Can't remove Win32.Autorun.tmp [Archive]

View Full Version : Can't remove Win32.Autorun.tmp

alphabet_soup

2010-09-05, 05:33

Hi there,

I am having problems with a Trojan called Win32.Autorun.tmp. Spybot is able to detect it, and I request that it fixes it each time it does so, but it seems to return every time I run the scan. Very persistent and annoying!

If anyone could help me purge it from my system forever that would be brilliant.

Logs are posted below.

Also I should note that I'm a complete noob, so if anyone can offer me advice, please do it in the most easy-to-understand way possible. Thanks!

DDS (Ver_10-03-17.01) - FAT32x86
Run by Owner at 12:26:02.54 on Sun 05/09/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.209 [GMT 10:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\willmonotti\Desktop\dds.scr
C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\033.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\089.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\977.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://trinity.unimelb.edu.au/portal
mDefault_Page_URL = hxxp://global.acer.com
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
mWinlogon: Taskman=c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
uWinlogon: Shell=c:\recycler\s-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe,explorer.exe,c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [vgr60] c:\windows\system32\6xc81oz.exe
uRun: [lbhc6y] c:\windows\system32\lr2xd2jk.exe
uRun: [llmcdi] c:\windows\system32\bm5hdyuu.exe
uRun: [rcc86] c:\windows\system32\q1gw1ni13p.exe
uRun: [mcdi3e] c:\windows\system32\bm86y3pl.exe
uRun: [yuupgg] c:\windows\system32\ytkkfwwr.exe
uRun: [zuvqm] c:\windows\system32\kkfwwrii.exe
uRun: [upggbs] c:\windows\system32\dzpplbbxnn.exe
uRun: [wbxxoo3] c:\windows\system32\0xdyep0.exe
uRun: [teea6r] c:\windows\system32\w39ee5v1wb.exe
uRun: [tkkfww] c:\windows\system32\i1eaavmmhy.exe
uRun: [pkkgww] c:\windows\system32\ni1eaavmmh.exe
uRun: [ezqqlcc] c:\windows\system32\oojaavmmhy.exe
uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [snoejuf] c:\windows\system32\86y2ff6.exe
uRun: [yzpf0w] c:\windows\system32\n20zvfbw.exe
uRun: [nojpk0r] c:\windows\system32\0jff66w.exe
uRun: [falhcc] c:\windows\system32\1qmmhyy.exe
uRun: [xdtyuua] c:\windows\system32\vlw2nyojzav.exe
uRun: [dzuklg2] c:\windows\system32\rsnt66k8708.exe
uRun: [uplbbxc] c:\windows\system32\pff69m1i.exe
uRun: [faawmm] c:\windows\system32\3wwriid.exe
uRun: [mmiyy6k] c:\windows\system32\fwwriiduupg.exe
uRun: [hcyytkk] c:\windows\system32\qlccxoojaa.exe
uRun: [zaflw] c:\windows\system32\70bxny1.exe
uRun: [cydo8] c:\windows\system32\cttuzf81.exe
uRun: [wcxtoeu] c:\windows\system32\70i1zuv.exe
uRun: [akvwx] c:\windows\system32\e1vbg3sn.exe
uRun: [vqwxin] c:\windows\system32\60niy1p.exe
uRun: [qhxiioj] c:\windows\system32\1cdi81u.exe
uRun: [hxdtp] c:\windows\system32\hm2noj081q.exe
uRun: [xsoo8] c:\windows\system32\sndu1klq.exe
uRun: [wrmns] c:\windows\system32\60xs0zf.exe
uRun: [cito0] c:\windows\system32\chxd60flvr.exe
uRun: [dezpq] c:\windows\system32\w2xyt081alm.exe
uRun: [dzuva] c:\windows\system32\1epqlr8.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [LaunchApp] Alaunch
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [KTPWare] c:\program files\elantech\ktp.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R? Lbd;Lbd
R? WDC_SAM;WD SCSI Pass Thru driver
R? ywyyitdy;System Monitor
S? vsdatant;vsdatant
S? WDDMService;WD SmartWare Drive Manager
S? WDSmartWareBackgroundService;WD SmartWare Background Service

=============== Created Last 30 ================

2010-09-03 13:25:36 0 d-sh--w- C:\FOUND.026
2010-09-02 12:08:00 0 d-sh--w- C:\FOUND.025
2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
2010-09-01 13:53:23 0 d-----w- c:\windows\pss
2010-09-01 04:55:38 0 d-sh--w- C:\FOUND.024
2010-08-31 13:58:24 0 d-sh--w- C:\FOUND.023
2010-08-31 09:41:40 0 d-sh--w- C:\FOUND.022
2010-08-27 11:22:10 0 d-sh--w- C:\FOUND.021
2010-08-26 13:15:04 0 d-sh--w- C:\FOUND.020

==================== Find3M ====================

2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe
2004-08-03 19:00:00 160603 --sh--r- c:\windows\system32\gnhnveo.dll

============= FINISH: 12:28:04.40 ===============

jmw3

2010-09-07, 17:46

Hello & Welcome to Safer-Networking

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

In the meantime please note the following:
Any recommendations made are for your computer problems only and should NOT be used on any other computer.
Please DO NOT run any scans/tools or other fixes unless I ask you to. This is very important for several reasons. Here are just two of them:
1. The tools that we use are very powerful and can cause >>irreparable damage<< to your computer if not used correctly.
2. Commercial scanners, for the most part can not completely remove some of the more "resistant" infections. This makes it much more difficult to get rid of completely.
If you get stuck or are unsure of something please ask for a further explanation, do not guess.
It will require more than one round to properly clean your system. Continue to respond to this thread until I give you the All Clean! even if symptoms seemingly abate.Please note that the forum is very busy and if I don't hear from you within four days this thread will be closed.
If for any reason you cannot complete instructions within that time, that's fine, just put a post here so that I know you're still here. We get a lot of people who simply leave & if there is no contact for that amount of time I will have to assume you have abandoned your topic.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

Thanks

Safer-Networking P2P Policy
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

µTorrent

I'd like you to read the File Sharing, otherwise known as Peer To Peer. (P2P) (http://forums.spybot.info/showthread.php?t=282).
Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) & any other P2P programs.

DDS
Re-run DDS & post the contents of both logs... copy/pasting the contents will be fine, no need to attach the logs.

Gmer
Download GMER Rootkit Scanner from here (http://www.gmer.net/download.php) & save it to your desktop.
Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO

http://i28.photobucket.com/albums/c227/tetonbob/gmer_th.gif (http://i28.photobucket.com/albums/c227/tetonbob/gmer_screen2-1.gif)
Click the image to enlarge it

In the right panel, you will see several boxes that have been checked. Uncheck the following ... IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
Save it where you can easily find it, such as your desktop, and post it in reply**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Do not run any programs while Gmer is running.

NOTE: If you cannot run GMER as indicated above, save a scan from the initial startup scan.
Before scanning, make sure all other running programs are closed & no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan
Double click the gmer.exe file
The program will begin to run & perform an initial scan. If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No
After the "initial scan" is complete, click on the Save button, save the log file to your desktop & post it in your replyTo post in next reply:
Contents of DDS log
Contents of Attach.txt
Contents of Gmer log

alphabet_soup

2010-09-08, 06:25

Hey jmw3! Thanks so much for replying and helping me.

The logs you requested are posted below:

"DDS":

DDS (Ver_10-03-17.01) - FAT32x86
Run by willmonotti at 13:01:38.37 on Wed 08/09/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.357 [GMT 10:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://trinity.unimelb.edu.au/portal
mDefault_Page_URL = hxxp://global.acer.com
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
mWinlogon: Taskman=c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
uWinlogon: Shell=c:\recycler\s-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe,explorer.exe,c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [vgr60] c:\windows\system32\6xc81oz.exe
uRun: [lbhc6y] c:\windows\system32\lr2xd2jk.exe
uRun: [llmcdi] c:\windows\system32\bm5hdyuu.exe
uRun: [rcc86] c:\windows\system32\q1gw1ni13p.exe
uRun: [mcdi3e] c:\windows\system32\bm86y3pl.exe
uRun: [yuupgg] c:\windows\system32\ytkkfwwr.exe
uRun: [zuvqm] c:\windows\system32\kkfwwrii.exe
uRun: [upggbs] c:\windows\system32\dzpplbbxnn.exe
uRun: [wbxxoo3] c:\windows\system32\0xdyep0.exe
uRun: [teea6r] c:\windows\system32\w39ee5v1wb.exe
uRun: [tkkfww] c:\windows\system32\i1eaavmmhy.exe
uRun: [pkkgww] c:\windows\system32\ni1eaavmmh.exe
uRun: [ezqqlcc] c:\windows\system32\oojaavmmhy.exe
uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [snoejuf] c:\windows\system32\86y2ff6.exe
uRun: [yzpf0w] c:\windows\system32\n20zvfbw.exe
uRun: [nojpk0r] c:\windows\system32\0jff66w.exe
uRun: [falhcc] c:\windows\system32\1qmmhyy.exe
uRun: [xdtyuua] c:\windows\system32\vlw2nyojzav.exe
uRun: [dzuklg2] c:\windows\system32\rsnt66k8708.exe
uRun: [uplbbxc] c:\windows\system32\pff69m1i.exe
uRun: [faawmm] c:\windows\system32\3wwriid.exe
uRun: [mmiyy6k] c:\windows\system32\fwwriiduupg.exe
uRun: [hcyytkk] c:\windows\system32\qlccxoojaa.exe
uRun: [zaflw] c:\windows\system32\70bxny1.exe
uRun: [cydo8] c:\windows\system32\cttuzf81.exe
uRun: [wcxtoeu] c:\windows\system32\70i1zuv.exe
uRun: [akvwx] c:\windows\system32\e1vbg3sn.exe
uRun: [vqwxin] c:\windows\system32\60niy1p.exe
uRun: [qhxiioj] c:\windows\system32\1cdi81u.exe
uRun: [hxdtp] c:\windows\system32\hm2noj081q.exe
uRun: [xsoo8] c:\windows\system32\sndu1klq.exe
uRun: [wrmns] c:\windows\system32\60xs0zf.exe
uRun: [cito0] c:\windows\system32\chxd60flvr.exe
uRun: [dezpq] c:\windows\system32\w2xyt081alm.exe
uRun: [dzuva] c:\windows\system32\1epqlr8.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [LaunchApp] Alaunch
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [KTPWare] c:\program files\elantech\ktp.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\pkfgbh60jef.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jjkf08hm.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\91whidj.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gbxx2dtkk.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\vrhhxd66u81.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\86i81uf.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\siy0zpv6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\xnndj66a8.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\kpfl60ntdz.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tup03g0h.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\0wwriid.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gccxoojaav.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\hcc6oo6aa81.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1tjpvbh.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\s8jpvbhnz.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\vwhntjpvgrs.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\glwhidj6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fbwxc81zu.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g6w81itup.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\bxx66o86.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\86c81o3.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\dzpplbbx.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6kk6ww6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\qqlccxooja.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\zvggrchsdez.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\m86y81kvw.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w1mns86e3a.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6dtz0fq.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ddtz0fqlc.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tjjfvvrh.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\lccxooz870b.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\2bcx081.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\chsdezf6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\3cxyy0z.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fl5ccsty.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1yjpfl2.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\d0ze81b5cn0.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\0ssneef.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\r1cteeffbw.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\z03q1hn1y.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1bh0xtt.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\u87wcx1jj.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ieezqqlccx.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jfvvrhhd.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\3wwriid.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g1cyytkk.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\m70njee6q.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6yy6kk6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\pfl2rx2d.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\f66rs1i3.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\di3e1aq1rs.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\hdd66u86.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yy13avg86.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\91itupf.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w81itupv2.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fq1ghm81.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jfaq1mc1y.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\aql0ccsi1z.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yo1f70bmsn.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\up084xnn.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\zuklq6rcnoj.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g3msn0eeu.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\kpalmhn2.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gbrstju1.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\l0ccxytup.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1vfbwxc.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ll2c5xtop.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fgb081yopu.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\eezqqlccxo.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\cxyu5ghy.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\94uufq5.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\citzkf253x.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ekl271it.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\u3l0rx0t26.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6g0hndd.exe
StartupFolder: c:\docume~1\willmo~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\q81cnojzavl.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\nxtopu81g8.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w86i81ufgbr.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yzkfagb081.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\s9efvvrcsxt.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tjpfvwrhii.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{51fb15f4-ad27-43bc-ad4b-dd0354fb6bbd}\Icon3E5562ED7.ico
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
TCP: {A26EB843-3715-4469-B456-842FEF3FC788} = 128.250.66.5,128.250.201.5
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-11-14 394952]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2009-11-13 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-6-21 11520]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 ywyyitdy;System Monitor;c:\windows\system32\svchost.exe -k netsvcs [2005-5-24 14336]

=============== Created Last 30 ================

2010-09-06 04:43:12 0 d-sh--w- C:\FOUND.027
2010-09-03 13:25:36 0 d-sh--w- C:\FOUND.026
2010-09-02 12:08:00 0 d-sh--w- C:\FOUND.025
2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
2010-09-01 13:53:23 0 d-----w- c:\windows\pss
2010-09-01 04:55:38 0 d-sh--w- C:\FOUND.024
2010-08-31 13:58:24 0 d-sh--w- C:\FOUND.023
2010-08-31 09:41:40 0 d-sh--w- C:\FOUND.022
2010-08-27 11:22:10 0 d-sh--w- C:\FOUND.021
2010-08-26 13:15:04 0 d-sh--w- C:\FOUND.020

==================== Find3M ====================

2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe
2004-08-03 19:00:00 160603 --sh--r- c:\windows\system32\gnhnveo.dll

============= FINISH: 13:01:54.54 ===============

"Attach":

