Virtumonde.dll detected!! Pls help

[Diwis]

Hi!
This is what spybot has found in my laptop:

--- Report generated: 2011-02-14 03:06 ---

Microsoft.WindowsSecurityCenter_disabled: [SBI $2E20C9A9] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start

Virtumonde.dll: [SBI $2F4068FC] Library (File, nothing done)
C:\Windows\System32\NAPCLCFGC.dll
Properties.size=59904
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Properties.filedate=1297533271
Properties.filedatetext=2011-02-12 17:54:30


--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-01-26 TeaTimer.exe (1.6.4.26)
2011-02-13 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-01-26 advcheck.dll (1.6.2.15)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2010-10-05 Includes\Adware.sbi (*)
2011-02-01 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2010-12-14 Includes\Dialer.sbi (*)
2010-12-14 Includes\DialerC.sbi (*)
2010-01-25 Includes\HeavyDuty.sbi (*)
2010-11-30 Includes\Hijackers.sbi (*)
2011-01-25 Includes\HijackersC.sbi (*)
2010-06-02 Includes\iPhone.sbi (*)
2010-12-14 Includes\Keyloggers.sbi (*)
2010-12-14 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2010-12-14 Includes\Malware.sbi (*)
2011-02-08 Includes\MalwareC.sbi (*)
2010-05-18 Includes\PUPS.sbi (*)
2010-12-14 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2010-12-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2011-01-18 Includes\Spyware.sbi (*)
2011-01-18 Includes\SpywareC.sbi (*)
2010-03-08 Includes\Tracks.uti
2010-12-28 Includes\Trojans.sbi (*)
2011-02-08 Includes\TrojansC-02.sbi (*)
2011-01-13 Includes\TrojansC-03.sbi (*)
2011-01-25 Includes\TrojansC-04.sbi (*)
2011-02-07 Includes\TrojansC-05.sbi (*)
2011-02-07 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

I have run DDS;


DDS (Ver_10-12-12.02) - NTFSx86
Run by Clair and Didi at 3:18:36.58 on 14/02/2011
Internet Explorer: 8.0.6001.19019
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2038.880 [GMT 0:00]

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Spare Messaging\MessagingApp.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Clair and Didi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9MHFNZ2G\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.6\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SpareMessaging] "c:\program files\spare messaging\MessagingApp.exe"
mRun: [UpdateP2GShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" update "software\cyberlink\power2go\5.0"
mRun: [osCheck] "c:\program files\norton 360\osCheck.exe"
mRun: [ccApp] c:\program files\common files\symantec shared\ccApp.exe
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
StartupFolder: c:\users\claira~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://www.king.com/ctl/kingcomie.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/VistaMSNPUpldes-es.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://www.travelblog.org/Admin/PhotoUpload-5.1/Common/ImageUploader5.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} - hxxp://www.travelblog.org/Admin/PhotoUpload4/Common/ImageUploader4.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\claira~1\appdata\roaming\mozilla\firefox\profiles\icftwr6k.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://uk.search.yahoo.com/search?fr=mcafee&p=
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - component: c:\program files\mozilla firefox\extensions\{e132ce4a-1cb1-43f4-8cff-b342d1e81f8a}\components\d979b314-8c6b-ed4e-32e5-4c0e599dc3f4.dll
FF - component: c:\users\clair and didi\appdata\roaming\mozilla\firefox\profiles\icftwr6k.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\tvuplayer\npTVUAx.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\users\clair and didi\appdata\roaming\mozilla\firefox\profiles\icftwr6k.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: z: {e132ce4a-1cb1-43f4-8cff-b342d1e81f8a} - c:\program files\mozilla firefox\extensions\{e132ce4a-1cb1-43f4-8cff-b342d1e81f8a}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\mcafee\SiteAdvisor

