.12
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
avast! Free Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player 10.2.159.1
Adobe Reader X (10.0.1)
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

Re: MALWARE problem please help28th May 2011, 4:35 am

I'm about to go crazy with this , so I sure hope you can help....THANKS !!!!!!

Re: MALWARE problem please help29th May 2011, 11:03 pm

BUMP....

I'm able to get online again, without booting up in safe mode.
Also, AVAST has miraculously started up again but I'm afraid to restart my computer.
If you see this, please give me some advice, thanks, Jim.

Re: MALWARE problem please help30th May 2011, 3:49 am

bump

Re: MALWARE problem please help30th May 2011, 8:07 pm

Hello.

Please download TDSSKiller from here and save it to your Desktop.

Doubleclick TDSSKiller.exe to run the tool
Click the Start Scan button
After the scan has finished, click the Close button
Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory.

Re: MALWARE problem please help31st May 2011, 2:54 am

2011/05/30 19:52:45.0946 2540 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
2011/05/30 19:52:46.0627 2540 ================================================================================
2011/05/30 19:52:46.0627 2540 SystemInfo:
2011/05/30 19:52:46.0627 2540
2011/05/30 19:52:46.0627 2540 OS Version: 5.1.2600 ServicePack: 3.0
2011/05/30 19:52:46.0627 2540 Product type: Workstation
2011/05/30 19:52:46.0627 2540 ComputerName: USER-4
2011/05/30 19:52:46.0627 2540 UserName: User
2011/05/30 19:52:46.0627 2540 Windows directory: C:\WINDOWS
2011/05/30 19:52:46.0627 2540 System windows directory: C:\WINDOWS
2011/05/30 19:52:46.0627 2540 Processor architecture: Intel x86
2011/05/30 19:52:46.0627 2540 Number of processors: 1
2011/05/30 19:52:46.0627 2540 Page size: 0x1000
2011/05/30 19:52:46.0627 2540 Boot type: Normal boot
2011/05/30 19:52:46.0627 2540 ================================================================================
2011/05/30 19:52:49.0180 2540 Initialize success
2011/05/30 19:52:52.0625 2476 ================================================================================
2011/05/30 19:52:52.0625 2476 Scan started
2011/05/30 19:52:52.0625 2476 Mode: Manual;
2011/05/30 19:52:52.0625 2476 ================================================================================
2011/05/30 19:52:54.0638 2476 Aavmker4 (83631291adf2887cffc786d034d3fa15) C:\WINDOWS\system32\drivers\Aavmker4.sys
2011/05/30 19:52:55.0119 2476 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
2011/05/30 19:52:55.0319 2476 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/05/30 19:52:55.0479 2476 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/05/30 19:52:55.0840 2476 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/05/30 19:52:56.0050 2476 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/05/30 19:52:56.0251 2476 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/05/30 19:52:57.0032 2476 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/05/30 19:52:57.0502 2476 aswFsBlk (1c2e6bb4fe8621b1b863855b02bc33eb) C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011/05/30 19:52:57.0643 2476 aswMon2 (452d0ecd14fa02f9b061f42c8a30dd49) C:\WINDOWS\system32\drivers\aswMon2.sys
2011/05/30 19:52:57.0813 2476 aswRdr (b6a9373619d851be80fb5f1b5eed0d4e) C:\WINDOWS\system32\drivers\aswRdr.sys
2011/05/30 19:52:57.0993 2476 aswSnx (9be41c1ae8bc481eb662d85c98d979c2) C:\WINDOWS\system32\drivers\aswSnx.sys
2011/05/30 19:52:58.0203 2476 aswSP (4b1a54ba2bc5873a774df6b70ab8b0b3) C:\WINDOWS\system32\drivers\aswSP.sys
2011/05/30 19:52:58.0404 2476 aswTdi (c7f1cea32766184911293f4e1ee653f5) C:\WINDOWS\system32\drivers\aswTdi.sys
2011/05/30 19:52:58.0564 2476 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/05/30 19:52:58.0724 2476 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/05/30 19:52:59.0095 2476 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/05/30 19:52:59.0315 2476 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/05/30 19:52:59.0505 2476 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/05/30 19:52:59.0706 2476 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/05/30 19:52:59.0956 2476 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/05/30 19:53:00.0126 2476 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/05/30 19:53:00.0236 2476 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/05/30 19:53:01.0118 2476 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/05/30 19:53:01.0328 2476 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/05/30 19:53:01.0568 2476 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/05/30 19:53:01.0758 2476 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/05/30 19:53:01.0979 2476 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/05/30 19:53:02.0229 2476 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/05/30 19:53:02.0449 2476 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/05/30 19:53:02.0680 2476 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/05/30 19:53:02.0890 2476 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/05/30 19:53:03.0090 2476 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/05/30 19:53:03.0321 2476 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/05/30 19:53:03.0511 2476 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/05/30 19:53:03.0711 2476 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/05/30 19:53:03.0902 2476 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2011/05/30 19:53:04.0022 2476 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/05/30 19:53:04.0252 2476 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/05/30 19:53:04.0603 2476 HPZid412 (5faba4775d4c61e55ec669d643ffc71f) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/05/30 19:53:04.0763 2476 HPZipr12 (a3c43980ee1f1beac778b44ea65dbdd4) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/05/30 19:53:04.0873 2476 HPZius12 (2906949bd4e206f2bb0dd1896ce9f66f) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/05/30 19:53:05.0073 2476 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/05/30 19:53:05.0524 2476 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/05/30 19:53:05.0674 2476 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/05/30 19:53:05.0955 2476 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/05/30 19:53:06.0095 2476 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/05/30 19:53:06.0255 2476 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/05/30 19:53:06.0435 2476 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/05/30 19:53:06.0585 2476 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/05/30 19:53:06.0816 2476 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS