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/02/2009 6:39:55 AM
System Uptime: 9/07/2010 10:28:54 PM (1455 hours ago)

Motherboard: Acer | | Mimid
Processor: Intel(R) Pentium(R) M processor 1.73GHz | uFCPGA | 1313/133mhz

==== Disk Partitions =========================

C: is FIXED (FAT32) - 75 GiB total, 3.589 GiB free.
D: is CDROM ()
F: is CDROM (UDF)
G: is FIXED (NTFS) - 465 GiB total, 396.211 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 6.0
Adobe Shockwave Player 11.5
AIM 7
AIM Search
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.3.9 (Unicode)
Bonjour
Cisco Systems VPN Client 5.0.04.0300
DC++ 0.7091
Download Updater (AOL LLC)
ERUNT 1.1j
First Principles of Business Law
foobar2000 v0.9.6.9
Google Chrome
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB915865)
Intel(R) Graphics Media Accelerator Driver for Mobile
iTunes
Java Auto Updater
Java(TM) 6 Update 20
KTP Ware PS/2-WDM 5.0.1.2
LAME v3.98.2 for Audacity
Last.fm 1.5.4.24567
Microsoft .NET Framework 2.0
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Ultimate 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.3)
NTI Backup NOW! 4
NTI CD & DVD-Maker
OGG MP3 Converter 3.2 build 827
Protected Music Converter 1.0.0.21
QuickTime
Realtek AC'97 Audio
RunAlyzer
Safari
Skills-Task 2 Feedback
SMSC IrCC V5.1.3600.5 SP2
SoftV90 Data Fax Modem with SmartCP
Spybot - Search & Destroy
Total Commander (Remove or Repair)
Trillian
Universal Soccer Manager 2
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
WD SmartWare
WebFldrs XP
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB885855
WinRAR archiver
WinZip
Xiph QuickTime Components

==== Event Viewer Messages From Past Week ========

4/09/2010 12:29:49 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer B38EF8B56EAF41E that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C0. The master browser is stopping or an election is being forced.
4/09/2010 10:10:04 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
4/09/2010 1:01:15 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the JavaQuickStarterService service.
2/09/2010 7:47:08 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.
2/09/2010 4:28:20 PM, error: Service Control Manager [7000] - The Ati HotKey Poller service failed to start due to the following error: The system cannot find the file specified.
2/09/2010 12:17:58 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ERIC-SINCLAIR that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-. The master browser is stopping or an election is being forced.
2/09/2010 11:08:44 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer H203-28-242-83 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09. The master browser is stopping or an election is being forced.
1/09/2010 7:48:08 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
1/09/2010 7:48:08 PM, error: Service Control Manager [7023] - The System Monitor service terminated with the following error: A dynamic link library (DLL) initialization routine failed.
1/09/2010 3:03:54 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer REICHART-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-41. The master browser is stopping or an election is being forced.
1/09/2010 2:58:56 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
1/09/2010 2:56:09 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
1/09/2010 2:03:25 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SOPHIEBOUCAUT that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-. The master browser is stopping or an election is being forced.
1/09/2010 1:00:01 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SCOTT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-4150-. The master browser is stopping or an election is being forced.

==== End Of File ===========================

"GMER":

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-08 13:23:22
Windows 5.1.2600 Service Pack 2
Running: umsywfnu.exe; Driver: C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\ugldqpod.sys

---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xAA773930]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xAA77EA80]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xAA773F20]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xAA77F6E0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteValueKey [0xAA77F440]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xAA77F8B0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xAA773D70]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xAA780250]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xAA77FCB0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xAA780080]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xAA774120]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetValueKey [0xAA77F140]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 4 Bytes JMP D25AAA77
? System32\Drivers\hiber_WMILIB.SYS The system cannot find the path specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[320] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 0165ADCD
.text C:\WINDOWS\System32\svchost.exe[320] NETAPI32.dll!NetpwPathCanonicalize 5B86A259 5 Bytes JMP 0165AD64
.text C:\WINDOWS\system32\svchost.exe[432] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 008CADCD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]

---- Devices - GMER 1.0.15 ----

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] ywyyitdy <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000b6b5d6d42
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@DisplayName System Monitor
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Description Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy\Parameters@ServiceDll C:\WINDOWS\system32\gnhnveo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000b6b5d6d42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@DisplayName System Monitor
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Type 32
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Start 2
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Description Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy\Parameters@ServiceDll C:\WINDOWS\system32\gnhnveo.dll

---- EOF - GMER 1.0.15 ----

Thanks again! :)

jmw3

2010-09-08, 06:54

Hmmm.... We've got some work to do.
Windows XP Service Pack 2 & no Anti-Virus software. This is no doubt why you are so heavily infected.
First up, some warnings advice you should seriously take heed of.

WARNING!!!

You are running a version of Windows that is no longer supported. You need to be aware that once an operating system is no longer supported there will be no further Microsoft Updates issued for that operating system. If you are running XP SP2, or running Vista with no Service Packs installed, be forewarned that those unpatched operating systems will soon become prime targets for malware infestations unless you take steps to bring them up to date by installing the required Service Pack for your system.

http://windows.microsoft.com/en-us/windows/help/what-does-end-of-support-mean

Support for Windows Vista without any service packs ended on April 13, 2010. To continue support, make sure you've installed Windows Vista SP2.

Support for Windows XP with Service Pack 2 (SP2) ended on July 13, 2010. To continue support, make sure you've installed Windows XP Service Pack 3 (SP3).
IMPORTANT: The above mentioned Service Packs should only be installed on a malware free computer.
So wait until I have given the All Clean.

NOTE: 64 bit Windows XP SP2 will still receive security updates as there is no SP3 for 64 bit XP.

Support for Windows XP SP1 ended on October 10, 2006.

No Anti-virus
You don't have any evidence of anti-virus software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Download a free anti-virus software from one these excellent vendors NOW:

1) Microsoft Security Essentials (http://www.microsoft.com/security_essentials/default.aspx?mkt=en-us) - Microsoft Security Essentials provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.
2) Antivir PersonalEdition Classic (http://www.free-av.com/en/download/1/download_avira_antivir_personal__free_antivirus.html)- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
3) avast! 4 Home Edition (http://files.avast.com/iavs4pro/setupeng.exe) - Anti-virus program for Windows. The home edition is freeware for noncommercial users.

Your computer must have only ONE anti-virus program installed at any time. Having more than one anti-virus program installed & active will cause program conflicts, false virus alerts, and system crashes.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. If you have a problem with one step, just move to the next.

Create A System Restore Point
Create a new System Restore point which you can use in case of any problems that may occur:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like Pre-Cleaning then press the Create button and once it's done press Close

TFC (Temp File Cleaner)
Download TFC (Temp File Cleaner) by Old Timer Here (http://oldtimer.geekstogo.com/TFC.exe) & save it to your desktop.
Save any unsaved work. TFC Cleaner will close all open application windows
Double-click TFC.exe to run the program, your desktop will temporarily disappear
If prompted, click Yes to rebootNote: Save your work.. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take any longer than a couple of minutes & may only take a few seconds. Only if needed will you be prompted to reboot.

ComboFix
Download ComboFix from one of these locations (DO NOT download ComboFix from anywhere else but one of the provided links):
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)

**IMPORTANT !!! Save ComboFix.exe to your Desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
A guide to do this can be found here (http://www.bleepingcomputer.com/forums/topic114351.html)
Double click on ComboFix.exe & follow the prompts
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Consolehttp://img.photobucket.com/albums/v666/sUBs/Query_RC.gif
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v666/sUBs/RC_successful.gif

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next replyA word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
ComboFix log
Update on how the computer is running

alphabet_soup

2010-09-08, 13:06

Hi there

thanks again for your post and assistance

I started running Combo Fix and it asked me if I needed to download the Microsoft Windows Recovery Console, I selected "Yes", then it came up with this message:

http://img64.imageshack.us/img64/2228/24126863.png

So I pressed "OK" and this came up:

http://img101.imageshack.us/img101/3469/prscr2.jpg

I'm not sure how to proceed, have you any idea? Should I re-download Combo Fix?

Cheers

jmw3

2010-09-08, 13:56

Hi
# As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
# Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery ConsoleNo need to re-download, but allow it to install the Recovery Console

jmw3

2010-09-08, 14:08

Sorry... misread what you said.

Yes, delete the copy of ComboFix you have & re-download it. before saving it rename it to commy.exe, then try running it.

alphabet_soup

2010-09-08, 14:55

Hmmm...still didn't work! :(

After pressing OK again when I got the message about the Licence Agreement, this is what came up

http://img7.imageshack.us/img7/2314/59936613.png

Then I pressed "close" and the same error message showed up again.

jmw3

2010-09-08, 15:06

OK... Leave ComboFix for a bit. We'll try & get rid of some the crap that's on your computer to see if it makes any difference.

Malwarebytes' Anti-Malware
Download Malwarebytes' Anti-Malware here (http://www.malwarebytes.org/mbam-download.php) & save to your desktop.
Double-click mbam-setup.exe & follow the prompts to install the program
At the end, be sure a checkmark is placed next to:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish
If an update is found, it will download and install the latest version
Once the program has loaded, select Perform full scan, then click Scan
When the scan is complete, click OK, then Show Results to view the results
Check all items except items in the C:\System Volume Information folder... then click on Remove Selected
When completed, a log will open in Notepad. Please copy & paste the log back into your next reply
Note:
The log is automatically saved by Malwarebytes' Anti-Malware & can be viewed by clicking the Logs tabNote: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either & let Malwarebytes' Anti-Malware proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
If you receive an (Error Loading) error on reboot please reboot a second time . It is normal for this error to occur once & does not need to be reported unless it returns on future reboots.

alphabet_soup

2010-09-08, 15:35

Swell...ok here's the Malwarebytes log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

8/09/2010 10:35:06 PM
mbam-log-2010-09-08 (22-35-06).txt

Scan type: Full scan (C:\|)
Objects scanned: 176360
Time elapsed: 22 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 8
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\.pox (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\pofile (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Miracle (PUP.PerfectOptimizer) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Perfect Optimizer (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FirstBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Service (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Application (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Temp (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

Files Infected:
C:\RECYCLER\S-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe (Worm.P2P) -> Delete on reboot.
C:\RECYCLER\S-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe (Worm.Autorun.B) -> Delete on reboot.
C:\Program Files\Perfect Optimizer\PerfectOptimizer.ini (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

jmw3

2010-09-08, 15:48

Hi

OK good. But the Database version you used to run Malwarebytes' Anti-Malware was woefully out of date. The current Database version is 4570 (at the time of this post).

Can you run Malwarebytes' again, ensuring you click the Update tab then Check for Updates before conducting the scan. Then post the log.

Cheers

alphabet_soup

2010-09-08, 16:05

I tried updating but got this error message:

http://img375.imageshack.us/img375/7323/89893928.png

Any ideas? Thanks again

alphabet_soup

2010-09-08, 16:08

EDIT: Never mind - just realised I needed to change the proxy settings! Running the scan again now :)

jmw3

2010-09-08, 16:20

OK, good :)

alphabet_soup

2010-09-09, 03:17

Hey, sorry, the scan was running really slowly last night so I abandoned it and tried again this morning - much faster.

Anyway, here's the log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4576

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

9/09/2010 10:16:30 AM
mbam-log-2010-09-09 (10-16-30).txt

Scan type: Full scan (C:\|)
Objects scanned: 195308
Time elapsed: 19 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 136

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0d82acd6-a652-4496-a298-2bde705f4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025e484-d4b0-441a-9f0b-69063bd679ce} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258b35c-05b8-4c0e-9525-9bccc70f8f2d} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{a89256ad-ec17-4a83-bef5-4b8bc4f39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7} (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\chrome (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\defaults (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\defaults\preferences (Adware.BarDiscover) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\willmonotti\Local Settings\Temp\709.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\621.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\047.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\421.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\188.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\995.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\889.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\C1IJGD6N\vewmknm[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\C1IJGD6N\fekoikj[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\0P2BWPI3\fewmok[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\0P2BWPI3\fewmkojk[1].exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\G9MBOXE3\fewmi[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\G9MBOXE3\jmokjo1[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\0DE3S56V\dfwemklm[1].exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\pkfgbh60jef.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\jjkf08hm.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\91whidj.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\gbxx2dtkk.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\vrhhxd66u81.exe (Trojan.DDox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\86i81uf.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\siy0zpv6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\xnndj66a8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\kpfl60ntdz.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\tup03g0h.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0wwriid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\gccxoojaav.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\hcc6oo6aa81.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1tjpvbh.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\s8jpvbhnz.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\vwhntjpvgrs.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\glwhidj6.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fbwxc81zu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\g6w81itup.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\bxx66o86.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\86c81o3.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\dzpplbbx.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6kk6ww6.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\qqlccxooja.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\zvggrchsdez.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\m86y81kvw.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w1mns86e3a.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6dtz0fq.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ddtz0fqlc.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\tjjfvvrh.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\lccxooz870b.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\2bcx081.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\chsdezf6.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\3cxyy0z.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fl5ccsty.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1yjpfl2.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\d0ze81b5cn0.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0ssneef.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\r1cteeffbw.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\z03q1hn1y.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1bh0xtt.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\u87wcx1jj.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ieezqqlccx.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\jfvvrhhd.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\3wwriid.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\g1cyytkk.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\m70njee6q.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6yy6kk6.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\pfl2rx2d.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\f66rs1i3.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\di3e1aq1rs.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\hdd66u86.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\yy13avg86.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\91itupf.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w81itupv2.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fq1ghm81.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\jfaq1mc1y.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\aql0ccsi1z.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\yo1f70bmsn.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\up084xnn.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\zuklq6rcnoj.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\g3msn0eeu.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\kpalmhn2.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\gbrstju1.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\l0ccxytup.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1vfbwxc.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ll2c5xtop.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fgb081yopu.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\eezqqlccxo.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\cxyu5ghy.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\94uufq5.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\citzkf253x.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ekl271it.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\u3l0rx0t26.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6g0hndd.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\q81cnojzavl.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\nxtopu81g8.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w86i81ufgbr.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\s9efvvrcsxt.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\hcdi81fabg.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w1n70jzf.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\c86o81almhx.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\2y5tpkl.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\mhn60pvfbw.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\91mxytz.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\2too6aa.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\r0xtoo6aa.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\wriiduupgg.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\riiduupggbs.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1wssnee.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\a1wssneezq.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\rmm6yy6kk.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\llhxxtjjfvv.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1t703a0.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\i6y86k81w.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\j70qqgw1n7.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0oojffb.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0uk0ggb.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ggbssnee.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fbrrnddz.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\70lhcc6.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\nnjzup6rhhd.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6qq6cc6.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\neezqqlccxo.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\avmmhddz.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6mxyytk.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fa1whi0eez.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\zavlmhs8.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\081cnoj.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\lr66i86u.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w6m81yjkf.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\mc0dtz66q8.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\sxnt60vblh.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\rnn2tppll2r.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\q3cxd601v7.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001383.exe (Worm.P2P) -> Not selected for removal.
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001384.exe (Trojan.Agent) -> Not selected for removal.
C:\FOUND.022\FILE0001.CHK (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\install.rdf (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\chrome.manifest (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\chrome\bardiscover.jar (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\defaults\preferences\prefs.js (Adware.BarDiscover) -> Quarantined and deleted successfully.

jmw3

2010-09-09, 04:19

Hi

That looks better. Let's try ComboFix again. Delete the version of ComboFix you have & download it again:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)

Run it following instructions previously posted & post the resulting log.

alphabet_soup

2010-09-09, 07:43

jmw3

2010-09-09, 08:28

Hi

Leave ComboFix for the time being.