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-2-13 64512]
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\ipsdefs\20090715.003\IDSvix86.sys [2009-7-17 272432]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-8-6 21504]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 1405384]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-18 149352]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2010-12-26 88176]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-2-13 1153368]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-2-19 41008]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-13 23888]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2010-5-13 112128]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [2010-5-13 102912]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S3 PLCND532;PLCND532 NDIS Protocol Driver;c:\windows\system32\drivers\PLCND532.sys [2007-8-8 26656]
S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-7-28 1245064]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2011-02-13 23:30:23 -------- dc-h--w- c:\progra~2\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2011-02-13 23:06:42 -------- d-----w- c:\program files\VS Revo Group
2011-02-13 19:20:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-02-13 19:20:47 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2011-02-13 18:29:15 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-02-13 18:29:03 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-13 18:24:15 -------- d-----w- c:\users\claira~1\appdata\local\Sunbelt Software
2011-02-13 17:59:37 -------- d-----w- c:\program files\Lavasoft
2011-02-13 15:10:27 -------- d-----w- c:\program files\Panda Security
2011-02-12 18:41:55 -------- d-----w- c:\program files\Microsoft Security Client
2011-02-12 18:40:59 221568 ----a-w- c:\windows\system32\drivers\netio.sys
2011-02-12 17:54:57 218624 ----a-w- c:\windows\Hvusia.exe
2011-02-12 17:54:30 59904 --sha-r- c:\windows\system32\NAPCLCFGC.dll
2011-02-12 17:47:49 -------- d-----w- c:\program files\Password Recovery Bundle 2010 Demo
2011-02-11 10:13:20 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{0d70c23f-4736-4498-8636-2ee0121fb560}\mpengine.dll
2011-02-09 19:38:13 2039808 ----a-w- c:\windows\system32\win32k.sys
2011-02-09 19:38:08 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-02-09 19:38:00 797184 ----a-w- c:\windows\system32\FntCache.dll
2011-02-09 19:38:00 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-02-09 19:38:00 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-02-09 19:32:42 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-02-09 19:32:42 292352 ----a-w- c:\windows\system32\atmfd.dll
2011-02-07 22:02:15 -------- d-----w- c:\program files\Frhed
2011-02-07 21:11:57 -------- d-----w- c:\program files\OpenOffice.org 3
2011-01-30 14:57:00 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
2011-01-30 14:57:00 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2011-01-21 18:36:53 -------- d-----w- c:\program files\SmartDoctor

==================== Find3M ====================

2011-02-02 17:11:20 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-01-20 16:08:16 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08:06 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08:06 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08:06 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08:06 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07:58 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07:42 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07:16 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06:38 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06:35 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04:54 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 16:04:54 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 14:28:38 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27:50 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26:30 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25:25 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24:32 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 14:24:26 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15:10 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14:39 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14:03 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14:03 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:11:34 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47:51 683008 ----a-w- c:\windows\system32\d2d1.dll
2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-18 06:27:04 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-18 06:22:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-18 06:22:27 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-18 06:22:11 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-12-18 06:22:11 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-12-18 05:25:26 385024 ----a-w- c:\windows\system32\html.iec
2010-12-18 04:48:39 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-12-18 04:47:11 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-12-14 14:49:23 1169408 ----a-w- c:\windows\system32\sdclt.exe

============= FINISH: 3:21:09.65 ===============

There is also the 'Attach' file but it said only to share if required

I'll would be really greatful if someone could give me a hand on this

Thanks

[ken545]

:snwelcome:


Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.


Are you experiencing any browser redirects or unwanted pop up windows ? Is your system running normally or have you noticed it slowing down drastically ?


Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.






Please download Malwarebytes from Here (http://www.malwarebytes.org/mbam-download.php) or Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)


Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
http://i24.photobucket.com/albums/c30/ken545/MBAMCapture.jpg
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please






OTL by OldTimer

Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Click the "Scan All Users" checkbox.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

[Diwis]

Hi Ken 545,

Thanks for your help! I have run Atf cleaner and Malwarebytes and this is the log file:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5749

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

16/02/2011 10:25:12
mbam-log-2011-02-16 (10-25-12).txt

Scan type: Quick scan
Objects scanned: 168319
Time elapsed: 5 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

It didn't find anything, I have Norton 360 premier 5 and doesn't seems to find anything either is just with spybot search and destroy that finds it and also detecs that windows defender doesn't work. The main issue that i find with this virus is redirect pages and slow down internet surfing:sad:

[Diwis]

OTL logfile created on: 16/02/2011 10:33:42 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Clair and Didi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 46.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.31 Gb Total Space | 19.95 Gb Free Space | 14.42% Space Free | Partition Type: NTFS
Drive S: | 1.46 Gb Total Space | 1.42 Gb Free Space | 96.62% Space Free | Partition Type: NTFS

Computer Name: CD-PC | User Name: Clair and Didi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Clair and Didi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
PRC - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Spare Messaging\MessagingApp.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Clair and Didi\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\asOEHook.dll (Symantec Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcp90.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Browser Defender Update Service) -- C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (N360) -- C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (WAS) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (AppHostSvc) -- C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (AresChatServer) -- C:\Program Files\Ares\chatServer.exe (Ares Development Group)
SRV - (SBSDWSCService) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (EvtEng) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)