Re: MALWARE problem please help31st May 2011, 2:54 am

\ipsec.sys
2011/05/30 19:53:06.0966 2476 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/05/30 19:53:07.0146 2476 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/05/30 19:53:07.0266 2476 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/05/30 19:53:07.0427 2476 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/05/30 19:53:07.0567 2476 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/05/30 19:53:07.0837 2476 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/05/30 19:53:08.0308 2476 ltmodem5 (9ee18a5a45552673a67532ea37370377) C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
2011/05/30 19:53:08.0548 2476 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/05/30 19:53:08.0688 2476 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/05/30 19:53:08.0809 2476 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/05/30 19:53:09.0059 2476 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/05/30 19:53:09.0309 2476 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/05/30 19:53:09.0520 2476 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/05/30 19:53:09.0840 2476 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/05/30 19:53:10.0010 2476 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/05/30 19:53:10.0181 2476 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/05/30 19:53:10.0351 2476 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/05/30 19:53:10.0491 2476 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/05/30 19:53:10.0671 2476 ms_mpu401 (ca3e22598f411199adc2dfee76cd0ae0) C:\WINDOWS\system32\drivers\msmpu401.sys
2011/05/30 19:53:10.0822 2476 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/05/30 19:53:11.0022 2476 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/05/30 19:53:11.0172 2476 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/05/30 19:53:11.0292 2476 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/05/30 19:53:11.0442 2476 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/05/30 19:53:11.0663 2476 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/05/30 19:53:11.0783 2476 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/05/30 19:53:11.0903 2476 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/05/30 19:53:12.0133 2476 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/05/30 19:53:12.0314 2476 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/05/30 19:53:12.0484 2476 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/05/30 19:53:12.0724 2476 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/05/30 19:53:13.0105 2476 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/05/30 19:53:13.0425 2476 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/05/30 19:53:13.0565 2476 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/05/30 19:53:13.0746 2476 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/05/30 19:53:13.0876 2476 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys
2011/05/30 19:53:13.0986 2476 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/05/30 19:53:14.0116 2476 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/05/30 19:53:14.0297 2476 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/05/30 19:53:14.0397 2476 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/05/30 19:53:14.0817 2476 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/05/30 19:53:15.0739 2476 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/05/30 19:53:15.0879 2476 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/05/30 19:53:16.0049 2476 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/05/30 19:53:16.0930 2476 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/05/30 19:53:17.0121 2476 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/05/30 19:53:17.0291 2476 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/05/30 19:53:17.0471 2476 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/05/30 19:53:17.0601 2476 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/05/30 19:53:17.0832 2476 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/05/30 19:53:18.0042 2476 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/05/30 19:53:18.0202 2476 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/05/30 19:53:18.0462 2476 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/05/30 19:53:18.0633 2476 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/05/30 19:53:18.0813 2476 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/05/30 19:53:18.0933 2476 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/05/30 19:53:19.0063 2476 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/05/30 19:53:19.0394 2476 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/05/30 19:53:19.0524 2476 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/05/30 19:53:19.0754 2476 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/05/30 19:53:19.0935 2476 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/05/30 19:53:20.0055 2476 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/05/30 19:53:20.0586 2476 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/05/30 19:53:20.0866 2476 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/05/30 19:53:21.0056 2476 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/05/30 19:53:21.0257 2476 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/05/30 19:53:21.0357 2476 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/05/30 19:53:21.0687 2476 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/05/30 19:53:22.0008 2476 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/05/30 19:53:22.0258 2476 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/05/30 19:53:22.0438 2476 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/05/30 19:53:22.0588 2476 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/05/30 19:53:22.0719 2476 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/05/30 19:53:22.0919 2476 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/05/30 19:53:23.0009 2476 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/05/30 19:53:23.0129 2476 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/05/30 19:53:23.0350 2476 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/05/30 19:53:23.0530 2476 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/05/30 19:53:23.0830 2476 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/05/30 19:53:24.0291 2476 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/05/30 19:53:24.0451 2476 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/05/30 19:53:24.0621 2476 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/05/30 19:53:24.0842 2476 ================================================================================
2011/05/30 19:53:24.0842 2476 Scan finished
2011/05/30 19:53:24.0842 2476 ================================================================================
2011/05/30 19:53:24.0892 2496 Detected object count: 0
2011/05/30 19:53:24.0892 2496 Actual detected object count: 0