OTL
Download OTL by Old Timer from Here (http://oldtimer.geekstogo.com/OTL.exe) & save it to your Desktop. Double click on the icon to run it. Make sure all other windows are closed & to let it run uninterrupted
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop - Click here to download it (http://www.geekstogo.com/forum/files/download/395-otl-custom-scan-file-scantxt/). You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying Click Ok to load a custom scan from a file or Cancel to cancel
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt & click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long When the scan completes, it will open two notepad windows OTL.Txt & Extras.Txt. These are saved in the same location as OTL
Copy/paste the contents of these files, one at a time & post them in your next replyTo post in next reply:
Contents of OTL.txt
Contents of Extras.txt
These are large logs, so one log per post please

jmw3

2010-09-09, 08:33

What happens if you click Ignore on that message?

alphabet_soup

2010-09-09, 08:37

What happens if you click Ignore on that message?

I haven't tried it; I assumed it would start running the scan without the Recovery Console?

Will do the OTL stuff now

alphabet_soup

2010-09-09, 08:44

OTL Logs:

"OTL":

OTL logfile created on: 9/09/2010 3:40:18 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\willmonotti\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1,015.00 Mb Total Physical Memory | 470.00 Mb Available Physical Memory | 46.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.51 Gb Total Space | 4.24 Gb Free Space | 5.69% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WILL
Current User Name: willmonotti
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
PRC - C:\Program Files\Last.fm\LastFM.exe (Last.fm)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveUtil.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveNew.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rsaenh.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (CiscoVpnInstallService) -- C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE File not found
SRV - (Ati HotKey Poller) -- C:\WINDOWS\System32\Ati2evxx.exe File not found
SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
SRV - (WDSmartWareBackgroundService) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (Lbd) -- C:\WINDOWS\System32\DRIVERS\Lbd.sys File not found
DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ESDCR) -- C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ESMCR) -- C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (Ktp) -- C:\WINDOWS\system32\drivers\Ktp.sys (ELANTECH Devices Corp.)
DRV - (b57w2k) Broadcom NetLink (TM) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (EMSCR) -- C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://trinity.unimelb.edu.au/portal
IE - HKCU\..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = wwwproxy.student.unimelb.edu.au:8000

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us"
FF - prefs.js..browser.startup.homepage: "https://www.trinitycollege.vic.edu.au/portal/today/today.php"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.53
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query="
FF - prefs.js..network.proxy.backup.ftp: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.ftp_port: 8000
FF - prefs.js..network.proxy.backup.gopher: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.gopher_port: 8000
FF - prefs.js..network.proxy.backup.socks: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.socks_port: 8000
FF - prefs.js..network.proxy.backup.ssl: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.ssl_port: 8000
FF - prefs.js..network.proxy.ftp: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.ftp_port: 8000
FF - prefs.js..network.proxy.gopher: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.gopher_port: 8000
FF - prefs.js..network.proxy.http: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.http_port: 8000
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.socks_port: 8000
FF - prefs.js..network.proxy.ssl: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.ssl_port: 8000
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/02/09 18:52:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/02/09 18:52:32 | 000,000,000 | ---D | M]

[2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Extensions
[2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions
[2009/06/03 19:00:26 | 000,000,000 | ---D | M] (MediaWrap) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{dd68c513-9296-4b63-8d8b-8f1c991c8a48}
[2009/12/12 17:56:04 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/03/25 20:14:48 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\mozilla-add-ons.xml
[2009/05/22 01:42:46 | 000,004,140 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\youtube.xml
[2009/02/09 18:52:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/23 23:02:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/23 23:01:54 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/12 18:57:14 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/12 18:57:14 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/12 18:57:14 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/12 18:57:14 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/11/20 21:35:48 | 000,000,732 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe File not found
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe File not found
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe File not found
O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SoundMan] File not found
O4 - HKCU..\Run: [akvwx] C:\WINDOWS\System32\e1vbg3sn.exe File not found
O4 - HKCU..\Run: [cito0] C:\WINDOWS\System32\chxd60flvr.exe File not found
O4 - HKCU..\Run: [cydo8] C:\WINDOWS\System32\cttuzf81.exe File not found
O4 - HKCU..\Run: [dezpq] C:\WINDOWS\System32\w2xyt081alm.exe File not found
O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe File not found
O4 - HKCU..\Run: [dzuklg2] C:\WINDOWS\System32\rsnt66k8708.exe File not found
O4 - HKCU..\Run: [dzuva] C:\WINDOWS\System32\1epqlr8.exe File not found
O4 - HKCU..\Run: [ezqqlcc] C:\WINDOWS\System32\oojaavmmhy.exe File not found
O4 - HKCU..\Run: [faawmm] C:\WINDOWS\System32\3wwriid.exe File not found
O4 - HKCU..\Run: [falhcc] C:\WINDOWS\System32\1qmmhyy.exe File not found
O4 - HKCU..\Run: [hcyytkk] C:\WINDOWS\System32\qlccxoojaa.exe File not found
O4 - HKCU..\Run: [hxdtp] C:\WINDOWS\System32\hm2noj081q.exe File not found
O4 - HKCU..\Run: [lbhc6y] C:\WINDOWS\System32\lr2xd2jk.exe File not found
O4 - HKCU..\Run: [llmcdi] C:\WINDOWS\System32\bm5hdyuu.exe File not found
O4 - HKCU..\Run: [mcdi3e] C:\WINDOWS\System32\bm86y3pl.exe File not found
O4 - HKCU..\Run: [mmiyy6k] C:\WINDOWS\System32\fwwriiduupg.exe File not found
O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe File not found
O4 - HKCU..\Run: [nojpk0r] C:\WINDOWS\System32\0jff66w.exe File not found
O4 - HKCU..\Run: [pkkgww] C:\WINDOWS\System32\ni1eaavmmh.exe File not found
O4 - HKCU..\Run: [qhxiioj] C:\WINDOWS\System32\1cdi81u.exe File not found
O4 - HKCU..\Run: [rcc86] C:\WINDOWS\System32\q1gw1ni13p.exe File not found
O4 - HKCU..\Run: [snoejuf] C:\WINDOWS\System32\86y2ff6.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [teea6r] C:\WINDOWS\System32\w39ee5v1wb.exe File not found
O4 - HKCU..\Run: [tkkfww] C:\WINDOWS\System32\i1eaavmmhy.exe File not found
O4 - HKCU..\Run: [upggbs] C:\WINDOWS\System32\dzpplbbxnn.exe File not found
O4 - HKCU..\Run: [uplbbxc] C:\WINDOWS\System32\pff69m1i.exe File not found
O4 - HKCU..\Run: [vgr60] C:\WINDOWS\System32\6xc81oz.exe File not found
O4 - HKCU..\Run: [vqwxin] C:\WINDOWS\System32\60niy1p.exe File not found
O4 - HKCU..\Run: [wbxxoo3] C:\WINDOWS\System32\0xdyep0.exe File not found
O4 - HKCU..\Run: [wcxtoeu] C:\WINDOWS\System32\70i1zuv.exe File not found
O4 - HKCU..\Run: [wrmns] C:\WINDOWS\System32\60xs0zf.exe File not found
O4 - HKCU..\Run: [xdtyuua] C:\WINDOWS\System32\vlw2nyojzav.exe File not found
O4 - HKCU..\Run: [xsoo8] C:\WINDOWS\System32\sndu1klq.exe File not found
O4 - HKCU..\Run: [yuupgg] C:\WINDOWS\System32\ytkkfwwr.exe File not found
O4 - HKCU..\Run: [yzpf0w] C:\WINDOWS\System32\n20zvfbw.exe File not found
O4 - HKCU..\Run: [zaflw] C:\WINDOWS\System32\70bxny1.exe File not found
O4 - HKCU..\Run: [zuvqm] C:\WINDOWS\System32\kkfwwrii.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
O4 - Startup: C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 203.28.240.18 203.28.240.20
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/24 15:15:44 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell - "" = AutoRun
O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\setup.exe -- [2004/08/04 05:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun\command - "" = F:\WD SmartWare.exe -- File not found
O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: ywyyitdy - C:\WINDOWS\system32\gnhnveo.dll ()

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/09 15:37:43 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
[2010/09/09 15:36:36 | 000,000,000 | --SD | C] -- C:\commy
[2010/09/08 22:11:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Malwarebytes
[2010/09/08 22:11:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/08 22:11:17 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/08 22:10:20 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
[2010/09/08 19:57:45 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/09/08 19:54:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/09/08 19:54:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/09/08 19:54:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/09/08 19:54:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/08 14:35:50 | 000,000,000 | -HSD | C] -- C:\FOUND.031
[2010/09/08 14:24:32 | 000,000,000 | -HSD | C] -- C:\FOUND.030
[2010/09/08 13:57:30 | 000,000,000 | -HSD | C] -- C:\FOUND.029
[2010/09/08 13:43:06 | 000,000,000 | -HSD | C] -- C:\FOUND.028
[2010/09/06 14:43:12 | 000,000,000 | -HSD | C] -- C:\FOUND.027
[2010/09/05 12:25:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/09/05 12:24:56 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/09/05 12:16:21 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
[2010/09/03 23:25:36 | 000,000,000 | -HSD | C] -- C:\FOUND.026
[2010/09/02 22:08:00 | 000,000,000 | -HSD | C] -- C:\FOUND.025
[2010/09/01 23:56:04 | 000,000,000 | ---D | C] -- C:\Program Files\Safer Networking
[2010/09/01 23:53:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010/09/01 14:55:38 | 000,000,000 | -HSD | C] -- C:\FOUND.024
[2010/08/31 23:58:24 | 000,000,000 | -HSD | C] -- C:\FOUND.023
[2010/08/31 19:41:40 | 000,000,000 | -HSD | C] -- C:\FOUND.022
[2010/08/31 18:26:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\My eBooks
[2010/08/27 21:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.021
[2010/08/26 23:15:04 | 000,000,000 | -HSD | C] -- C:\FOUND.020
[2010/08/26 14:56:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Desktop\VPN
[2010/07/31 13:44:48 | 000,000,000 | -HSD | C] -- C:\FOUND.009
[2010/07/31 10:40:54 | 000,000,000 | -HSD | C] -- C:\FOUND.008
[2010/07/31 01:34:08 | 000,000,000 | -HSD | C] -- C:\FOUND.007
[2010/07/27 01:23:50 | 000,000,000 | -HSD | C] -- C:\FOUND.006
[2010/07/26 19:15:58 | 000,000,000 | -HSD | C] -- C:\FOUND.005
[2010/07/24 15:16:26 | 000,000,000 | -HSD | C] -- C:\FOUND.004
[2010/07/03 11:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2010/06/30 17:10:22 | 000,000,000 | ---D | C] -- C:\CyberFoot2007
[2010/06/30 16:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\SuperSoccerManager 2005
[2010/06/29 23:56:04 | 000,000,000 | -HSD | C] -- C:\FOUND.002
[2010/06/29 23:19:22 | 000,000,000 | -HSD | C] -- C:\FOUND.001
[2010/06/21 16:04:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western_Digital
[2010/06/21 16:01:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
[2010/06/21 16:01:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2010/06/21 16:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ServiceTest
[2010/06/21 16:01:31 | 000,011,520 | ---- | C] (Western Digital Technologies) -- C:\WINDOWS\System32\drivers\wdcsam.sys
[2010/06/21 16:01:13 | 000,000,000 | ---D | C] -- C:\Program Files\Western Digital
[2010/06/21 15:58:02 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2010/06/21 15:57:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2010/06/21 15:56:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western Digital
[2010/06/16 20:12:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\Downloads
[2010/06/16 20:03:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Temp
[2010/06/14 23:25:24 | 000,000,000 | -HSD | C] -- C:\FOUND.000
[2008/08/29 14:00:00 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2008/08/29 14:00:00 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsi.exe