========== Driver Services (SafeList) ==========

DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110215.038\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110215.038\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SYMTDIv) -- C:\Windows\system32\drivers\N360\0500000.07D\SYMTDIV.SYS (Symantec Corporation)
DRV - (BHDrvx86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110114.001\BHDrvx86.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\Windows\system32\drivers\N360\0500000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\Windows\system32\drivers\N360\0500000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\Windows\system32\drivers\N360\0500000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) -- C:\Windows\system32\drivers\N360\0500000.07D\Ironx86.SYS (Symantec Corporation)
DRV - (IDSVix86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110215.001\IDSvix86.sys (Symantec Corporation)
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (SymDS) -- C:\Windows\system32\drivers\N360\0500000.07D\SYMDS.SYS (Symantec Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek )
DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbfake) -- C:\Windows\System32\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV - (VX1000) -- C:\Windows\System32\drivers\VX1000.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (sfsync04) StarForce Protection Synchronization Driver (version 4.x) -- C:\Windows\System32\drivers\sfsync04.sys (Protection Technology (StarForce))
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PLCND532) -- C:\Windows\System32\drivers\PLCND532.sys (Intellon, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology (StarForce))
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DA 88 BD 9E A1 3A CA 01 [binary data]
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011/02/15 02:06:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2011/02/15 16:59:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn\ [2011/02/15 16:54:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/27 18:38:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/11 10:17:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/12/16 18:37:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/11/17 10:43:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Extensions
[2010/06/17 11:21:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/06/23 11:35:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
[2008/09/21 11:52:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Extensions\maxtv@developer.max-tv.be
[2010/11/17 10:43:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Extensions\prism@developer.mozilla.org
[2011/02/15 12:02:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Firefox\Profiles\icftwr6k.default\extensions
[2010/07/06 11:28:52 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Firefox\Profiles\icftwr6k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/06 11:17:07 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Firefox\Profiles\icftwr6k.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010/01/20 15:56:58 | 000,000,000 | ---D | M] ("SearchStatus") -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Firefox\Profiles\icftwr6k.default\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
[2010/12/07 20:30:36 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\Firefox\Profiles\icftwr6k.default\extensions\firefox@tvunetworks.com
[2010/06/23 11:35:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Clair and Didi\AppData\Roaming\mozilla\SeaMonkey\Profiles\22kfy25u.default\extensions
[2011/02/15 02:34:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/02/07 21:08:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/01/23 17:27:05 | 000,000,000 | ---D | M] (z) -- C:\Program Files\Mozilla Firefox\extensions\{e132ce4a-1cb1-43f4-8cff-b342d1e81f8a}
[2009/03/31 21:47:26 | 000,324,976 | ---- | M] (Symantec Corporation) -- C:\Program Files\Mozilla Firefox\components\coFFPlgn.dll
[2010/06/26 07:47:04 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/06/26 07:47:04 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/06/26 07:47:04 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/01/19 22:47:51 | 000,002,027 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml
[2010/06/26 07:47:04 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/02/15 01:28:55 | 000,429,885 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 14800 more lines...
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\5.0.0.125\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SpareMessaging] C:\Program Files\Spare Messaging\MessagingApp.exe ()
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe ()
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-3673642746-4147633524-2801634249-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} http://www.king.com/ctl/kingcomie.cab (king.com)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/pr01/resources/VistaMSNPUpldes-es.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.travelblog.org/Admin/PhotoUpload-5.1/Common/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} http://dl.uc.sina.com/cab/downloader.cab (DLoader Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab (EPUImageControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} http://www.travelblog.org/Admin/PhotoUpload4/Common/ImageUploader4.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{28e20019-f6d3-11df-81e5-001e101f8e22}\Shell - "" = AutoRun
O33 - MountPoints2\{28e20019-f6d3-11df-81e5-001e101f8e22}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{387fc0f9-5ec6-11df-874a-00030d97c0bd}\Shell - "" = AutoRun
O33 - MountPoints2\{387fc0f9-5ec6-11df-874a-00030d97c0bd}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{387fc103-5ec6-11df-874a-001e101f8aaa}\Shell - "" = AutoRun
O33 - MountPoints2\{387fc103-5ec6-11df-874a-001e101f8aaa}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{387fc126-5ec6-11df-874a-001e101f1f81}\Shell - "" = AutoRun