Re: MALWARE problem please help31st May 2011, 2:58 am

I've restored the computer to the 28th, which seems to let me get online.
However, AVAST is still disabled...and when I click "FIX NOW" on Avast it still won't run.
I'm going to run OTL and MBAM again and post the logs here...
Here is the log for SECURITY CHECK
Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Adobe Flash Player 10.2.159.1
Adobe Reader X (10.0.1)
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast avastUI.exe
``````````End of Log````````````

Re: MALWARE problem please help31st May 2011, 4:50 am

OTL logfile created on: 5/30/2011 9:33:29 PM - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.53 Mb Total Physical Memory | 327.11 Mb Available Physical Memory | 63.95% Memory free
1.22 Gb Paging File | 1.08 Gb Available in Paging File | 88.54% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.24 Gb Total Space | 29.37 Gb Free Space | 51.31% Space Free | Partition Type: NTFS
Drive D: | 414.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: USER-4 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/27 14:44:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\Downloads\OTL.com
PRC - [2011/02/23 07:04:20 | 003,451,496 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/08/02 21:08:00 | 000,095,504 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe

========== Modules (SafeList) ==========

MOD - [2011/05/27 14:44:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\Downloads\OTL.com
MOD - [2011/02/23 07:04:17 | 000,197,208 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/02/23 07:04:19 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2004/03/18 16:55:48 | 000,065,536 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

========== Driver Services (SafeList) ==========

DRV - [2011/02/23 06:56:55 | 000,371,544 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/02/23 06:56:45 | 000,301,528 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/02/23 06:55:49 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/02/23 06:55:47 | 000,102,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/02/23 06:55:10 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/02/23 06:54:57 | 000,030,680 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/02/23 06:54:55 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2008/04/13 11:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 15:41:36 | 000,606,684 | ---- | M] (LT) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2001/08/17 07:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/29 05:39:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/04/18 15:12:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2011/04/18 15:12:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/04/29 05:39:19 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

Hosts file not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O4 - HKCU..\Run: [4ECYTQ9SIC] File not found
O4 - HKCU..\Run: [Isoquce] C:\WINDOWS\pronet.dll ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/04/14 16:06:35 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2000/08/09 05:00:56 | 000,036,864 | R--- | M] () - D:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2000/08/09 04:47:56 | 000,000,050 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe - (Hewlett-Packard Co.)
MsConfig - StartUpFolder: C:^Documents and Settings^User^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found
MsConfig - StartUpReg: HP Component Manager - hkey= - key= - C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: Ulead AutoDetector v2 - hkey= - key= - C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /HideWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56027131116781568)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/29 21:37:12 | 000,000,000 | -HSD | C] -- C:\found.000
[2011/05/28 19:27:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2011/05/28 16:59:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/05/27 20:18:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/05/27 20:18:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/05/27 16:56:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\User\Recent
[2011/05/27 08:59:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/05/27 04:21:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Identities
[2011/05/26 16:34:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/05/26 16:34:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/05/20 21:49:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\WeirdTalesBatwoman
[2011/05/20 16:06:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\Black Cat1
[2011/05/19 15:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\eBay
[2011/05/19 15:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\eBay
[2011/05/19 15:12:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\eBay
[2011/05/19 10:32:04 | 001,044,480 | R--- | C] (eHelp Corporation.) -- C:\WINDOWS\System32\roboex32.dll
[2011/05/19 10:32:04 | 000,049,152 | R--- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\System32\inetwh32.dll
[2011/05/17 15:39:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\coins
[2011/05/13 22:12:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\SW68
[2011/05/13 20:06:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ulead.dat
[2011/05/13 15:51:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Help
[2011/05/13 15:51:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Help
[2011/05/12 00:52:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\USA7-clock
[2011/05/12 00:11:09 | 001,056,768 | ---- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\ROBOEX32.DLL
[2011/05/12 00:11:09 | 000,026,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\CTL3DV2.DLL
[2011/05/12 00:11:07 | 000,049,152 | ---- | C] (Blue Sky Software Corporation.) -- C:\WINDOWS\INETWH32.dll
[2011/05/12 00:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ulead PhotoImpact 6
[2011/05/12 00:01:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Corel
[2011/05/12 00:01:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PhotoImpact X3
[2011/05/11 23:59:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ulead Systems
[2011/05/11 23:57:55 | 000,000,000 | ---D | C] -- C:\Program Files\Corel
[2011/05/11 22:13:28 | 000,000,000 | ---D | C] -- C:\Program Files\Ulead Systems
[2011/05/11 22:07:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2011/05/01 03:02:54 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2011/05/01 03:01:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\TL-covers-thebedroomwallbabes.blogspot.com