========== Files - Modified Within 90 Days ==========

[2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
[2010/09/09 15:00:40 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/09/09 14:30:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/09 14:29:50 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
[2010/09/09 14:24:22 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
[2010/09/09 14:23:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/09 14:23:20 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
[2010/09/09 10:29:50 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2010/09/09 10:24:02 | 007,340,032 | -H-- | M] () -- C:\Documents and Settings\willmonotti\NTUSER.DAT
[2010/09/09 10:24:02 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\willmonotti\ntuser.ini
[2010/09/09 00:47:02 | 000,000,950 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
[2010/09/08 22:11:22 | 000,000,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/08 22:10:24 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
[2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
[2010/09/08 12:00:02 | 000,000,374 | ---- | M] () -- C:\WINDOWS\tasks\PerfectOptimizer_home.job
[2010/09/08 11:57:40 | 000,002,451 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\VPN Client.lnk
[2010/09/08 00:40:18 | 000,175,616 | ---- | M] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/05 12:25:04 | 000,000,675 | ---- | M] () -- C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/09/05 12:16:24 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
[2010/09/05 12:15:44 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
[2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2010/09/01 19:56:14 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/08/30 14:18:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/22 20:09:32 | 000,002,238 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
[2010/08/22 20:09:32 | 000,002,216 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/08/03 17:15:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/30 17:10:24 | 000,000,490 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
[2010/06/21 16:01:38 | 000,001,026 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
[2010/06/21 16:01:38 | 000,000,965 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
[2010/06/21 16:01:00 | 000,411,674 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/21 16:01:00 | 000,397,110 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/21 16:01:00 | 000,060,514 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/16 19:58:30 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk

========== Files Created - No Company Name ==========

[2010/09/09 14:29:48 | 003,840,723 | R--- | C] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
[2010/09/08 22:11:21 | 000,000,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/08 19:54:53 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/09/08 19:54:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/09/08 19:54:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/09/08 19:54:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/09/08 19:54:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/09/08 13:04:13 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
[2010/09/05 12:25:03 | 000,000,675 | ---- | C] () -- C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/09/05 12:15:46 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
[2010/09/05 00:42:46 | 000,000,950 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
[2010/06/30 17:10:22 | 000,000,490 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
[2010/06/21 16:01:37 | 000,001,026 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
[2010/06/21 16:01:37 | 000,000,965 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
[2010/06/16 20:04:19 | 000,002,238 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
[2010/06/16 20:04:19 | 000,002,216 | ---- | C] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2009/04/19 22:12:37 | 000,001,127 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009/04/03 13:26:13 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009/03/11 00:07:05 | 000,000,125 | ---- | C] () -- C:\WINDOWS\ds467.dll
[2009/02/14 22:30:45 | 000,175,616 | ---- | C] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/16 11:46:40 | 000,000,700 | ---- | C] () -- C:\Program Files\studentVPN.pcf
[2008/08/29 14:00:22 | 000,001,073 | ---- | C] () -- C:\Program Files\sig.dat
[2008/08/29 14:00:20 | 000,001,099 | ---- | C] () -- C:\Program Files\vpnclient_setup.ini
[2008/08/29 14:00:18 | 000,052,224 | ---- | C] () -- C:\Program Files\vpnclient_jp.mst
[2008/08/29 14:00:06 | 010,935,808 | ---- | C] () -- C:\Program Files\vpnclient_setup.msi
[2008/08/29 14:00:04 | 000,051,200 | ---- | C] () -- C:\Program Files\vpnclient_fc.mst
[2008/08/29 14:00:00 | 000,000,819 | ---- | C] () -- C:\Program Files\vpnclient_setup.sms
[2008/08/29 14:00:00 | 000,000,640 | ---- | C] () -- C:\Program Files\vpnclient_setup.pdf
[2008/08/29 13:59:58 | 000,056,832 | ---- | C] () -- C:\Program Files\vpnclient_setup.exe
[2008/08/29 13:58:26 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2008/08/29 13:58:16 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2008/08/29 13:58:04 | 000,221,315 | ---- | C] () -- C:\Program Files\installservice.exe
[2008/08/29 13:57:32 | 000,016,505 | ---- | C] () -- C:\Program Files\DelayInst.exe
[2005/05/26 09:49:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/05/26 09:35:20 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005/05/26 09:35:18 | 000,000,329 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005/05/26 09:31:07 | 000,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
[2005/05/24 15:16:04 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005/05/24 15:02:43 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2005/05/24 15:02:39 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2005/05/24 14:58:31 | 000,037,776 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/05/24 14:50:20 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/05/24 14:35:43 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2005/05/24 14:35:29 | 000,160,603 | RHS- | C] () -- C:\WINDOWS\System32\gnhnveo.dll
[2005/05/24 14:35:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004/12/17 17:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2001/12/26 16:12:30 | 000,065,536 | R--- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/09/03 23:46:38 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/07/30 16:33:56 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/23 22:04:36 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1980/01/01 00:00:00 | 000,000,085 | ---- | C] () -- C:\WINDOWS\ALAUNCH.INI

========== LOP Check ==========

[2009/02/12 21:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/02/14 21:58:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/07/01 00:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/12/07 21:45:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2010/03/30 01:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2010/06/21 16:01:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/02/14 22:08:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\USM2
[2009/02/18 22:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\uTorrent
[2009/07/02 23:01:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\gtk-2.0
[2009/10/19 19:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Audacity
[2009/11/22 17:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\foobar2000
[2009/12/07 21:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\acccore
[2010/03/07 01:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Windows Search
[2010/06/21 16:01:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
[2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/09/08 12:00:02 | 000,000,374 | ---- | M] () -- C:\WINDOWS\Tasks\PerfectOptimizer_home.job
[2010/03/25 00:07:32 | 000,000,516 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2005/05/26 11:33:48 | 000,000,076 | RHS- | M] () -- C:\PRELOAD.AAA
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2005/05/24 14:53:22 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2005/05/24 15:15:44 | 000,000,050 | ---- | M] () -- C:\AUTOEXEC.BAT
[2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2005/05/26 11:34:00 | 000,000,003 | ---- | M] () -- C:\PRELOAD.TAG
[2010/09/09 14:23:20 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/30 00:48:10 | 000,012,540 | ---- | M] () -- C:\aaw7boot.log
[2009/07/12 00:02:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/07/12 00:02:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/07/17 11:34:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/07/17 11:34:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/08/03 12:34:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/08/03 12:34:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/08/19 13:58:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/08/19 13:58:24 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/08/21 15:15:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/08/21 15:15:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/08/23 15:08:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/08/23 15:08:18 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/10/19 19:18:16 | 000,009,312 | ---- | M] () -- C:\Ask & Record Toolbar Setup Log.txt
[2009/12/07 21:45:34 | 000,000,397 | -H-- | M] () -- C:\IPH.PH
[2010/09/09 14:23:18 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/05/24 14:52:46 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2004/06/14 11:25:16 | 000,187,392 | ---- | M] () -- C:\WINDOWS\Acer.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/08/29 14:00:06 | 010,935,808 | ---- | M] () -- C:\Program Files\vpnclient_setup.msi
[2008/08/29 14:00:00 | 000,000,640 | ---- | M] () -- C:\Program Files\vpnclient_setup.pdf
[2008/08/29 14:00:00 | 000,000,819 | ---- | M] () -- C:\Program Files\vpnclient_setup.sms
[2008/08/29 13:57:32 | 000,016,505 | ---- | M] () -- C:\Program Files\DelayInst.exe
[2008/08/29 13:58:04 | 000,221,315 | ---- | M] () -- C:\Program Files\installservice.exe
[2008/08/29 14:00:00 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsi.exe
[2008/08/29 14:00:00 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2008/08/29 14:00:22 | 000,001,073 | ---- | M] () -- C:\Program Files\sig.dat
[2008/08/29 14:00:04 | 000,051,200 | ---- | M] () -- C:\Program Files\vpnclient_fc.mst
[2008/08/29 14:00:18 | 000,052,224 | ---- | M] () -- C:\Program Files\vpnclient_jp.mst
[2008/08/29 13:59:58 | 000,056,832 | ---- | M] () -- C:\Program Files\vpnclient_setup.exe
[2008/08/29 14:00:20 | 000,001,099 | ---- | M] () -- C:\Program Files\vpnclient_setup.ini
[2008/10/16 11:46:40 | 000,000,700 | ---- | M] () -- C:\Program Files\studentVPN.pcf

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/05/24 14:42:34 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
[2005/05/24 14:42:34 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005/05/24 14:42:34 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/05/24 14:53:24 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/08 06:41:04 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/05/24 14:59:42 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
[2010/09/05 12:16:24 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
[2010/09/09 14:29:50 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
[2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
[2010/09/08 22:10:24 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
[2010/03/07 01:12:46 | 005,520,400 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\WindowsSearch-KB940157-XP-x86-enu.exe
[1997/10/06 21:15:48 | 000,045,056 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Join32.exe
[2010/03/01 22:12:12 | 016,492,320 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\willmonotti\Desktop\jre-6u18-windows-i586-s.exe
[1997/10/06 21:22:28 | 000,033,024 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\JOIN16.EXE
[2009/11/30 01:25:04 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\willmonotti\Desktop\spybotsd162.exe
[2009/11/30 00:55:20 | 000,308,160 | ---- | M] (ALWIL Software) -- C:\Documents and Settings\willmonotti\Desktop\avast_home_setup.exe
[2009/04/04 18:03:12 | 526,428,264 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\X12-30307.exe
[2009/04/11 17:26:22 | 001,234,120 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\wrar380.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/02/08 06:41:04 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Favorites\Desktop.ini
[2009/03/11 00:06:58 | 000,000,579 | ---- | M] () -- C:\Documents and Settings\willmonotti\Favorites\First Principles of Business Law.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/09 15:00:42 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\willmonotti\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/04 05:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2004/08/04 01:06:34 | 001,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1998/12/25 08:15:38 | 000,345,983 | ---- | M] () -- C:\WINDOWS\system\RCDsetup.exe

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[2 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

alphabet_soup

2010-09-09, 08:46

"Extras":

OTL Extras logfile created on: 9/09/2010 3:40:18 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\willmonotti\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1,015.00 Mb Total Physical Memory | 470.00 Mb Available Physical Memory | 46.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.51 Gb Total Space | 4.24 Gb Free Space | 5.69% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WILL
Current User Name: willmonotti
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3453:TCP" = 3453:TCP:*:Enabled:huxutzgk
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\DC++\DCPlusPlus.exe" = C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++ -- ()
"C:\Documents and Settings\willmonotti\Desktop\utorrent.exe" = C:\Documents and Settings\willmonotti\Desktop\utorrent.exe:*:Enabled:µTorrent -- File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{232DB76D-4751-41A9-9EC2-CDC0DAC1FAB6}" = WD SmartWare
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{385979FE-DC4F-4140-8EAD-A59625000D72}" = NTI Backup NOW! 4
"{3C80C102-40C7-4119-B786-7765936F8472}" = First Principles of Business Law
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}" = Cisco Systems VPN Client 5.0.04.0300
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{8F432F86-A16B-42DA-B5F5-FE4CB7257814}" = Skills-Task 2 Feedback
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
"{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C5C649A8-1D21-4C83-9B08-7B3752E580F4}" = Safari
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{F1B8DB67-D30E-4FF9-A85F-3CEE51825AA2}" = SMSC IrCC V5.1.3600.5 SP2
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AIM Search" = AIM Search
"AIM_7" = AIM 7
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.9 (Unicode)
"CNXT_MODEM_PCI_VEN_8086&DEV_266D&SUBSYS_00811025" = SoftV90 Data Fax Modem with SmartCP
"DC++" = DC++ 0.7091
"Elantech" = KTP Ware PS/2-WDM 5.0.1.2
"ERUNT_is1" = ERUNT 1.1j
"foobar2000" = foobar2000 v0.9.6.9
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{385979FE-DC4F-4140-8EAD-A59625000D72}" = NTI Backup NOW! 4
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"LastFM_is1" = Last.fm 1.5.4.24567
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"OGG MP3 Converter" = OGG MP3 Converter 3.2 build 827
"Protected Music Converter_is1" = Protected Music Converter 1.0.0.21
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Totalcmd" = Total Commander (Remove or Repair)
"Trillian" = Trillian
"ULTIMATER" = Microsoft Office Ultimate 2007
"VLC media player" = VLC media player 0.9.8a
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"XiphQT" = Xiph QuickTime Components

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Universal Soccer Manager 2" = Universal Soccer Manager 2

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/09/2010 11:57:51 PM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 12:06:49 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 12:15:49 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 12:24:57 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 12:36:11 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 12:45:32 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 2:30:06 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
Description =

Error - 8/09/2010 3:04:21 AM | Computer Name = WILL | Source = Application Hang | ID = 1002
Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/09/2010 3:04:26 AM | Computer Name = WILL | Source = Application Hang | ID = 1001
Description = Fault bucket 1116954496.

Error - 8/09/2010 7:44:14 PM | Computer Name = WILL | Source = Google Update | ID = 20
Description =

[ OSession Events ]
Error - 30/06/2009 10:26:25 AM | Computer Name = WILL | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 216517
seconds with 240 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 8/09/2010 8:28:45 PM | Computer Name = WILL | Source = Service Control Manager | ID = 7000
Description = The Cisco Systems, Inc. Installer service service failed to start
due to the following error: %%2

Error - 8/09/2010 8:28:45 PM | Computer Name = WILL | Source = Service Control Manager | ID = 7023
Description = The System Monitor service terminated with the following error: %%1114

Error - 8/09/2010 8:28:45 PM | Computer Name = WILL | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
IntelIde Lbd

Error - 9/09/2010 12:24:16 AM | Computer Name = WILL | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service BITS with arguments
"" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7000
Description = The Ati HotKey Poller service failed to start due to the following
error: %%2

Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7000
Description = The Cisco Systems, Inc. Installer service service failed to start
due to the following error: %%2

Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the WD SmartWare Background
Service service to connect.

Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7023
Description = The System Monitor service terminated with the following error: %%1114

Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Lbd

Error - 9/09/2010 12:27:42 AM | Computer Name = WILL | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
KAT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-4150-B9.
The
master browser is stopping or an election is being forced.

< End of report >

jmw3

2010-09-09, 12:29

Hi

Warning: Please note that this fix is specific for this poster & should not be used by anyone else.

Backup Your Registry with ERUNT
Download ERUNT from here (http://www.aumha.org/downloads/erunt-setup.exe) & follow the installation prompts
Uncheck Create NTREGOPT desktop icon at the Additional Tasks screen. Click No when prompted to create an ERUNT entry in the startup folder.
Double click the Erunt icon on your desktop to open the program then click OK at the prompt
Use the default settings unless there is more than one user account. (If more the one user account tick Other open user registries in Backup Options)
Click OK
The following instruction should only be carried out if you need to restore the registry backup:
Navigate to the folder where the backup is saved
Double click on ERDNT.exe then OK
When the program opens click OK

Run Fix With OTL
Highlight the following in the code box and press Ctrl+C on the keyboard
Make sure you include the first colon (:)

:Commands
[CreateRestorePoint]
:Files
C:\WINDOWS\system32\gnhnveo.dll
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3453:TCP" =-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\willmonotti\Desktop\utorrent.exe" =-
:otl
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (CiscoVpnInstallService) -- C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE File not found
SRV - (Ati HotKey Poller) -- C:\WINDOWS\System32\Ati2evxx.exe File not found
DRV - (Lbd) -- C:\WINDOWS\System32\DRIVERS\Lbd.sys File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe File not found
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe File not found
O4 - HKLM..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe File not found
O4 - HKLM..\Run: [SoundMan] File not found
O4 - HKCU..\Run: [akvwx] C:\WINDOWS\System32\e1vbg3sn.exe File not found
O4 - HKCU..\Run: [cito0] C:\WINDOWS\System32\chxd60flvr.exe File not found
O4 - HKCU..\Run: [cydo8] C:\WINDOWS\System32\cttuzf81.exe File not found
O4 - HKCU..\Run: [dezpq] C:\WINDOWS\System32\w2xyt081alm.exe File not found
O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe File not found
O4 - HKCU..\Run: [dzuklg2] C:\WINDOWS\System32\rsnt66k8708.exe File not found
O4 - HKCU..\Run: [dzuva] C:\WINDOWS\System32\1epqlr8.exe File not found
O4 - HKCU..\Run: [ezqqlcc] C:\WINDOWS\System32\oojaavmmhy.exe File not found
O4 - HKCU..\Run: [faawmm] C:\WINDOWS\System32\3wwriid.exe File not found
O4 - HKCU..\Run: [falhcc] C:\WINDOWS\System32\1qmmhyy.exe File not found
O4 - HKCU..\Run: [hcyytkk] C:\WINDOWS\System32\qlccxoojaa.exe File not found
O4 - HKCU..\Run: [hxdtp] C:\WINDOWS\System32\hm2noj081q.exe File not found
O4 - HKCU..\Run: [lbhc6y] C:\WINDOWS\System32\lr2xd2jk.exe File not found
O4 - HKCU..\Run: [llmcdi] C:\WINDOWS\System32\bm5hdyuu.exe File not found
O4 - HKCU..\Run: [mcdi3e] C:\WINDOWS\System32\bm86y3pl.exe File not found
O4 - HKCU..\Run: [mmiyy6k] C:\WINDOWS\System32\fwwriiduupg.exe File not found
O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe File not found
O4 - HKCU..\Run: [nojpk0r] C:\WINDOWS\System32\0jff66w.exe File not found
O4 - HKCU..\Run: [pkkgww] C:\WINDOWS\System32\ni1eaavmmh.exe File not found
O4 - HKCU..\Run: [qhxiioj] C:\WINDOWS\System32\1cdi81u.exe File not found
O4 - HKCU..\Run: [rcc86] C:\WINDOWS\System32\q1gw1ni13p.exe File not found
O4 - HKCU..\Run: [snoejuf] C:\WINDOWS\System32\86y2ff6.exe File not found
O4 - HKCU..\Run: [teea6r] C:\WINDOWS\System32\w39ee5v1wb.exe File not found
O4 - HKCU..\Run: [tkkfww] C:\WINDOWS\System32\i1eaavmmhy.exe File not found
O4 - HKCU..\Run: C:\WINDOWS\System32\dzpplbbxnn.exe File not found
O4 - HKCU..\Run: [uplbbxc] C:\WINDOWS\System32\pff69m1i.exe File not found
O4 - HKCU..\Run: [vgr60] C:\WINDOWS\System32\6xc81oz.exe File not found
O4 - HKCU..\Run: [vqwxin] C:\WINDOWS\System32\60niy1p.exe File not found
O4 - HKCU..\Run: [wbxxoo3] C:\WINDOWS\System32\0xdyep0.exe File not found
O4 - HKCU..\Run: [wcxtoeu] C:\WINDOWS\System32\70i1zuv.exe File not found
O4 - HKCU..\Run: [wrmns] C:\WINDOWS\System32\60xs0zf.exe File not found
O4 - HKCU..\Run: [xdtyuua] C:\WINDOWS\System32\vlw2nyojzav.exe File not found
O4 - HKCU..\Run: [xsoo8] C:\WINDOWS\System32\sndu1klq.exe File not found
O4 - HKCU..\Run: [yuupgg] C:\WINDOWS\System32\ytkkfwwr.exe File not found
O4 - HKCU..\Run: [yzpf0w] C:\WINDOWS\System32\n20zvfbw.exe File not found
O4 - HKCU..\Run: [zaflw] C:\WINDOWS\System32\70bxny1.exe File not found
O4 - HKCU..\Run: [zuvqm] C:\WINDOWS\System32\kkfwwrii.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
O32 - AutoRun File - [2005/05/24 15:15:44 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell - "" = AutoRun
O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\setup.exe -- [2004/08/04 05:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun\command - "" = F:\WD SmartWare.exe -- File not found
O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell - "" = AutoRun
O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell - "" = AutoRun
O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: ywyyitdy - C:\WINDOWS\system32\gnhnveo.dll ()
[2010/09/09 15:36:36 | 000,000,000 | --SD | C] -- C:\commy
[2010/09/08 14:35:50 | 000,000,000 | -HSD | C] -- C:\FOUND.031
[2010/09/08 14:24:32 | 000,000,000 | -HSD | C] -- C:\FOUND.030
[2010/09/08 13:57:30 | 000,000,000 | -HSD | C] -- C:\FOUND.029
[2010/09/08 13:43:06 | 000,000,000 | -HSD | C] -- C:\FOUND.028
[2010/09/06 14:43:12 | 000,000,000 | -HSD | C] -- C:\FOUND.027
[2010/09/03 23:25:36 | 000,000,000 | -HSD | C] -- C:\FOUND.026
[2010/09/02 22:08:00 | 000,000,000 | -HSD | C] -- C:\FOUND.025
[2010/09/01 14:55:38 | 000,000,000 | -HSD | C] -- C:\FOUND.024
[2010/08/31 23:58:24 | 000,000,000 | -HSD | C] -- C:\FOUND.023
[2010/08/31 19:41:40 | 000,000,000 | -HSD | C] -- C:\FOUND.022
[2010/08/27 21:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.021
[2010/08/26 23:15:04 | 000,000,000 | -HSD | C] -- C:\FOUND.020
[2010/07/31 13:44:48 | 000,000,000 | -HSD | C] -- C:\FOUND.009
[2010/07/31 10:40:54 | 000,000,000 | -HSD | C] -- C:\FOUND.008
[2010/07/31 01:34:08 | 000,000,000 | -HSD | C] -- C:\FOUND.007
[2010/07/27 01:23:50 | 000,000,000 | -HSD | C] -- C:\FOUND.006
[2010/07/26 19:15:58 | 000,000,000 | -HSD | C] -- C:\FOUND.005
[2010/07/24 15:16:26 | 000,000,000 | -HSD | C] -- C:\FOUND.004
[2010/07/03 11:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.003
[2010/06/29 23:56:04 | 000,000,000 | -HSD | C] -- C:\FOUND.002
[2010/06/29 23:19:22 | 000,000,000 | -HSD | C] -- C:\FOUND.001
[2010/06/14 23:25:24 | 000,000,000 | -HSD | C] -- C:\FOUND.000
[2010/09/08 12:00:02 | 000,000,374 | ---- | M] () -- C:\WINDOWS\tasks\PerfectOptimizer_home.job
[2009/03/11 00:07:05 | 000,000,125 | ---- | C] () -- C:\WINDOWS\ds467.dll
[2009/02/18 22:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\uTorrent
[2009/10/19 19:18:16 | 000,009,312 | ---- | M] () -- C:\Ask & Record Toolbar Setup Log.txt
[2010/09/05 12:16:24 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
[2010/09/09 14:29:50 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
[2010/09/08 22:10:24 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
[2010/03/07 01:12:46 | 005,520,400 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\WindowsSearch-KB940157-XP-x86-enu.exe
[2010/03/01 22:12:12 | 016,492,320 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\willmonotti\Desktop\jre-6u18-windows-i586-s.exe
[2009/11/30 01:25:04 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\willmonotti\Desktop\spybotsd162.exe
[2009/11/30 00:55:20 | 000,308,160 | ---- | M] (ALWIL Software) -- C:\Documents and Settings\willmonotti\Desktop\avast_home_setup.exe
:Commands
[Purity]
[EmptyTemp]
[Reboot]

Double-click on the OTL.exe file to start OTL. OK any warning about running OTL.
Click in the Custom Scans/Fixes box at the bottom of the OTL window
Press Ctrl+V to paste the above code in the box (check that the code appears)
Click the Run Fix button
Post the resulting log in your next reply.

Re-scan With OTL
Then run another scan with OTL using the direction previously posted [U]Here (http://forums.spybot.info/showpost.php?p=382974&postcount=18)

alphabet_soup

2010-09-09, 16:29

Hi there.

I ran the OTL fix, my computer shut down, rebooted, the log posted below came up. There were a few other things that happened though:

1) First thing I noticed was the appearance - everything had gone back to "Windows Classic" style. I tried to change it but it seems the other options don't exist anymore.

2) All my network connections had been wiped, and I couldn't set up a new connection (not sure why). Tried to open the Help & Support Centre, but that wouldn't work (said it needed missing programs to run or something). So currently posting this from another comp.

3) I tried opening iTunes and it told me there were problems with playing audio and video. All my files are there, but nothing plays.

Anyway, so here's the log, I'll go back and run OTL again, but for now here's what came up after re-boot:

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point (0)
========== FILES ==========
File move failed. C:\WINDOWS\system32\gnhnveo.dll scheduled to be moved on reboot.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\3453:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\willmonotti\Desktop\utorrent.exe deleted successfully.
========== OTL ==========
Service HidServ stopped successfully!
Service HidServ deleted successfully!
File C:\WINDOWS\System32\hidserv.dll File not found not found.
Service CiscoVpnInstallService stopped successfully!
Service CiscoVpnInstallService deleted successfully!
File C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE File not found not found.
Service Ati HotKey Poller stopped successfully!
Service Ati HotKey Poller deleted successfully!
File C:\WINDOWS\System32\Ati2evxx.exe File not found not found.
Service Lbd stopped successfully!
Service Lbd deleted successfully!
File C:\WINDOWS\System32\DRIVERS\Lbd.sys File not found not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b0cda128-b425-4eef-a174-61a11ac5dbf8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0cda128-b425-4eef-a174-61a11ac5dbf8}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HotKeysCmds deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IgfxTray deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KTPWare deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SoundMan deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\akvwx deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cito0 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cydo8 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\dezpq deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\DW6 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\dzuklg2 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\dzuva deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ezqqlcc deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\faawmm deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\falhcc deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\hcyytkk deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\hxdtp deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\lbhc6y deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\llmcdi deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mcdi3e deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mmiyy6k deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MsnMsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\nojpk0r deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\pkkgww deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\qhxiioj deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\rcc86 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\snoejuf deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\teea6r deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\tkkfww deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\upggbs deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\uplbbxc deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vgr60 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vqwxin deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wbxxoo3 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wcxtoeu deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wrmns deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\xdtyuua deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\xsoo8 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\yuupgg deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\yzpf0w deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\zaflw deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\zuvqm deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\wvc1dmo.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31435657-9980-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0198223c-57e9-11de-a977-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0198223c-57e9-11de-a977-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{095707e1-8304-11de-a97c-b956f7f66bd7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{095707e1-8304-11de-a97c-b956f7f66bd7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\ not found.
C:\WINDOWS\system32\setup.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
File F:\WD SmartWare.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e03ecff4-2297-11de-a963-00059a3c7800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e03ecff4-2297-11de-a963-00059a3c7800}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
6to4 removed from NetSvcs value successfully!
HidServ removed from NetSvcs value successfully!
Ias removed from NetSvcs value successfully!
Iprip removed from NetSvcs value successfully!
NWCWorkstation removed from NetSvcs value successfully!
Nwsapagent removed from NetSvcs value successfully!
WmdmPmSp removed from NetSvcs value successfully!
ywyyitdy removed from NetSvcs value successfully!
Service ywyyitdy stopped successfully!
Service ywyyitdy deleted successfully!
File move failed. C:\WINDOWS\system32\gnhnveo.dll scheduled to be moved on reboot.
C:\commy folder moved successfully.
C:\FOUND.031 folder moved successfully.
C:\FOUND.030 folder moved successfully.
C:\FOUND.029 folder moved successfully.
C:\FOUND.028 folder moved successfully.
C:\FOUND.027 folder moved successfully.
C:\FOUND.026 folder moved successfully.
C:\FOUND.025 folder moved successfully.
C:\FOUND.024 folder moved successfully.
C:\FOUND.023 folder moved successfully.
C:\FOUND.022 folder moved successfully.
C:\FOUND.021 folder moved successfully.
C:\FOUND.020 folder moved successfully.
C:\FOUND.009 folder moved successfully.
C:\FOUND.008 folder moved successfully.
C:\FOUND.007 folder moved successfully.
C:\FOUND.006 folder moved successfully.
C:\FOUND.005 folder moved successfully.
C:\FOUND.004 folder moved successfully.
C:\FOUND.003 folder moved successfully.
C:\FOUND.002 folder moved successfully.
C:\FOUND.001 folder moved successfully.
C:\FOUND.000 folder moved successfully.
C:\WINDOWS\tasks\PerfectOptimizer_home.job moved successfully.
C:\WINDOWS\ds467.dll moved successfully.
C:\Documents and Settings\willmonotti\Application Data\uTorrent folder moved successfully.
C:\Ask & Record Toolbar Setup Log.txt moved successfully.
C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe moved successfully.
C:\Documents and Settings\willmonotti\Desktop\commy.exe moved successfully.
C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe moved successfully.
C:\Documents and Settings\willmonotti\Desktop\WindowsSearch-KB940157-XP-x86-enu.exe moved successfully.
C:\Documents and Settings\willmonotti\Desktop\jre-6u18-windows-i586-s.exe moved successfully.
C:\Documents and Settings\willmonotti\Desktop\spybotsd162.exe moved successfully.
C:\Documents and Settings\willmonotti\Desktop\avast_home_setup.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 38286 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 34449 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: willmonotti
->Temp folder emptied: 175788 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3772584 bytes
->Google Chrome cache emptied: 215038035 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 9580 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 209.00 mb