O33 - MountPoints2\{387fc126-5ec6-11df-874a-001e101f1f81}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{7151e3fe-5f26-11df-be87-001e101f50a4}\Shell - "" = AutoRun
O33 - MountPoints2\{7151e3fe-5f26-11df-be87-001e101f50a4}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{dfffcdfd-ae7c-11dd-892a-00030d97c0bd}\Shell - "" = AutoRun
O33 - MountPoints2\{dfffcdfd-ae7c-11dd-892a-00030d97c0bd}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/16 10:32:10 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Clair and Didi\Desktop\OTL.exe
[2011/02/16 10:19:06 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Local\Apple
[2011/02/15 16:57:05 | 000,126,512 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2011/02/15 16:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2011/02/15 16:55:51 | 000,330,360 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\symtdiv.sys
[2011/02/15 16:55:50 | 000,652,336 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\SymEFA.sys
[2011/02/15 16:55:50 | 000,509,560 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\srtsp.sys
[2011/02/15 16:55:50 | 000,340,016 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\SymDS.sys
[2011/02/15 16:55:50 | 000,295,032 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\symnets.sys
[2011/02/15 16:55:50 | 000,136,312 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\Ironx86.sys
[2011/02/15 16:55:50 | 000,050,168 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0500000.07D\srtspx.sys
[2011/02/15 16:54:27 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\N360
[2011/02/15 16:54:27 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\N360\0500000.07D
[2011/02/15 16:54:20 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 Premier Edition
[2011/02/15 16:54:20 | 000,000,000 | ---D | C] -- C:\Program Files\Norton 360 Premier Edition
[2011/02/15 12:13:31 | 000,000,000 | ---D | C] -- C:\ProgramData\PCSettings
[2011/02/15 12:13:06 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2011/02/15 12:13:06 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2011/02/15 12:06:55 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
[2011/02/15 11:35:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/02/15 03:17:24 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\AVG
[2011/02/15 03:14:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC Tuneup 2011
[2011/02/15 02:56:03 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\AVG10
[2011/02/15 02:54:51 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011/02/15 02:51:39 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10
[2011/02/15 02:50:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011/02/15 02:40:20 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011/02/15 02:11:48 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Local\Threat Expert
[2011/02/15 02:06:35 | 000,149,456 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll
[2011/02/15 02:06:34 | 002,000,848 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll
[2011/02/15 02:06:34 | 001,533,904 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll
[2011/02/15 01:59:55 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools Security
[2011/02/15 01:55:06 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011/02/14 18:50:31 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2011/02/13 23:06:43 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2011/02/13 23:06:42 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2011/02/13 19:20:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/02/13 19:20:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011/02/13 19:20:47 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/02/13 18:29:15 | 000,064,512 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys
[2011/02/13 18:29:03 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2011/02/13 18:24:15 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Local\Sunbelt Software
[2011/02/13 17:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011/02/13 17:59:37 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2011/02/13 15:10:27 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2011/02/12 18:40:59 | 000,221,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2011/02/12 17:47:49 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Recovery Bundle 2010 Demo
[2011/02/12 17:47:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Password Recovery Bundle 2010 Demo
[2011/02/12 17:47:49 | 000,000,000 | ---D | C] -- C:\Program Files\Password Recovery Bundle 2010 Demo
[2011/02/12 17:31:17 | 000,385,024 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_xml.dll
[2011/02/12 17:31:17 | 000,360,448 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx4ole14.ocx
[2011/02/12 17:31:17 | 000,217,088 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_tls.dll
[2011/02/12 17:31:17 | 000,065,536 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_wnd.dll
[2011/02/12 17:31:17 | 000,053,248 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_wmf.flt
[2011/02/12 17:31:16 | 001,056,768 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_dox.dll
[2011/02/12 17:31:16 | 000,610,304 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_pdf.dll
[2011/02/12 17:31:16 | 000,552,960 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_rtf.dll
[2011/02/12 17:31:16 | 000,327,680 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_obj.dll
[2011/02/12 17:31:16 | 000,253,952 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_png.flt
[2011/02/12 17:31:16 | 000,249,856 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_htm.dll
[2011/02/12 17:31:16 | 000,200,704 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_jpg.flt
[2011/02/12 17:31:16 | 000,131,072 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_ic.dll
[2011/02/12 17:31:16 | 000,073,728 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_tif.flt