[2011/05/01 00:33:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\Element1026-saved-files
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/30 21:31:41 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FFEA4426-2709-41B9-BD34-893515F62E02}.job
[2011/05/30 21:11:16 | 000,000,304 | -HS- | M] () -- C:\WINDOWS\tasks\Asgpruvix.job
[2011/05/30 21:11:16 | 000,000,302 | -HS- | M] () -- C:\WINDOWS\tasks\fpeqhbhnj.job
[2011/05/30 21:06:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/30 21:06:41 | 536,449,024 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/30 19:59:52 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/05/30 19:17:58 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/29 21:05:12 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/26 14:31:11 | 000,230,400 | ---- | M] () -- C:\WINDOWS\Xrejea.exe
[2011/05/26 00:53:52 | 000,005,014 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI
[2011/05/25 23:37:15 | 000,000,030 | ---- | M] () -- C:\WINDOWS\iedit.INI
[2011/05/25 16:48:07 | 000,305,707 | ---- | M] () -- C:\Documents and Settings\User\Desktop\uncanny_x-men_113.jpg
[2011/05/25 00:25:14 | 000,002,261 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Lord's Buyers.rtf
[2011/05/25 00:24:49 | 000,019,661 | ---- | M] () -- C:\Documents and Settings\User\Desktop\REVAMPING the ebay searches.rtf
[2011/05/24 22:58:54 | 000,441,943 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Adam v19n11 Cassandra.jpg
[2011/05/24 22:37:16 | 000,109,845 | ---- | M] () -- C:\Documents and Settings\User\Desktop\exciting 39 1009 dizneyart.JPG
[2011/05/24 22:35:29 | 000,099,091 | ---- | M] () -- C:\Documents and Settings\User\Desktop\My Personal Problem 1 ajax.JPG
[2011/05/24 22:35:01 | 000,138,738 | ---- | M] () -- C:\Documents and Settings\User\Desktop\My Personal Problem 2 ajax.JPG
[2011/05/24 22:30:54 | 000,131,051 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Thrilling 44 sold 609.JPG
[2011/05/24 22:29:34 | 000,038,676 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Police Detective 8-54 GGA.JPG
[2011/05/24 22:28:15 | 000,083,147 | ---- | M] () -- C:\Documents and Settings\User\Desktop\SHORT STORIES March 25, 1948 COOL COVER.JPG
[2011/05/24 22:27:41 | 000,096,340 | ---- | M] () -- C:\Documents and Settings\User\Desktop\SHORT STORIES January 25, 1947 COOL SKULL COVER.JPG
[2011/05/24 22:19:41 | 000,064,027 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Inside_tracy_lords_mag.JPG
[2011/05/23 23:55:33 | 000,095,744 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/23 23:53:54 | 000,000,782 | ---- | M] () -- C:\Documents and Settings\User\Desktop\MONEY IN MONEY OUT.rtf
[2011/05/23 18:55:38 | 000,413,125 | ---- | M] () -- C:\Documents and Settings\User\Desktop\anna-kourikova1.jpg
[2011/05/20 23:53:17 | 004,421,706 | ---- | M] () -- C:\Documents and Settings\User\Desktop\ALL-story_TARZAN.jpg
[2011/05/20 21:03:27 | 001,633,343 | ---- | M] () -- C:\Documents and Settings\User\Desktop\weird_tales_batwoman2.jpg
[2011/05/20 21:02:08 | 002,161,482 | ---- | M] () -- C:\Documents and Settings\User\Desktop\weird_tales_batwoman.jpg
[2011/05/20 20:59:44 | 001,794,515 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Spicy_mystery_cover_green_skull.jpg
[2011/05/20 20:57:52 | 000,081,062 | ---- | M] () -- C:\Documents and Settings\User\Desktop\spicy-mystery-stories-pulp-movie-poster-1020410286.jpg
[2011/05/20 18:19:42 | 000,026,123 | ---- | M] () -- C:\Documents and Settings\User\Desktop\TRACI_young_busters.JPG
[2011/05/20 15:29:59 | 001,141,485 | ---- | M] () -- C:\Documents and Settings\User\Desktop\BLACK CAT 1.jpg
[2011/05/19 18:39:22 | 000,206,114 | ---- | M] () -- C:\Documents and Settings\User\Desktop\washingtons.jpg
[2011/05/19 15:13:19 | 000,001,770 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\eBay Turbo Lister 2.lnk
[2011/05/19 15:12:45 | 000,001,475 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay Turbo Lister 2.lnk
[2011/05/19 10:32:04 | 001,044,480 | R--- | M] (eHelp Corporation.) -- C:\WINDOWS\System32\roboex32.dll
[2011/05/19 10:32:04 | 000,049,152 | R--- | M] (Blue Sky Software Corporation.) -- C:\WINDOWS\System32\inetwh32.dll
[2011/05/19 00:37:02 | 000,366,116 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Maria_land_and_sea.jpg
[2011/05/19 00:13:19 | 000,031,925 | ---- | M] () -- C:\Documents and Settings\User\Desktop\3287446681.jpg
[2011/05/18 20:56:42 | 000,080,958 | ---- | M] () -- C:\Documents and Settings\User\Desktop\TL-paperback.jpg
[2011/05/17 14:27:46 | 000,079,900 | ---- | M] () -- C:\Documents and Settings\User\Desktop\CBG-1987_windy_city_batman1.jpg
[2011/05/16 22:21:39 | 000,041,635 | ---- | M] () -- C:\Documents and Settings\User\Desktop\newsstand.JPG
[2011/05/16 20:30:07 | 000,212,640 | ---- | M] () -- C:\Documents and Settings\User\Desktop\SHOCK MYSTERY TALES GGA FEB 1963.jpg
[2011/05/16 15:48:11 | 000,098,959 | ---- | M] () -- C:\Documents and Settings\User\Desktop\airboy_logo.jpg
[2011/05/15 10:06:28 | 000,055,419 | ---- | M] () -- C:\Documents and Settings\User\Desktop\batcave-sprang-poster.jpg
[2011/05/15 10:05:49 | 000,070,469 | ---- | M] () -- C:\Documents and Settings\User\Desktop\batman-poster-sprang.jpg
[2011/05/14 21:52:42 | 000,082,490 | ---- | M] () -- C:\Documents and Settings\User\Desktop\all-great crime stories 132pg.jpg
[2011/05/14 17:22:11 | 000,090,098 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Dstevens.jpg
[2011/05/12 22:42:38 | 000,003,173 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Files named inventory.fnd
[2011/05/12 07:53:05 | 000,214,472 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/12 00:11:58 | 000,001,789 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ulead Drop Spot.lnk
[2011/05/12 00:10:52 | 000,001,794 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact Album 6.lnk
[2011/05/12 00:10:48 | 000,001,794 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact 6.lnk
[2011/05/11 21:58:58 | 000,000,030 | ---- | M] () -- C:\WINDOWS\iedit_.INI
[2011/05/10 14:46:09 | 000,002,339 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Document.rtf
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/30 21:06:41 | 536,449,024 | -HS- | C] () -- C:\hiberfil.sys
[2011/05/26 16:36:24 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/26 14:34:43 | 000,000,304 | -HS- | C] () -- C:\WINDOWS\tasks\Asgpruvix.job
[2011/05/26 14:34:43 | 000,000,302 | -HS- | C] () -- C:\WINDOWS\tasks\fpeqhbhnj.job