OTL by OldTimer - Version 3.2.11.0 log created on 09092010_231100

Files\Folders moved on Reboot...
C:\WINDOWS\system32\gnhnveo.dll moved successfully.

Registry entries deleted on Reboot...

alphabet_soup

2010-09-09, 16:37

OK, here's the log of the OTL Quick Scan:

OTL logfile created on: 9/09/2010 11:31:51 PM - Run 2
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\willmonotti\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1,015.00 Mb Total Physical Memory | 461.00 Mb Available Physical Memory | 45.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.51 Gb Total Space | 4.31 Gb Free Space | 5.79% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WILL
Current User Name: willmonotti
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
PRC - C:\Program Files\Last.fm\LastFM.exe (Last.fm)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
SRV - (WDSmartWareBackgroundService) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ESDCR) -- C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ESMCR) -- C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (Ktp) -- C:\WINDOWS\system32\drivers\Ktp.sys (ELANTECH Devices Corp.)
DRV - (b57w2k) Broadcom NetLink (TM) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (EMSCR) -- C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://trinity.unimelb.edu.au/portal
IE - HKCU\..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = wwwproxy.student.unimelb.edu.au:8000

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us"
FF - prefs.js..browser.startup.homepage: "https://www.trinitycollege.vic.edu.au/portal/today/today.php"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.53
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query="
FF - prefs.js..network.proxy.backup.ftp: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.ftp_port: 8000
FF - prefs.js..network.proxy.backup.gopher: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.gopher_port: 8000
FF - prefs.js..network.proxy.backup.socks: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.socks_port: 8000
FF - prefs.js..network.proxy.backup.ssl: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.backup.ssl_port: 8000
FF - prefs.js..network.proxy.ftp: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.ftp_port: 8000
FF - prefs.js..network.proxy.gopher: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.gopher_port: 8000
FF - prefs.js..network.proxy.http: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.http_port: 8000
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.socks_port: 8000
FF - prefs.js..network.proxy.ssl: "wwwproxy.unimelb.edu.au"
FF - prefs.js..network.proxy.ssl_port: 8000
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/02/09 18:52:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/02/09 18:52:32 | 000,000,000 | ---D | M]

[2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Extensions
[2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions
[2009/06/03 19:00:26 | 000,000,000 | ---D | M] (MediaWrap) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{dd68c513-9296-4b63-8d8b-8f1c991c8a48}
[2009/12/12 17:56:04 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/03/25 20:14:48 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\mozilla-add-ons.xml
[2009/05/22 01:42:46 | 000,004,140 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\youtube.xml
[2009/02/09 18:52:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/23 23:02:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/23 23:01:54 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/12 18:57:14 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/12 18:57:14 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/12 18:57:14 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/12 18:57:14 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/11/20 21:35:48 | 000,000,732 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 203.28.240.18 203.28.240.20
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\WD SmartWare.exe -- File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Unable to start service SrService!

========== Files/Folders - Created Within 90 Days ==========

[2010/09/09 23:11:00 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/09/09 23:09:40 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/09/09 15:37:43 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
[2010/09/08 22:11:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Malwarebytes
[2010/09/08 22:11:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/08 22:11:17 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/08 19:57:45 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010/09/08 19:54:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/09/08 19:54:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/09/08 19:54:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/09/08 19:54:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/05 12:25:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/09/01 23:56:04 | 000,000,000 | ---D | C] -- C:\Program Files\Safer Networking
[2010/09/01 23:53:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010/08/31 18:26:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\My eBooks
[2010/08/26 14:56:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Desktop\VPN
[2010/06/30 17:10:22 | 000,000,000 | ---D | C] -- C:\CyberFoot2007
[2010/06/30 16:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\SuperSoccerManager 2005
[2010/06/21 16:04:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western_Digital
[2010/06/21 16:01:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
[2010/06/21 16:01:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2010/06/21 16:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ServiceTest
[2010/06/21 16:01:31 | 000,011,520 | ---- | C] (Western Digital Technologies) -- C:\WINDOWS\System32\drivers\wdcsam.sys
[2010/06/21 16:01:13 | 000,000,000 | ---D | C] -- C:\Program Files\Western Digital
[2010/06/21 15:58:02 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2010/06/21 15:57:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2010/06/21 15:56:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western Digital
[2010/06/16 20:12:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\Downloads
[2010/06/16 20:03:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Temp
[2008/08/29 14:00:00 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2008/08/29 14:00:00 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsi.exe

========== Files - Modified Within 90 Days ==========

[2010/09/09 23:32:36 | 007,602,176 | -H-- | M] () -- C:\Documents and Settings\willmonotti\NTUSER.DAT
[2010/09/09 23:17:44 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/09/09 23:13:00 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
[2010/09/09 23:12:36 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
[2010/09/09 23:12:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/09 23:11:42 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2010/09/09 23:11:40 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\willmonotti\ntuser.ini
[2010/09/09 23:09:42 | 000,000,519 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\NTREGOPT.lnk
[2010/09/09 23:09:42 | 000,000,500 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\ERUNT.lnk
[2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
[2010/09/09 14:30:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/09 00:47:02 | 000,000,950 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
[2010/09/08 22:11:22 | 000,000,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
[2010/09/08 11:57:40 | 000,002,451 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\VPN Client.lnk
[2010/09/08 00:40:18 | 000,175,616 | ---- | M] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/05 12:15:44 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
[2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2010/09/01 19:56:14 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/08/30 14:18:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/22 20:09:32 | 000,002,238 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
[2010/08/22 20:09:32 | 000,002,216 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/08/03 17:15:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/30 17:10:24 | 000,000,490 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
[2010/06/21 16:01:38 | 000,001,026 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
[2010/06/21 16:01:38 | 000,000,965 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
[2010/06/21 16:01:00 | 000,411,674 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/21 16:01:00 | 000,397,110 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/21 16:01:00 | 000,060,514 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/16 19:58:30 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk

========== Files Created - No Company Name ==========

[2010/09/09 23:08:36 | 000,000,519 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\NTREGOPT.lnk
[2010/09/09 23:08:36 | 000,000,500 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\ERUNT.lnk
[2010/09/08 22:11:21 | 000,000,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/08 19:54:53 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/09/08 19:54:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/09/08 19:54:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/09/08 19:54:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/09/08 19:54:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/09/08 13:04:13 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
[2010/09/05 12:15:46 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
[2010/09/05 00:42:46 | 000,000,950 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
[2010/06/30 17:10:22 | 000,000,490 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
[2010/06/21 16:01:37 | 000,001,026 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
[2010/06/21 16:01:37 | 000,000,965 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
[2010/06/16 20:04:19 | 000,002,238 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
[2010/06/16 20:04:19 | 000,002,216 | ---- | C] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2009/04/19 22:12:37 | 000,001,127 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009/04/03 13:26:13 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009/02/14 22:30:45 | 000,175,616 | ---- | C] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/16 11:46:40 | 000,000,700 | ---- | C] () -- C:\Program Files\studentVPN.pcf
[2008/08/29 14:00:22 | 000,001,073 | ---- | C] () -- C:\Program Files\sig.dat
[2008/08/29 14:00:20 | 000,001,099 | ---- | C] () -- C:\Program Files\vpnclient_setup.ini
[2008/08/29 14:00:18 | 000,052,224 | ---- | C] () -- C:\Program Files\vpnclient_jp.mst
[2008/08/29 14:00:06 | 010,935,808 | ---- | C] () -- C:\Program Files\vpnclient_setup.msi
[2008/08/29 14:00:04 | 000,051,200 | ---- | C] () -- C:\Program Files\vpnclient_fc.mst
[2008/08/29 14:00:00 | 000,000,819 | ---- | C] () -- C:\Program Files\vpnclient_setup.sms
[2008/08/29 14:00:00 | 000,000,640 | ---- | C] () -- C:\Program Files\vpnclient_setup.pdf
[2008/08/29 13:59:58 | 000,056,832 | ---- | C] () -- C:\Program Files\vpnclient_setup.exe
[2008/08/29 13:58:26 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2008/08/29 13:58:16 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2008/08/29 13:58:04 | 000,221,315 | ---- | C] () -- C:\Program Files\installservice.exe
[2008/08/29 13:57:32 | 000,016,505 | ---- | C] () -- C:\Program Files\DelayInst.exe
[2005/05/26 09:49:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/05/26 09:35:20 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005/05/26 09:35:18 | 000,000,329 | ---- | C] () -- C:\WINDOWS\uninstall.ini
[2005/05/26 09:31:07 | 000,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
[2005/05/24 15:16:04 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2005/05/24 15:02:43 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2005/05/24 15:02:39 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2005/05/24 14:58:31 | 000,037,776 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/05/24 14:50:20 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/05/24 14:35:43 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2005/05/24 14:35:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004/12/17 17:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2001/12/26 16:12:30 | 000,065,536 | R--- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/09/03 23:46:38 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/07/30 16:33:56 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/23 22:04:36 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1980/01/01 00:00:00 | 000,000,085 | ---- | C] () -- C:\WINDOWS\ALAUNCH.INI

========== LOP Check ==========

[2009/02/12 21:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/02/14 21:58:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/07/01 00:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/12/07 21:45:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2010/03/30 01:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2010/06/21 16:01:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/02/14 22:08:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\USM2
[2009/07/02 23:01:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\gtk-2.0
[2009/10/19 19:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Audacity
[2009/11/22 17:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\foobar2000
[2009/12/07 21:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\acccore
[2010/03/07 01:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Windows Search
[2010/06/21 16:01:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
[2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/03/25 00:07:32 | 000,000,516 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2005/05/26 11:33:48 | 000,000,076 | RHS- | M] () -- C:\PRELOAD.AAA
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2005/05/24 14:53:22 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2005/05/26 11:34:00 | 000,000,003 | ---- | M] () -- C:\PRELOAD.TAG
[2010/09/09 23:12:36 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/30 00:48:10 | 000,012,540 | ---- | M] () -- C:\aaw7boot.log
[2009/07/12 00:02:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/07/12 00:02:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/07/17 11:34:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/07/17 11:34:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/08/03 12:34:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/08/03 12:34:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/08/19 13:58:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/08/19 13:58:24 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/08/21 15:15:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/08/21 15:15:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/08/23 15:08:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/08/23 15:08:18 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/12/07 21:45:34 | 000,000,397 | -H-- | M] () -- C:\IPH.PH
[2010/09/09 23:12:34 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/05/24 14:52:46 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2004/06/14 11:25:16 | 000,187,392 | ---- | M] () -- C:\WINDOWS\Acer.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/08/29 14:00:06 | 010,935,808 | ---- | M] () -- C:\Program Files\vpnclient_setup.msi
[2008/08/29 14:00:00 | 000,000,640 | ---- | M] () -- C:\Program Files\vpnclient_setup.pdf
[2008/08/29 14:00:00 | 000,000,819 | ---- | M] () -- C:\Program Files\vpnclient_setup.sms
[2008/08/29 13:57:32 | 000,016,505 | ---- | M] () -- C:\Program Files\DelayInst.exe
[2008/08/29 13:58:04 | 000,221,315 | ---- | M] () -- C:\Program Files\installservice.exe
[2008/08/29 14:00:00 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsi.exe
[2008/08/29 14:00:00 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2008/08/29 14:00:22 | 000,001,073 | ---- | M] () -- C:\Program Files\sig.dat
[2008/08/29 14:00:04 | 000,051,200 | ---- | M] () -- C:\Program Files\vpnclient_fc.mst
[2008/08/29 14:00:18 | 000,052,224 | ---- | M] () -- C:\Program Files\vpnclient_jp.mst
[2008/08/29 13:59:58 | 000,056,832 | ---- | M] () -- C:\Program Files\vpnclient_setup.exe
[2008/08/29 14:00:20 | 000,001,099 | ---- | M] () -- C:\Program Files\vpnclient_setup.ini
[2008/10/16 11:46:40 | 000,000,700 | ---- | M] () -- C:\Program Files\studentVPN.pcf

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/05/24 14:42:34 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
[2005/05/24 14:42:34 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005/05/24 14:42:34 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/05/24 14:53:24 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/02/08 06:41:04 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/05/24 14:59:42 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
[2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
[1997/10/06 21:15:48 | 000,045,056 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Join32.exe
[1997/10/06 21:22:28 | 000,033,024 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\JOIN16.EXE
[2009/04/04 18:03:12 | 526,428,264 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\X12-30307.exe
[2009/04/11 17:26:22 | 001,234,120 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\wrar380.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/02/08 06:41:04 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Favorites\Desktop.ini
[2009/03/11 00:06:58 | 000,000,579 | ---- | M] () -- C:\Documents and Settings\willmonotti\Favorites\First Principles of Business Law.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/09 23:17:46 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\willmonotti\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/08/04 05:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2004/08/04 01:06:34 | 001,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1998/12/25 08:15:38 | 000,345,983 | ---- | M] () -- C:\WINDOWS\system\RCDsetup.exe

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[2 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

jmw3

2010-09-09, 17:26

Click Start >> All Programs >> Accessories >> System Tools then click System Restore
On the Welcome to System Restore page, click Restore my computer to an earlier time (if it is not already selected) then click Next
On the Select a Restore Point page, click the OTL Restore Point then click Next
On the Confirm Restore Point Selection page, click Next
System Restore should restore the previous Windows XP configuration & restart the computerLet me know what happens.

alphabet_soup

2010-09-10, 11:21

:( :(

System Restore wouldn't open! I tried clicking on it...got a pop which said:

"System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again".