[2011/02/12 17:31:16 | 000,057,344 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_gif.flt
[2011/02/12 17:31:15 | 001,084,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.002
[2011/02/12 17:31:15 | 000,765,952 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14.dll
[2011/02/12 17:31:15 | 000,667,648 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_doc.dll
[2011/02/12 17:31:15 | 000,343,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.001
[2011/02/12 17:31:15 | 000,331,776 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_css.dll
[2011/02/12 17:31:15 | 000,061,440 | ---- | C] (The Imaging Source Europe GmbH) -- C:\Windows\System32\tx14_bmp.flt
[2011/02/12 17:31:15 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.003
[2011/02/12 17:31:15 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3a.dll
[2011/02/12 17:31:14 | 001,028,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.000
[2011/02/12 17:31:14 | 000,000,000 | ---D | C] -- C:\Program Files\Abdio
[2011/02/10 11:05:24 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\Desktop\Missing Leap Calls
[2011/02/09 19:38:13 | 002,039,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011/02/09 19:38:00 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2011/02/09 19:38:00 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2011/02/09 19:38:00 | 000,797,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2011/02/09 19:37:59 | 000,979,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll
[2011/02/09 19:37:59 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2011/02/09 19:37:59 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011/02/09 19:37:59 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2011/02/09 19:37:58 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2011/02/09 19:37:58 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011/02/09 19:37:58 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll
[2011/02/09 19:37:58 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll
[2011/02/09 19:37:58 | 000,261,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2011/02/09 19:37:57 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2011/02/09 19:37:57 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2011/02/09 19:37:57 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2011/02/09 19:37:56 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2011/02/09 19:37:56 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2011/02/09 19:37:55 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2011/02/09 19:37:55 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2011/02/09 19:37:54 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2011/02/09 19:37:53 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2011/02/09 19:37:53 | 000,209,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll
[2011/02/09 19:37:51 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2011/02/09 19:37:51 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2011/02/09 19:37:50 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2011/02/09 19:37:39 | 003,602,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011/02/09 19:37:38 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011/02/09 19:37:30 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011/02/09 19:37:30 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/02/09 19:37:29 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/02/09 19:37:29 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/02/09 19:37:28 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011/02/09 19:37:28 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/02/09 19:37:28 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/02/09 19:37:28 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011/02/09 19:37:27 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011/02/09 19:37:27 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011/02/09 19:37:27 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011/02/09 19:37:27 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011/02/09 19:37:27 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011/02/09 19:37:27 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011/02/09 19:37:27 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/02/09 19:37:27 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011/02/09 19:37:27 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011/02/09 19:32:42 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011/02/09 19:32:42 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011/02/07 23:26:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccentSoft Utilities
[2011/02/07 23:00:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frhed
[2011/02/07 22:02:15 | 000,000,000 | ---D | C] -- C:\Program Files\Frhed
[2011/02/07 21:11:57 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2011/02/07 21:10:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011/02/07 21:10:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/02/07 21:07:31 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011/01/30 16:48:00 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\Documents\VIDEO_TS
[2011/01/30 16:48:00 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\Documents\AUDIO_TS
[2011/01/21 19:03:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accent WORD Password Recovery
[2011/01/21 18:36:53 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SmartDoctor
[2011/01/21 18:36:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartDoctor
[2011/01/21 18:36:53 | 000,000,000 | ---D | C] -- C:\Program Files\SmartDoctor
[2011/01/21 18:33:32 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Multi Password Recovery
[2011/01/20 16:57:42 | 000,000,000 | ---D | C] -- C:\Users\Clair and Didi\Desktop\Mum
[2007/08/08 13:40:18 | 000,026,656 | ---- | C] (Intellon, Inc.) -- C:\Users\Clair and Didi\AppData\Roaming\PLCND532.sys
[2007/08/08 13:39:44 | 000,040,992 | ---- | C] (Intellon, Inc.) -- C:\Users\Clair and Didi\AppData\Roaming\PLCND564.sys