[2011/05/26 14:32:05 | 000,230,400 | ---- | C] () -- C:\WINDOWS\Xrejea.exe
[2011/05/25 16:48:02 | 000,305,707 | ---- | C] () -- C:\Documents and Settings\User\Desktop\uncanny_x-men_113.jpg
[2011/05/25 00:25:14 | 000,002,261 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Lord's Buyers.rtf
[2011/05/24 22:58:50 | 000,441,943 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Adam v19n11 Cassandra.jpg
[2011/05/24 22:37:15 | 000,109,845 | ---- | C] () -- C:\Documents and Settings\User\Desktop\exciting 39 1009 dizneyart.JPG
[2011/05/24 22:35:27 | 000,099,091 | ---- | C] () -- C:\Documents and Settings\User\Desktop\My Personal Problem 1 ajax.JPG
[2011/05/24 22:35:00 | 000,138,738 | ---- | C] () -- C:\Documents and Settings\User\Desktop\My Personal Problem 2 ajax.JPG
[2011/05/24 22:30:52 | 000,131,051 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Thrilling 44 sold 609.JPG
[2011/05/24 22:29:33 | 000,038,676 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Police Detective 8-54 GGA.JPG
[2011/05/24 22:28:14 | 000,083,147 | ---- | C] () -- C:\Documents and Settings\User\Desktop\SHORT STORIES March 25, 1948 COOL COVER.JPG
[2011/05/24 22:27:39 | 000,096,340 | ---- | C] () -- C:\Documents and Settings\User\Desktop\SHORT STORIES January 25, 1947 COOL SKULL COVER.JPG
[2011/05/24 22:19:36 | 000,064,027 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Inside_tracy_lords_mag.JPG
[2011/05/23 18:55:30 | 000,413,125 | ---- | C] () -- C:\Documents and Settings\User\Desktop\anna-kourikova1.jpg
[2011/05/22 23:32:27 | 000,000,782 | ---- | C] () -- C:\Documents and Settings\User\Desktop\MONEY IN MONEY OUT.rtf
[2011/05/20 23:53:16 | 004,421,706 | ---- | C] () -- C:\Documents and Settings\User\Desktop\ALL-story_TARZAN.jpg
[2011/05/20 21:03:26 | 001,633,343 | ---- | C] () -- C:\Documents and Settings\User\Desktop\weird_tales_batwoman2.jpg
[2011/05/20 21:02:06 | 002,161,482 | ---- | C] () -- C:\Documents and Settings\User\Desktop\weird_tales_batwoman.jpg
[2011/05/20 20:59:43 | 001,794,515 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Spicy_mystery_cover_green_skull.jpg
[2011/05/20 20:57:48 | 000,081,062 | ---- | C] () -- C:\Documents and Settings\User\Desktop\spicy-mystery-stories-pulp-movie-poster-1020410286.jpg
[2011/05/20 18:19:37 | 000,026,123 | ---- | C] () -- C:\Documents and Settings\User\Desktop\TRACI_young_busters.JPG
[2011/05/20 15:29:54 | 001,141,485 | ---- | C] () -- C:\Documents and Settings\User\Desktop\BLACK CAT 1.jpg
[2011/05/19 18:39:22 | 000,206,114 | ---- | C] () -- C:\Documents and Settings\User\Desktop\washingtons.jpg
[2011/05/19 15:13:19 | 000,001,770 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\eBay Turbo Lister 2.lnk
[2011/05/19 15:12:44 | 000,001,475 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay Turbo Lister 2.lnk
[2011/05/19 00:36:48 | 000,366,116 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Maria_land_and_sea.jpg
[2011/05/19 00:13:17 | 000,031,925 | ---- | C] () -- C:\Documents and Settings\User\Desktop\3287446681.jpg
[2011/05/18 20:56:39 | 000,080,958 | ---- | C] () -- C:\Documents and Settings\User\Desktop\TL-paperback.jpg
[2011/05/17 14:27:46 | 000,079,900 | ---- | C] () -- C:\Documents and Settings\User\Desktop\CBG-1987_windy_city_batman1.jpg
[2011/05/16 22:21:37 | 000,041,635 | ---- | C] () -- C:\Documents and Settings\User\Desktop\newsstand.JPG
[2011/05/16 20:30:05 | 000,212,640 | ---- | C] () -- C:\Documents and Settings\User\Desktop\SHOCK MYSTERY TALES GGA FEB 1963.jpg
[2011/05/16 15:48:08 | 000,098,959 | ---- | C] () -- C:\Documents and Settings\User\Desktop\airboy_logo.jpg
[2011/05/15 10:06:27 | 000,055,419 | ---- | C] () -- C:\Documents and Settings\User\Desktop\batcave-sprang-poster.jpg
[2011/05/15 10:05:44 | 000,070,469 | ---- | C] () -- C:\Documents and Settings\User\Desktop\batman-poster-sprang.jpg
[2011/05/14 21:52:36 | 000,082,490 | ---- | C] () -- C:\Documents and Settings\User\Desktop\all-great crime stories 132pg.jpg
[2011/05/14 17:22:11 | 000,090,098 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Dstevens.jpg
[2011/05/12 23:34:09 | 000,000,030 | ---- | C] () -- C:\WINDOWS\iedit.INI
[2011/05/12 22:42:38 | 000,003,173 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Files named inventory.fnd
[2011/05/12 00:11:58 | 000,001,789 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ulead Drop Spot.lnk
[2011/05/12 00:10:52 | 000,001,794 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact Album 6.lnk
[2011/05/12 00:10:48 | 000,001,794 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PhotoImpact 6.lnk
[2011/05/12 00:10:46 | 000,005,014 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
[2011/05/11 18:26:25 | 000,084,261 | ---- | C] () -- C:\Documents and Settings\User\Desktop\amc2_amx_clocked.jpg
[2011/05/09 07:31:47 | 000,002,339 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Document.rtf
[2011/04/28 03:29:18 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2011/04/21 22:20:07 | 000,650,752 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/04/21 22:20:07 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/04/18 19:46:04 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2011/04/18 19:15:52 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\fusioncache.dat
[2011/04/18 17:57:02 | 000,104,183 | ---- | C] () -- C:\WINDOWS\hpoins04.dat
[2011/04/18 17:57:02 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat
[2011/04/18 17:18:55 | 000,000,030 | ---- | C] () -- C:\WINDOWS\iedit_.INI
[2011/04/18 15:21:14 | 000,095,744 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/14 16:10:05 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/04/14 16:02:51 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/04/14 08:34:44 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/04/14 08:33:27 | 000,214,472 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/01/28 12:54:06 | 000,048,640 | ---- | C] () -- C:\WINDOWS\fsViewer_acm.exe
[2011/01/28 12:53:52 | 000,051,200 | ---- | C] () -- C:\WINDOWS\fsViewer_h.dll
[2004/08/04 05:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,380,680 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,118,784 | ---- | C] () -- C:\WINDOWS\pronet.dll
[2004/08/04 05:00:00 | 000,052,968 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/03/16 17:00:00 | 000,007,420 | ---- | C] () -- C:\WINDOWS\UA000091.DLL

========== Custom Scans ==========

< %APPDATA%\Microsoft\*.* >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\winn32\*.* >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >
[2011/04/29 05:39:19 | 000,125,912 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\crashreporter.exe
[2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2011/04/29 05:39:23 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
[2011/04/29 05:39:24 | 000,261,080 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\updater.exe

< %ProgramFiles%\TinyProxy. >

< %systemroot%\system32\*.* /lockedfiles >
[2011/04/14 08:59:06 | 000,000,000 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\h323log.txt
[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
[2011/05/30 21:11:16 | 000,000,304 | -HS- | M] () Unable to obtain MD5 -- C:\WINDOWS\Tasks\Asgpruvix.job
[2011/05/30 21:11:16 | 000,000,302 | -HS- | M] () Unable to obtain MD5 -- C:\WINDOWS\Tasks\fpeqhbhnj.job

< %systemroot%\system32\drivers\*.* /lockedfiles >

< %PROGRAMFILES%\*. >
[2011/04/18 20:08:52 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2011/04/22 00:00:20 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2011/04/14 18:53:47 | 000,000,000 | ---D | M] -- C:\Program Files\AVAST Software
[2011/04/14 18:50:53 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2011/05/11 23:59:09 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2011/04/14 16:02:37 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2011/05/11 23:57:55 | 000,000,000 | ---D | M] -- C:\Program Files\Corel
[2011/05/19 15:12:46 | 000,000,000 | ---D | M] -- C:\Program Files\eBay
[2011/04/26 21:47:32 | 000,000,000 | ---D | M] -- C:\Program Files\File Secure Pro
[2011/04/28 02:42:47 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
[2011/04/27 01:04:15 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2011/04/21 22:24:18 | 000,000,000 | ---D | M] -- C:\Program Files\GRETECH
[2011/04/18 18:12:09 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2011/04/18 18:19:25 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2011/05/12 00:11:51 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2011/04/20 03:01:40 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2011/04/14 19:06:18 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2011/04/20 03:18:29 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/04/14 18:40:30 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2011/04/20 03:03:04 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011/04/14 16:06:49 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2011/04/21 12:18:27 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2011/04/15 15:11:44 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2011/04/29 05:39:47 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2011/04/14 16:00:51 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2011/04/14 16:01:25 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2011/04/20 03:00:47 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2011/04/14 18:29:19 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2011/04/29 22:53:10 | 000,000,000 | ---D | M] -- C:\Program Files\OE-Mail Recovery
[2011/04/28 04:15:53 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2011/04/14 19:08:17 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 3
[2011/04/15 15:10:17 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2011/05/12 00:11:56 | 000,000,000 | ---D | M] -- C:\Program Files\Ulead Systems
[2011/04/14 16:13:02 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2011/04/21 23:49:12 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2011/04/14 18:29:15 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2011/04/14 16:04:27 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2011/04/21 22:38:11 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2011/04/14 16:06:49 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2011/04/21 22:20:45 | 000,000,000 | ---D | M] -- C:\Program Files\Xvid

< MD5 for: AGP440.SYS >
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2011/04/14 18:20:57 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2011/04/14 18:20:57 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 16:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004/08/03 16:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2011/04/14 18:20:57 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2011/04/14 18:20:57 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 05:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/04 05:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2011/04/14 18:20:57 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2011/04/14 18:20:57 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/04 05:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2009/02/06 11:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 11:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/04 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-11 08:34:10

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/04/29 05:39:24 | 000,711,672 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/04/29 05:39:20 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 04:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< >

< >

< End of report >

Re: MALWARE problem please help31st May 2011, 6:07 pm

I know you guys are busy but this is going on 4 days and I've only had one reply.
I've donated money in the past.
Can someone HELP ?

Re: MALWARE problem please help31st May 2011, 8:23 pm

Hello.

Download combofix from here
Link 1

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:

3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
We need to disable your local AV (Anti-virus) before running Combofix.
See HERE for how to disable your AV.
Double click on ComboFix.exe.
Follow the prompts. NOTE:
ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
Allow ComboFix to download the Recovery Console.
Accept the End-User License Agreement.
The Recovery Console will be installed.
You will then get this next prompt that asks if you want to continue the malware scan, select yes
Allow combofix to run
Post C:\combofix.txt back here.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Re: MALWARE problem please help1st June 2011, 7:58 am

ComboFix 11-05-31.01 - Administrator 05/31/2011 21:35:42.1.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.276 [GMT -7:00]
Running from: c:\documents and settings\Administrator.USER-4\Desktop\Combo-Fix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Files Created from 2011-05-01 to 2011-06-01 )))))))))))))))))))))))))))))))
.
.
2011-06-01 00:02 . 2011-06-01 00:02 -------- d-----w- c:\windows\system32\wbem\Repository