I restarted as instructed, but just got the same message.

Any ideas? Still not able to create any kind of internet connection on the machine...this is most important! Please help!

jmw3

2010-09-10, 11:41

Hi

Did you back up the registry as advised with Erunt? If so do this:
Navigate to the folder where the backup is saved
Double click on ERDNT.exe then OK
When the program opens click OK

Le me know what happens.

Do you have an XP Installation disc?

alphabet_soup

2010-09-10, 17:23

OK, so managed to restore Internet connections etc through ERUNT.

Any advice as to how to proceed from here?

jmw3

2010-09-10, 17:51

We'll try ComboFix again... a little differently.

Delete the copy of ComboFix you have & download it again:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Don't run it just yet. Go to Microsoft's website => http://support.microsoft.com/kb/310994
Scroll down to Step 1 (where it says: Step 1: Download the Setup disk program) & select the download that's appropriate for your Operating System (Windows XP Service Pack 2 (SP2). Download the file & save it as it's originally named.
Note: If you have SP3, use the SP2 package.
Save the file to the desktop of your computer
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
http://img.photobucket.com/albums/v666/sUBs/RC1-4.gif
Drag the setup package onto ComboFix.exe and drop it
Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console
http://img.photobucket.com/albums/v706/ried7/whatnext.png
At the next prompt, click No to exit
At the next prompt, click 'Yes' to run the full ComboFix scan.
When finished, it will produce a report for youPost the C:\ComboFix.txt in your next reply.

alphabet_soup

2010-09-11, 16:41

Aha! Finally...Combo fix worked!

Here's the log:

ComboFix 10-09-09.04 - willmonotti 11/09/2010 23:31:51.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.550 [GMT 10:00]
Running from: c:\documents and settings\willmonotti\Desktop\commy.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Uninstall.ini

.
((((((((((((((((((((((((( Files Created from 2010-08-11 to 2010-09-11 )))))))))))))))))))))))))))))))
.

2010-09-09 13:11 . 2010-09-09 13:11 -------- d-----w- C:\_OTL
2010-09-09 13:09 . 2010-09-09 13:09 -------- d-----w- c:\program files\ERUNT
2010-09-08 12:11 . 2010-09-08 12:11 -------- d-----w- c:\documents and settings\willmonotti\Application Data\Malwarebytes
2010-09-08 12:11 . 2010-04-29 05:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-08 12:11 . 2010-09-08 12:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-08 12:11 . 2010-09-08 12:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-08 12:11 . 2010-04-29 05:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-08 09:57 . 2010-09-08 09:57 -------- d-----w- C:\ComboFix
2010-09-01 13:56 . 2010-09-01 13:56 -------- d-----w- c:\program files\Safer Networking
2010-08-15 10:24 . 2010-08-15 10:24 503808 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4d9ba47b-n\msvcp71.dll
2010-08-15 10:24 . 2010-08-15 10:24 499712 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4d9ba47b-n\jmc.dll
2010-08-15 10:24 . 2010-08-15 10:24 61440 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-40226f48-n\decora-sse.dll
2010-08-15 10:24 . 2010-08-15 10:24 348160 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4d9ba47b-n\msvcr71.dll
2010-08-15 10:24 . 2010-08-15 10:24 12800 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-40226f48-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-11 12:32 . 2005-05-24 05:18 12 ----a-w- c:\windows\bthservsdp.dat
2010-08-03 07:15 . 2009-05-23 10:52 664 ----a-w- c:\windows\system32\d3d9caps.dat
2008-10-16 01:46 . 2008-10-16 01:46 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00 . 2008-08-29 04:00 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00 . 2008-08-29 04:00 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00 . 2008-08-29 04:00 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00 . 2008-08-29 04:00 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00 . 2008-08-29 04:00 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00 . 2008-08-29 04:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00 . 2008-08-29 04:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00 . 2008-08-29 04:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00 . 2008-08-29 04:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59 . 2008-08-29 03:59 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58 . 2008-08-29 03:58 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57 . 2008-08-29 03:57 16505 ----a-w- c:\program files\DelayInst.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Google Update"="c:\documents and settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-06-16 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\DC++\\DCPlusPlus.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3453:TCP"= 3453:TCP:huxutzgk
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [13/11/2009 11:28 AM 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16/06/2009 8:58 AM 20480]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 ywyyitdy;System Monitor;c:\windows\system32\svchost.exe -k netsvcs [24/05/2005 2:35 PM 14336]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [21/06/2010 4:01 PM 11520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ywyyitdy
.
Contents of the 'Scheduled Tasks' folder

2010-08-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]

2010-03-24 c:\windows\Tasks\Install_NSS.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2010-03-15 13:58]

2010-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
- c:\documents and settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-06-16 10:03]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://trinity.unimelb.edu.au/portal
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKCU-Run-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
HKCU-Run-vgr60 - c:\windows\system32\6xc81oz.exe
HKCU-Run-lbhc6y - c:\windows\system32\lr2xd2jk.exe
HKCU-Run-llmcdi - c:\windows\system32\bm5hdyuu.exe
HKCU-Run-rcc86 - c:\windows\system32\q1gw1ni13p.exe
HKCU-Run-mcdi3e - c:\windows\system32\bm86y3pl.exe
HKCU-Run-yuupgg - c:\windows\system32\ytkkfwwr.exe
HKCU-Run-zuvqm - c:\windows\system32\kkfwwrii.exe
HKCU-Run-upggbs - c:\windows\system32\dzpplbbxnn.exe
HKCU-Run-wbxxoo3 - c:\windows\system32\0xdyep0.exe
HKCU-Run-teea6r - c:\windows\system32\w39ee5v1wb.exe
HKCU-Run-tkkfww - c:\windows\system32\i1eaavmmhy.exe
HKCU-Run-pkkgww - c:\windows\system32\ni1eaavmmh.exe
HKCU-Run-ezqqlcc - c:\windows\system32\oojaavmmhy.exe
HKCU-Run-snoejuf - c:\windows\system32\86y2ff6.exe
HKCU-Run-yzpf0w - c:\windows\system32\n20zvfbw.exe
HKCU-Run-nojpk0r - c:\windows\system32\0jff66w.exe
HKCU-Run-falhcc - c:\windows\system32\1qmmhyy.exe
HKCU-Run-xdtyuua - c:\windows\system32\vlw2nyojzav.exe
HKCU-Run-dzuklg2 - c:\windows\system32\rsnt66k8708.exe
HKCU-Run-uplbbxc - c:\windows\system32\pff69m1i.exe
HKCU-Run-faawmm - c:\windows\system32\3wwriid.exe
HKCU-Run-mmiyy6k - c:\windows\system32\fwwriiduupg.exe
HKCU-Run-hcyytkk - c:\windows\system32\qlccxoojaa.exe
HKCU-Run-zaflw - c:\windows\system32\70bxny1.exe
HKCU-Run-cydo8 - c:\windows\system32\cttuzf81.exe
HKCU-Run-wcxtoeu - c:\windows\system32\70i1zuv.exe
HKCU-Run-akvwx - c:\windows\system32\e1vbg3sn.exe
HKCU-Run-vqwxin - c:\windows\system32\60niy1p.exe
HKCU-Run-qhxiioj - c:\windows\system32\1cdi81u.exe
HKCU-Run-hxdtp - c:\windows\system32\hm2noj081q.exe
HKCU-Run-xsoo8 - c:\windows\system32\sndu1klq.exe
HKCU-Run-wrmns - c:\windows\system32\60xs0zf.exe
HKCU-Run-cito0 - c:\windows\system32\chxd60flvr.exe
HKCU-Run-dezpq - c:\windows\system32\w2xyt081alm.exe
HKCU-Run-dzuva - c:\windows\system32\1epqlr8.exe
HKLM-Run-IgfxTray - c:\windows\system32\igfxtray.exe
HKLM-Run-HotKeysCmds - c:\windows\system32\hkcmd.exe
HKLM-Run-SoundMan - SOUNDMAN.EXE
HKLM-Run-KTPWare - c:\program files\Elantech\ktp.exe
AddRemove-Trillian - c:\program files\Trillian\trillian.exe
AddRemove-Universal Soccer Manager 2 - c:\program files\Universal Soccer Manager 2\Uninstal.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-11 23:37
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(840)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
.
Completion time: 2010-09-11 23:40:07
ComboFix-quarantined-files.txt 2010-09-11 13:40

Pre-Run: 4,167,008,256 bytes free
Post-Run: 4,139,712,512 bytes free

- - End Of File - - C6D230758D0672820BBC94C84E897482

jmw3

2010-09-12, 00:15

Hi

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3453:TCP"=-
Driver::
ywyyitdy
Netsvc::
ywyyitdy
Save this as CFScript.txt, in the same location as ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Referring to the picture above, drag CFScript into ComboFix.exe
If prompted by ComboFix to update, please do so
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 21.
Download the latest version of Java Runtime Environment (JRE) 6 Here (http://java.sun.com/javase/downloads/index.jsp)
Scroll down to where it says "JDK 6 Update 21 (JDK or JRE)"
Click the orange Download JRE button to the right
Select the Windows platform from the dropdown menu
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
Click on the link to download Windows Offline Installation & save the file to your desktop
Close any programs you may have running - especially your web browser
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions
Reboot your computer once all Java components are removed
Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
Trace and Log Files Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control PanelKaspersky Online Scan
Do an online scan with >Kaspersky Online Scanner< (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html)
Read through the requirements and privacy statement and click on Accept button
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run
When the downloads have finished, click on Settings
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases Click on My Computer under Scan
Once the scan is complete, it will display the results. Click on View Scan Report
You will see a list of infected items there. Click on Save Report As...
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button
Please post this log in your next replyPictured tutorial if required (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif).
This scan will take quite some time to update & scan, so be patient with it.

To post in next reply:
ComboFix log
Kaspersky Online Scan log
Update on how the computer is running

alphabet_soup

2010-09-12, 05:08

Hi there, thanks for your help again.

Kaspersky is not running. It's telling me I don't fulfill the system requirements to let it run, though I installed Java exactly as you stipulated. These are the requirements according to the "Help" centre of Kaspersky: is there anything in here that you think I'd be missing??

Hardware and software requirements

For successful startup and operation of Kaspersky Online Scanner 7.0 the hardware and software of your computer must meet the following minimum requirements:
50 MB of available disk space;
Microsoft Windows 2000 Professional SP4, 32-bit / 64-bit Microsoft Windows XP SP2 or 32-bit / 64-bit Microsoft Windows Vista: Microsoft Internet Explorer 6 or 7, Opera 9 or Firefox 2;
Ubuntu 7.10: Firefox 2;
Sun Java SE Runtime Environment (JRE): for Microsoft Windows Vista version 1.6.0 or higher; for other operating systems version 1.5.0 or higher;
Java and JavaScript support for internet applications must be enabled in the browser.
Note.
Successful launch of Kaspersky Online Scanner 7.0 on a computer running Microsoft Windows Vista requires starting the browser with the administrator credentials (Run as Administrator).

Anyway I ran Combofix before all that, here's the log while I'm at it:

ComboFix 10-09-09.04 - willmonotti 12/09/2010 11:35:39.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.555 [GMT 10:00]
Running from: c:\documents and settings\willmonotti\Desktop\commy.exe
Command switches used :: c:\documents and settings\willmonotti\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_YWYYITDY
-------\Service_ywyyitdy

((((((((((((((((((((((((( Files Created from 2010-08-12 to 2010-09-12 )))))))))))))))))))))))))))))))
.