[2007/06/02 01:50:30 | 000,118,784 | ---- | C] (Intellon, Inc.) -- C:\Users\Clair and Didi\AppData\Roaming\PLCLIB32.dll
[2005/10/11 07:01:08 | 000,122,880 | ---- | C] (Intellon) -- C:\Users\Clair and Didi\AppData\Roaming\PowerPacket Utility.exe
[2004/04/26 09:53:26 | 000,094,208 | ---- | C] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\Users\Clair and Didi\AppData\Roaming\PLCLIB.dll
[1 C:\Users\Clair and Didi\*.tmp files -> C:\Users\Clair and Didi\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/16 10:32:10 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Clair and Didi\Desktop\OTL.exe
[2011/02/16 10:07:28 | 000,000,440 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{508EFDC1-88EF-47E2-824C-BD2D6262BAD6}.job
[2011/02/16 09:20:02 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011/02/16 09:16:54 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/16 09:16:53 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/16 09:16:52 | 000,000,326 | -HS- | M] () -- C:\Windows\tasks\XNIDQFPJ.job
[2011/02/16 09:16:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/16 09:16:33 | 2137,448,448 | -HS- | M] () -- C:\hiberfil.sys
[2011/02/15 16:59:00 | 002,317,406 | ---- | M] () -- C:\Windows\System32\drivers\N360\0500000.07D\Cat.DB
[2011/02/15 16:57:05 | 000,126,512 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2011/02/15 16:57:05 | 000,007,456 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2011/02/15 16:57:05 | 000,000,805 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2011/02/15 16:56:16 | 000,002,330 | ---- | M] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2011/02/15 11:27:26 | 000,046,080 | ---- | M] () -- C:\Users\Clair and Didi\Desktop\Book1.xls
[2011/02/15 02:30:35 | 241,654,406 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/02/15 02:03:33 | 002,317,406 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2011/02/15 01:28:55 | 000,429,885 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/02/15 01:24:49 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011/02/15 01:23:27 | 000,631,102 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/02/15 01:23:27 | 000,114,220 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/02/14 03:06:40 | 000,000,201 | ---- | M] () -- C:\Windows\wininit.ini
[2011/02/14 02:44:44 | 000,001,356 | ---- | M] () -- C:\Users\Clair and Didi\AppData\Local\d3d9caps.dat
[2011/02/13 23:33:58 | 000,064,512 | ---- | M] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys
[2011/02/13 23:06:43 | 000,001,062 | ---- | M] () -- C:\Users\Clair and Didi\Desktop\Revo Uninstaller.lnk
[2011/02/13 22:23:15 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/02/13 22:23:15 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/02/13 20:13:23 | 000,001,114 | ---- | M] () -- C:\Users\Clair and Didi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/02/13 18:29:00 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2011/02/12 18:34:14 | 000,000,753 | ---- | M] () -- C:\Users\Clair and Didi\Desktop\Ares.lnk
[2011/02/12 17:54:30 | 000,059,904 | RHS- | M] () -- C:\Windows\System32\NAPCLCFGC.dll
[2011/02/12 17:47:49 | 000,001,061 | ---- | M] () -- C:\Users\Clair and Didi\Desktop\Password Recovery Bundle 2010 Demo.lnk
[2011/02/11 10:17:38 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/02/10 09:04:34 | 000,380,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/02/07 22:40:56 | 000,000,418 | ---- | M] () -- C:\Users\Clair and Didi\AppData\Roaming\wklnhst.dat
[2011/02/02 17:11:20 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2011/02/01 22:53:19 | 000,000,943 | ---- | M] () -- C:\Users\Clair and Didi\Desktop\CyberlinkPower2Go.lnk
[2011/01/30 17:51:28 | 000,061,952 | ---- | M] () -- C:\Users\Clair and Didi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/20 16:08:16 | 000,478,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2011/01/20 16:08:06 | 001,029,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2011/01/20 16:08:06 | 000,219,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2011/01/20 16:08:06 | 000,189,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2011/01/20 16:08:06 | 000,160,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2011/01/20 16:07:58 | 000,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2011/01/20 16:06:38 | 002,873,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2011/01/20 16:06:35 | 000,026,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2011/01/20 16:04:54 | 000,209,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll
[2011/01/20 16:04:54 | 000,098,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2011/01/20 14:28:38 | 001,554,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2011/01/20 14:27:50 | 000,876,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011/01/20 14:26:30 | 000,667,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2011/01/20 14:25:25 | 000,847,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2011/01/20 14:24:32 | 000,288,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011/01/20 14:24:26 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2011/01/20 14:15:10 | 000,979,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll
[2011/01/20 14:14:39 | 000,357,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll
[2011/01/20 14:14:03 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll
[2011/01/20 14:14:03 | 000,261,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2011/01/20 14:12:46 | 001,172,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2011/01/20 14:11:34 | 000,486,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2011/01/20 13:47:51 | 000,683,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2011/01/20 13:44:05 | 001,068,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2011/01/20 13:44:03 | 000,797,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[1 C:\Users\Clair and Didi\*.tmp files -> C:\Users\Clair and Didi\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/15 16:57:45 | 002,317,406 | ---- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\Cat.DB