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\program files\Corel
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\program files\Common Files\Ulead Systems
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\documents and settings\User\Application Data\Ulead Systems
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\program files\eBay
2011-05-30 04:37 . 2011-05-30 04:37 -------- d-----w- C:\found.000
2011-05-28 23:59 . 2011-05-28 23:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-05-28 03:18 . 2011-05-28 03:18 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-05-27 23:53 . 2011-05-27 23:55 -------- d-s---w- c:\documents and settings\Administrator
2011-05-27 11:21 . 2011-05-27 11:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2011-05-26 23:34 . 2011-05-26 23:34 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-05-26 21:32 . 2011-05-26 21:31 230400 ----a-w- c:\windows\Xrejea.exe
2011-05-19 22:12 . 2011-05-31 04:59 -------- d-----w- c:\documents and settings\All Users\eBay
2011-05-19 17:32 . 2011-05-19 17:32 49152 ----a-r- c:\windows\system32\inetwh32.dll
2011-05-19 17:32 . 2011-05-19 17:32 1044480 ----a-r- c:\windows\system32\roboex32.dll
2011-05-14 03:06 . 2011-05-14 03:06 -------- d-----w- c:\windows\ulead.dat
2011-05-13 22:51 . 2011-05-13 22:51 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Help
2011-05-12 07:11 . 1999-10-15 19:50 1056768 ----a-w- c:\windows\ROBOEX32.DLL
2011-05-12 07:11 . 1995-07-20 07:00 26832 ----a-w- c:\windows\CTL3DV2.DLL
2011-05-12 07:11 . 1999-01-28 22:44 49152 ----a-w- c:\windows\INETWH32.dll
2011-05-12 05:13 . 2011-05-12 07:11 -------- d-----w- c:\program files\Ulead Systems
2011-05-12 05:07 . 2011-05-12 07:08 -------- d-----w- c:\program files\Common Files\InstallShield
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-10 12:10 . 2011-04-15 01:53 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2011-04-15 01:53 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2011-04-15 01:54 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 12:03 . 2011-04-15 01:54 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2011-04-15 01:54 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:02 . 2011-04-15 01:54 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-05-10 12:02 . 2011-04-15 01:54 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-05-10 11:59 . 2011-04-15 01:54 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2011-04-15 01:54 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-05-10 11:59 . 2011-04-15 01:54 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-19 01:11 . 2011-04-19 01:11 45056 ----a-r- c:\documents and settings\User\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
2011-04-15 02:06 . 2011-04-15 02:06 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-15 02:06 . 2011-04-15 02:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-21 13:56 . 2011-04-22 05:20 143872 ----a-w- c:\windows\system32\xvid.ax
2011-03-19 15:06 . 2011-04-22 05:20 240640 ----a-w- c:\windows\system32\xvidvfw.dll
2011-03-19 15:04 . 2011-04-22 05:20 650752 ----a-w- c:\windows\system32\xvidcore.dll
2011-03-07 05:33 . 2011-04-14 23:03 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 12:00 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-04-29 12:39 . 2011-04-18 22:12 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2007-08-03 95504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"aswAhAScr.dll"="c:\program files\AVAST Software\Avast\aswRegSvr.exe" [2011-02-23 22016]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 19:49 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2004-05-12 22:18 241664 ----a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-02-12 20:38 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector v2]
2007-08-03 04:08 95504 ----a-w- c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/14/2011 6:54 PM 441176]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/14/2011 6:54 PM 307928]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/14/2011 6:54 PM 19544]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-01 c:\windows\Tasks\User_Feed_Synchronization-{FFEA4426-2709-41B9-BD34-893515F62E02}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Administrator.USER-4\Application Data\Mozilla\Firefox\Profiles\9veffpgf.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-31 21:54
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(832)
c:\windows\system32\WININET.dll
.
Completion time: 2011-05-31 21:57:48
ComboFix-quarantined-files.txt 2011-06-01 04:57
.
Pre-Run: 31,520,038,912 bytes free
Post-Run: 32,647,667,712 bytes free
.
- - End Of File - - 159A2622A3F3C5103C945369D960B5A0

Re: MALWARE problem please help1st June 2011, 10:26 pm

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:
Code:
File:: c:\windows\Xrejea.exe
Save this as CFScript.txt, in the same location as ComboFix.exe
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt
Please post the contents of the log in your next reply.

Re: MALWARE problem please help2nd June 2011, 1:52 am

Here is the log after following your directions in the last post. If it makes a difference, this was done in SAFE MODE....I can't get it to run unless it's in SM.

ComboFix 11-06-01.04 - Administrator 06/01/2011 18:38:30.2.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.385 [GMT -7:00]
Running from: c:\documents and settings\Administrator.USER-4\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator.USER-4\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\Xrejea.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Xrejea.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-05-02 to 2011-06-02 )))))))))))))))))))))))))))))))
.
.
2011-06-02 01:30 . 2011-06-02 01:30 -------- d-----w- C:\Combo-Fix
2011-06-01 00:02 . 2011-06-01 00:02 -------- d-----w- c:\windows\system32\wbem\Repository
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\program files\Corel
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\program files\Common Files\Ulead Systems
2011-05-31 23:59 . 2011-05-31 23:59 -------- d-----w- c:\program files\eBay
2011-05-30 04:37 . 2011-05-30 04:37 -------- d-----w- C:\found.000
2011-05-28 23:59 . 2011-05-28 23:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-05-28 03:18 . 2011-05-28 03:18 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-05-27 23:53 . 2011-05-27 23:55 -------- d-s---w- c:\documents and settings\Administrator