2010-09-09 13:11 . 2010-09-09 13:11 -------- d-----w- C:\_OTL
2010-09-09 13:09 . 2010-09-09 13:09 -------- d-----w- c:\program files\ERUNT
2010-09-08 12:11 . 2010-09-08 12:11 -------- d-----w- c:\documents and settings\willmonotti\Application Data\Malwarebytes
2010-09-08 12:11 . 2010-04-29 05:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-08 12:11 . 2010-09-08 12:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-08 12:11 . 2010-09-08 12:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-08 12:11 . 2010-04-29 05:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-08 09:57 . 2010-09-08 09:57 -------- d-----w- C:\ComboFix
2010-09-01 13:56 . 2010-09-01 13:56 -------- d-----w- c:\program files\Safer Networking
2010-08-15 10:24 . 2010-08-15 10:24 503808 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4d9ba47b-n\msvcp71.dll
2010-08-15 10:24 . 2010-08-15 10:24 499712 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4d9ba47b-n\jmc.dll
2010-08-15 10:24 . 2010-08-15 10:24 61440 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-40226f48-n\decora-sse.dll
2010-08-15 10:24 . 2010-08-15 10:24 348160 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4d9ba47b-n\msvcr71.dll
2010-08-15 10:24 . 2010-08-15 10:24 12800 ----a-w- c:\documents and settings\willmonotti\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-40226f48-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-12 01:41 . 2005-05-24 05:18 12 ----a-w- c:\windows\bthservsdp.dat
2010-08-03 07:15 . 2009-05-23 10:52 664 ----a-w- c:\windows\system32\d3d9caps.dat
2008-10-16 01:46 . 2008-10-16 01:46 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00 . 2008-08-29 04:00 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00 . 2008-08-29 04:00 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00 . 2008-08-29 04:00 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00 . 2008-08-29 04:00 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00 . 2008-08-29 04:00 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00 . 2008-08-29 04:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00 . 2008-08-29 04:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00 . 2008-08-29 04:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00 . 2008-08-29 04:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59 . 2008-08-29 03:59 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58 . 2008-08-29 03:58 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57 . 2008-08-29 03:57 16505 ----a-w- c:\program files\DelayInst.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-09-11_13.37.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-12 01:42 . 2010-09-12 01:42 16384 c:\windows\Temp\Perflib_Perfdata_4f0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Google Update"="c:\documents and settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-06-16 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 110592]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\DC++\\DCPlusPlus.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [13/11/2009 11:28 AM 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16/06/2009 8:58 AM 20480]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [21/06/2010 4:01 PM 11520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-08-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]

2010-03-24 c:\windows\Tasks\Install_NSS.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2010-03-15 13:58]

2010-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
- c:\documents and settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-06-16 10:03]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://trinity.unimelb.edu.au/portal
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-12 11:43
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(848)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
.
**************************************************************************
.
Completion time: 2010-09-12 11:46:06 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-12 01:46
ComboFix2.txt 2010-09-11 13:40

Pre-Run: 3,845,029,888 bytes free
Post-Run: 3,789,979,648 bytes free

- - End Of File - - 04CDED9696069A4E89B9E4253B1EBD73

jmw3

2010-09-12, 08:27

Hi

If your having problems with the Kaspersky scan, try this one:

ESET Online Scanner
Go here (http://www.eset.com/onlinescan/) to run an online scannner from ESET.
Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic

alphabet_soup

2010-09-12, 09:50

Here's the log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=af314bc8d461c742a26a4c0ace62f01d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-09-12 06:43:50
# local_time=2010-09-12 04:43:50 (+1000, AUS Eastern Standard Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=65060
# found=65
# cleaned=0
# scan_time=2382
C:\Documents and Settings\willmonotti\My Documents\Stuff\Procrastination central\Random music\Portishead\Third\07 Deep Water.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001383.exe a variant of Win32/Injector.AIF trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001384.exe Win32/Peerfrag.FL worm 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001407.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001408.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001411.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001412.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001415.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001416.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001419.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001422.exe a variant of Win32/Injector.CQB trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001425.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001426.exe a variant of Win32/Injector.CQB trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001427.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001428.exe a variant of Win32/Injector.CQB trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001433.exe a variant of Win32/Injector.CQB trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001435.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001437.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001438.exe a variant of Win32/Injector.CQB trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001439.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001440.exe a variant of Win32/Injector.CQB trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001441.exe a variant of Win32/Injector.CQD trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001443.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001446.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001449.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001450.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001451.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001453.exe Win32/Lethic.AA trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001454.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001455.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001457.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001459.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001461.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001465.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001468.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001469.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001471.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001475.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001476.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001478.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001480.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001486.exe Win32/Lethic.AA trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001488.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001490.exe Win32/Lethic.AA trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001491.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001495.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001499.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001502.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001503.exe Win32/Lethic.AA trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001504.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001505.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001506.exe Win32/Lethic.AA trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001508.exe a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001510.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001511.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001513.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001514.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001515.exe a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_WINDOWS\system32\gnhnveo.dll a variant of Win32/Conficker.X worm 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_\FOUND.024\FILE0000.CHK a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_\FOUND.024\FILE0001.CHK a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_\FOUND.024\FILE0002.CHK a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_\FOUND.024\FILE0003.CHK a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_\FOUND.024\FILE0004.CHK a variant of Win32/Injector.CXM trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\09092010_231100\C_\FOUND.024\FILE0005.CHK a variant of Win32/Injector.CTK trojan 00000000000000000000000000000000 I

jmw3

2010-09-12, 15:08

Hi

Just about done, I think.

Update Adobe Reader
Recently there have been vunerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version: Adobe Reader 9.3
You can download it from http://www.adobe.com/products/acrobat/readstep2.html (http://www.adobe.com/products/acrobat/readstep2.html)
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed Uncheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Adobe 9 is a large program and if you prefer a smaller program you can get Foxit 3 instead from Foxit Software (http://mirrors.foxitsoftware.com/pub/foxit/reader/desktop/win/3.x/3.1/enu/FoxitReader31_enu_Setup.exe)
Note: Do not install anything dealing with AskBar... presented as an installation option.

OTL Double click on OTL.exe to run it
Copy & paste the contents of the Code box below into Paste Instructions for Items to be Moved
Note: Do not type it out to minimize the risk of typo error

:Files
C:\Documents and Settings\willmonotti\My Documents\Stuff\Procrastination central\Random music\Portishead\Third\07 Deep Water.mp3
:Commands
[Purity]
[EmptyTemp]
[Reboot]
Click on Run Fix
When done, click on Exit
Note: If a file or folder can't be moved immediately, you may be asked to restart your computer. Choose Yes.
Post the resulting log in your next reply along with an update on how the computer is running.

alphabet_soup

2010-09-12, 16:15

Hey there

Here's the log. The computer is running smoothly at the moment - definitely a lot faster and it's not shutting down of its own accord all the time.

All processes killed
========== FILES ==========
C:\Documents and Settings\willmonotti\My Documents\Stuff\Procrastination central\Random music\Portishead\Third\07 Deep Water.mp3 moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: willmonotti
->Temp folder emptied: 32211914 bytes
->Temporary Internet Files folder emptied: 4589978 bytes
->Java cache emptied: 5401 bytes
->FireFox cache emptied: 3575562 bytes
->Google Chrome cache emptied: 193444434 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 12593 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 15923882 bytes

Total Files Cleaned = 238.00 mb

OTL by OldTimer - Version 3.2.11.0 log created on 09122010_231232

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\willmonotti\Local Settings\Temp\Perflib_Perfdata_934.dat not found!

Registry entries deleted on Reboot...

jmw3

2010-09-13, 00:00

Hi

You should now update your computer to Windows XP Service Pack 3:
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=5B33B5A8-5E76-401F-BE08-1E1555D4F3D4&displaylang=en

Once that's done, post a new DDS log for review

alphabet_soup

2010-09-14, 17:47

Hey there. sorry for the delay. Here are the DDS logs after having updated with the Windows XP service pack.

Also - the past few startups, an installation wizard for something called "Windows Genuine Advantage Notications" has popped up after I log in. What is this, and should I let it install?

Here's the dds log ("attach" is attached)

DDS (Ver_10-03-17.01) - FAT32x86
Run by willmonotti at 0:43:01.37 on Wed 15/09/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.534 [GMT 10:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\willmonotti\Desktop\dds.scr
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://trinity.unimelb.edu.au/portal
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [LaunchApp] Alaunch
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{51fb15f4-ad27-43bc-ad4b-dd0354fb6bbd}\Icon3E5562ED7.ico
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-11-14 394952]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2009-11-13 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-6-21 11520]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]

=============== Created Last 30 ================

2010-09-14 13:56:45 0 d-----w- c:\windows\LastGood.Tmp
2010-09-14 13:56:33 8840 ----a-w- c:\windows\SEC15A6.PNF
2010-09-14 13:50:33 294912 ------w- c:\windows\system32\dllcache\dlimport.exe
2010-09-14 13:47:23 2948 ----a-w- c:\windows\SEC12.PNF
2010-09-14 13:46:56 19569 ----a-w- c:\windows\003139_.tmp
2010-09-13 22:35:19 0 d-----w- c:\windows\system32\XPSViewer
2010-09-13 22:34:42 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-09-13 22:34:42 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-09-13 22:34:42 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-09-13 22:34:42 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-09-13 22:34:42 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-09-13 22:34:42 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2010-09-13 22:34:42 117760 ------w- c:\windows\system32\prntvpt.dll
2010-09-13 22:32:24 0 d-----w- c:\program files\MSXML 6.0
2010-09-13 04:02:23 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-09-12 13:16:11 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-09-12 13:16:10 215552 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-09-12 06:01:44 0 d-----w- c:\program files\ESET
2010-09-12 03:50:54 0 d-sh--w- C:\Recycled
2010-09-12 02:13:56 353792 ------w- c:\windows\system32\dllcache\srv.sys
2010-09-12 02:13:26 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-09-12 02:13:23 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-09-12 02:13:15 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-12 02:09:47 203136 ------w- c:\windows\system32\dllcache\rmcast.sys
2010-09-12 02:05:01 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2010-09-12 02:01:28 0 d-sh--w- C:\FOUND.000
2010-09-12 01:55:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-12 01:51:12 0 d-----w- c:\windows\system32\PreInstall
2010-09-12 01:44:40 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-09-11 13:29:46 0 d-sha-r- C:\cmdcons
2010-09-09 13:11:00 0 d-----w- C:\_OTL
2010-09-08 12:11:29 0 d-----w- c:\docume~1\willmo~1\applic~1\Malwarebytes
2010-09-08 12:11:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-08 12:11:17 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-08 12:11:17 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-08 12:11:17 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-09-08 09:57:45 0 d-----w- C:\ComboFix
2010-09-08 09:54:53 98816 ----a-w- c:\windows\sed.exe
2010-09-08 09:54:53 77312 ----a-w- c:\windows\MBR.exe
2010-09-08 09:54:53 256512 ----a-w- c:\windows\PEV.exe
2010-09-08 09:54:53 161792 ----a-w- c:\windows\SWREG.exe
2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
2010-09-01 13:53:23 0 d-----w- c:\windows\pss

==================== Find3M ====================

2010-09-12 01:54:42 423656 ----a-w- c:\windows\system32\deployJava1.dll
2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe

============= FINISH: 0:43:37.45 ===============

jmw3

2010-09-15, 13:42

Hi

Sorry for the delay.

Windows Genuine Advantage Notifications -
Windows Genuine Advantage Notifications for Windows XP notifies you if a copy of Windows XP is not genuine. The notification messages only appear on computers that have failed the WGA validation process and that are running a copy of Windows XP that is not genuine. If you are running a validated, genuine copy of Windows XP, you will not receive notification messages. http://support.microsoft.com/kb/905474
You are probably getting this as you have just updated to Service Pack 3. Allow it to install.

Clean Up
Now we need to clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if used inappropriately.
Remove ComboFix
The following will implement some cleanup procedures as well as reset System Restore points:
Click Start > Run then copy/paste the following bolded text into the Run box and click OK:
ComboFix /Uninstall
Double-click OTL
Click the CleanUp! button
Select Yes when the Begin cleanup Process? prompt appears
If you are prompted to Reboot during the cleanup, select Yes
The tool will delete itself once it finishes, if not delete it yourselfYou can delete the following from your desktop:
TFC.exe
The Gmer.exe file (it will be randomly named .exe file)
Any logs that may have been saved to your desktop
ESET Online Scanner v3 - via Add or Remove Programs
If you haven't already done so, open Malwarebytes' Anti-Malware, click Quarantine then Delete All. Close the program.

All Clean
Now that your system is safe we would like you to keep it that way.
Take the time to follow these recommendations & it will greatly reduce the risk of further infections and greatly diminish the chances of you having to visit here again.

Create a Clean System Restore Point
Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and click OK
Ensure the boxes for Temporary Files & Temporary Internet Files are checked. You can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore click Clean up... and click Yes to the prompt
Click OK and Yes to confirm.

Microsoft Windows Update
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows
Go to Start > All Programs > Windows Update
To update Office
Open up any Office program.
Go to Help > Check for Updates

Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is totally free but for real-time protection you will have to pay a small one-time fee.
You can find a tutorial here (http://thespykiller.co.uk/index.php/topic,5946.0.html). Keep it updated & run it regularly.

SpywareBlaster
Download and install Javacools SpywareBlaster from here (http://www.javacoolsoftware.com/spywareblaster.html)
SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. You need to manually check for updates regularly.

Download and Install a HOSTS File
A HOSTS file is a big list of bad web sites. The list has a specific format, a specific name, (name is just HOSTS with no file extension), and a specific location. Your machine always looks at that file in that location before connecting to a web site to verify the address. So the HOSTS listing can be used to "short circuit" a request to a bad website by giving it the address of your own machine.
Install MVPS Hosts File From Here (http://mvps.org/winhelp2002/hosts.htm)
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
You can Find the Tutorial HERE (http://www.mvps.org/winhelp2002/hosts2.htm)

Install WinPatrol
Download it here (http://www.winpatrol.com/download.html)
You can find information about how WinPatrol works here (http://www.winpatrol.com/features.html)

Read some information here (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html) on how to prevent Malware.

Hopefully these steps will help keep your computer clean.

jmw3

2010-09-17, 17:20

Since this issue appears to be resolved ... this Topic has been closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include fresh DDS & Attach logs and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or Moderator a private message (pm). A valid, working link to the closed topic is also required.