[2011/02/15 16:57:05 | 000,007,456 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2011/02/15 16:57:05 | 000,000,805 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2011/02/15 16:56:16 | 000,002,330 | ---- | C] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2011/02/15 16:54:34 | 000,003,374 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymEFA.inf
[2011/02/15 16:54:34 | 000,002,792 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymDS.inf
[2011/02/15 16:54:34 | 000,001,474 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymNetV.inf
[2011/02/15 16:54:34 | 000,001,446 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymNet.inf
[2011/02/15 16:54:34 | 000,001,389 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\srtspx.inf
[2011/02/15 16:54:34 | 000,001,383 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\srtsp.inf
[2011/02/15 16:54:34 | 000,000,742 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\Iron.inf
[2011/02/15 16:54:28 | 000,007,877 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\symnetv.cat
[2011/02/15 16:54:28 | 000,007,528 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\iron.cat
[2011/02/15 16:54:28 | 000,007,458 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymNet.cat
[2011/02/15 16:54:28 | 000,007,456 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymEFA.cat
[2011/02/15 16:54:28 | 000,007,454 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\srtspx.cat
[2011/02/15 16:54:28 | 000,007,450 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\SymDS.cat
[2011/02/15 16:54:28 | 000,007,450 | R--- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\srtsp.cat
[2011/02/15 16:54:27 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\N360\0500000.07D\isolate.ini
[2011/02/15 09:27:16 | 000,046,080 | ---- | C] () -- C:\Users\Clair and Didi\Desktop\Book1.xls
[2011/02/15 02:30:35 | 241,654,406 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/02/15 02:06:35 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2011/02/15 02:06:35 | 000,002,125 | ---- | C] () -- C:\Windows\UDB.zip
[2011/02/15 02:06:35 | 000,000,882 | ---- | C] () -- C:\Windows\RegSDImport.xml
[2011/02/15 02:06:35 | 000,000,879 | ---- | C] () -- C:\Windows\RegISSImport.xml
[2011/02/15 02:06:35 | 000,000,131 | ---- | C] () -- C:\Windows\IDB.zip
[2011/02/15 02:02:33 | 002,317,406 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2011/02/14 03:08:08 | 2137,448,448 | -HS- | C] () -- C:\hiberfil.sys
[2011/02/13 23:06:43 | 000,001,062 | ---- | C] () -- C:\Users\Clair and Didi\Desktop\Revo Uninstaller.lnk
[2011/02/13 22:23:15 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011/02/13 22:23:15 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011/02/13 21:41:16 | 000,000,201 | ---- | C] () -- C:\Windows\wininit.ini
[2011/02/13 19:20:56 | 000,001,114 | ---- | C] () -- C:\Users\Clair and Didi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/02/12 18:43:21 | 000,001,945 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011/02/12 17:54:35 | 000,000,326 | -HS- | C] () -- C:\Windows\tasks\XNIDQFPJ.job
[2011/02/12 17:54:30 | 000,059,904 | RHS- | C] () -- C:\Windows\System32\NAPCLCFGC.dll
[2011/02/12 17:47:49 | 000,001,061 | ---- | C] () -- C:\Users\Clair and Didi\Desktop\Password Recovery Bundle 2010 Demo.lnk
[2011/02/12 17:31:16 | 000,000,530 | ---- | C] () -- C:\Windows\System32\tx14_ic.ini
[2010/12/09 10:49:50 | 000,000,418 | ---- | C] () -- C:\Users\Clair and Didi\AppData\Roaming\wklnhst.dat
[2010/09/01 07:42:59 | 000,000,482 | ---- | C] () -- C:\Users\Clair and Didi\AppData\Roaming\Poladroid prefs.plist
[2010/06/25 09:02:12 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010/06/25 08:50:52 | 000,000,056 | ---- | C] () -- C:\Windows\videotoaudio.ini
[2010/05/10 14:32:28 | 000,000,040 | ---- | C] () -- C:\Windows\RUNAWAY2.INI
[2009/12/03 07:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009/11/22 20:44:08 | 000,176,235 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
[2009/08/03 13:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/07/31 01:58:42 | 000,000,314 | ---- | C] () -- C:\Windows\primopdf.ini
[2009/07/15 22:06:49 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/06/26 16:21:02 | 000,015,498 | ---- | C] () -- C:\Windows\VX1000.ini
[2009/03/23 06:24:15 | 000,001,356 | ---- | C] () -- C:\Users\Clair and Didi\AppData\Local\d3d9caps.dat
[2008/09/21 17:10:42 | 000,000,204 | ---- | C] () -- C:\Windows\struct~.ini
[2008/08/28 16:43:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/08/08 16:18:11 | 000,061,952 | ---- | C] () -- C:\Users\Clair and Didi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/28 10:48:20 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2008/07/28 10:48:14 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/07/28 10:48:14 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/07/28 10:48:13 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/07/28 10:48:10 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2008/04/25 09:00:42 | 000,910,720 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2008/04/25 09:00:42 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1280.dll
[2008/04/25 09:00:38 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007/08/16 04:23:28 | 000,040,960 | ---- | C] () -- C:\Windows\System32\gpyapi.dll
[2007/05/14 06:45:24 | 000,001,181 | ---- | C] () -- C:\Windows\System32\PLCLIB32.INI
[2007/05/14 06:45:24 | 000,001,181 | ---- | C] () -- C:\Users\Clair and Didi\AppData\Roaming\PLCLIB32.INI
[2007/02/21 10:26:58 | 000,995,328 | ---- | C] () -- C:\Windows\System32\WLIHVUI.dll
[2006/11/02 12:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 07:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/09/13 11:06:10 | 000,045,056 | ---- | C] () -- C:\Windows\System32\gtapi.dll
[2004/04/26 09:43:30 | 000,016,001 | ---- | C] () -- C:\Users\Clair and Didi\AppData\Roaming\PLCNDIS3.VXD