2011-05-27 11:21 . 2011-05-27 11:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2011-05-26 23:34 . 2011-05-26 23:34 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-05-19 22:12 . 2011-05-31 04:59 -------- d-----w- c:\documents and settings\All Users\eBay
2011-05-19 17:32 . 2011-05-19 17:32 49152 ----a-r- c:\windows\system32\inetwh32.dll
2011-05-19 17:32 . 2011-05-19 17:32 1044480 ----a-r- c:\windows\system32\roboex32.dll
2011-05-14 03:06 . 2011-05-14 03:06 -------- d-----w- c:\windows\ulead.dat
2011-05-12 07:11 . 1999-10-15 19:50 1056768 ----a-w- c:\windows\ROBOEX32.DLL
2011-05-12 07:11 . 1995-07-20 07:00 26832 ----a-w- c:\windows\CTL3DV2.DLL
2011-05-12 07:11 . 1999-01-28 22:44 49152 ----a-w- c:\windows\INETWH32.dll
2011-05-12 05:13 . 2011-05-12 07:11 -------- d-----w- c:\program files\Ulead Systems
2011-05-12 05:07 . 2011-05-12 07:08 -------- d-----w- c:\program files\Common Files\InstallShield
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-10 12:10 . 2011-04-15 01:53 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2011-04-15 01:53 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2011-04-15 01:54 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 12:03 . 2011-04-15 01:54 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2011-04-15 01:54 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:02 . 2011-04-15 01:54 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-05-10 12:02 . 2011-04-15 01:54 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-05-10 11:59 . 2011-04-15 01:54 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2011-04-15 01:54 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-05-10 11:59 . 2011-04-15 01:54 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-15 02:06 . 2011-04-15 02:06 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-15 02:06 . 2011-04-15 02:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-21 13:56 . 2011-04-22 05:20 143872 ----a-w- c:\windows\system32\xvid.ax
2011-03-19 15:06 . 2011-04-22 05:20 240640 ----a-w- c:\windows\system32\xvidvfw.dll
2011-03-19 15:04 . 2011-04-22 05:20 650752 ----a-w- c:\windows\system32\xvidcore.dll
2011-03-07 05:33 . 2011-04-14 23:03 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-04-29 12:39 . 2011-04-18 22:12 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2007-08-03 95504]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 19:49 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2004-05-12 22:18 241664 ----a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-02-12 20:38 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector v2]
2007-08-03 04:08 95504 ----a-w- c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/14/2011 6:54 PM 441176]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/14/2011 6:54 PM 307928]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/14/2011 6:54 PM 19544]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-02 c:\windows\Tasks\User_Feed_Synchronization-{FFEA4426-2709-41B9-BD34-893515F62E02}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Administrator.USER-4\Application Data\Mozilla\Firefox\Profiles\9veffpgf.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-01 18:47
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(424)
c:\windows\system32\COMRes.dll
.
Completion time: 2011-06-01 18:49:39
ComboFix-quarantined-files.txt 2011-06-02 01:49
ComboFix2.txt 2011-06-01 04:57
.
Pre-Run: 32,600,719,360 bytes free
Post-Run: 32,589,762,560 bytes free
.
- - End Of File - - 20E75E5DD6637A2DEBF74FD4A9B92165

Re: MALWARE problem please help2nd June 2011, 10:52 pm

Seriously, not to be unappreciative, but this is the 6th day since my original post. I have had no indication from you guys how things look.
My machine is still messed up and I'm going to have to bring it BACK to the shop.

Can you please let me know where we stand with all of this.

Continuing to download programs and post logs is fine, if you could let me know what's up, that would be nice too.
thanks, Jim.

Re: MALWARE problem please help4th June 2011, 1:12 am

Well, this is pretty pathetic. One week now with no real advice. :sad:

To think I supported you guys with a donation Ahahaha

Thanks for your help in the past, which was much more attentive. Not sure what's up....

Re: MALWARE problem please help5th June 2011, 2:06 pm

Sorry, but my life has been really really busy lately and there are more important things going on right now and I can't always be here.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

Check (tick) this box: YES, I accept the Terms of Use.
Click on the Start button next to it.
When prompted to run ActiveX. click Yes.
You will be asked to install an ActiveX. Click Install.
Once installed, the scanner will be initialized.
After the scanner is initialized, click Start.
Check (tick) Remove found threats box.
Check (tick) Scan unwanted applications.
Click on Scan.
It will start scanning. Please be patient.
Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.

MALWARE problem please help

descriptionMALWARE problem please help27th May 2011, 11:18 pm

descriptionRe: MALWARE problem please help28th May 2011, 4:19 am

descriptionRe: MALWARE problem please help28th May 2011, 4:23 am

descriptionRe: MALWARE problem please help28th May 2011, 4:25 am

descriptionRe: MALWARE problem please help28th May 2011, 4:28 am

descriptionRe: MALWARE problem please help28th May 2011, 4:32 am

descriptionRe: MALWARE problem please help28th May 2011, 4:33 am

descriptionRe: MALWARE problem please help28th May 2011, 4:33 am

descriptionRe: MALWARE problem please help28th May 2011, 4:35 am

descriptionRe: MALWARE problem please help29th May 2011, 11:03 pm

descriptionRe: MALWARE problem please help30th May 2011, 3:49 am

descriptionRe: MALWARE problem please help30th May 2011, 8:07 pm

descriptionRe: MALWARE problem please help31st May 2011, 2:54 am

descriptionRe: MALWARE problem please help31st May 2011, 2:54 am

descriptionRe: MALWARE problem please help31st May 2011, 2:58 am

descriptionRe: MALWARE problem please help31st May 2011, 4:50 am

descriptionRe: MALWARE problem please help31st May 2011, 6:07 pm

descriptionRe: MALWARE problem please help31st May 2011, 8:23 pm

descriptionRe: MALWARE problem please help1st June 2011, 7:58 am

descriptionRe: MALWARE problem please help1st June 2011, 10:26 pm

descriptionRe: MALWARE problem please help2nd June 2011, 1:52 am

descriptionRe: MALWARE problem please help2nd June 2011, 10:52 pm

descriptionRe: MALWARE problem please help4th June 2011, 1:12 am

descriptionRe: MALWARE problem please help5th June 2011, 2:06 pm

descriptionRe: MALWARE problem please help