========== LOP Check ==========

[2010/07/27 20:06:40 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\111 Pix Ltd
[2009/07/17 08:45:27 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\AntiMalware
[2011/02/15 04:11:01 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\AVG
[2011/02/15 02:56:03 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\AVG10
[2010/07/08 11:14:49 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/06/08 15:06:12 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\CoffeeCup Software
[2008/10/11 07:38:17 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/12/14 20:55:19 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\dBpoweramp
[2008/09/21 11:52:18 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\DMV Technologies
[2011/02/15 11:28:01 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Dropbox
[2011/02/11 16:15:14 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\FileZilla
[2010/06/10 18:18:45 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\NCH Swift Sound
[2010/12/09 20:34:30 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\PrimoPDF
[2010/05/31 11:42:29 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Serif
[2009/12/06 16:23:12 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\StreamTorrent
[2010/12/09 10:49:54 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Template
[2010/06/17 11:21:51 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Thunderbird
[2011/01/03 12:20:42 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\To-Do DeskList
[2010/07/15 21:06:12 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Uniblue
[2010/05/13 19:57:30 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Vodafone
[2008/08/07 16:06:38 | 000,000,000 | ---D | M] -- C:\Users\Clair and Didi\AppData\Roaming\Windows Live Writer
[2010/10/11 08:29:29 | 000,000,000 | ---D | M] -- C:\Users\HarwoodVA\AppData\Roaming\Thunderbird
[2010/10/11 08:26:19 | 000,000,000 | ---D | M] -- C:\Users\HarwoodVA\AppData\Roaming\Vodafone
[2011/02/16 05:57:20 | 000,032,648 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/02/16 10:07:28 | 000,000,440 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{508EFDC1-88EF-47E2-824C-BD2D6262BAD6}.job
[2011/02/16 09:16:52 | 000,000,326 | -HS- | M] () -- C:\Windows\Tasks\XNIDQFPJ.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 833 bytes -> C:\Users\Clair and Didi\Desktop\failure notice.eml:OECustomProperty
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

[Diwis]

OTL Extras logfile created on: 16/02/2011 10:33:42 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Clair and Didi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 46.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.31 Gb Total Space | 19.95 Gb Free Space | 14.42% Space Free | Partition Type: NTFS
Drive S: | 1.46 Gb Total Space | 1.42 Gb Free Space | 96.62% Space Free | Partition Type: NTFS

Computer Name: CD-PC | User Name: Clair and Didi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [edit] -- "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D3E3F0E-2493-4F31-AE67-F0F078FE1475}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{0F90F49C-CDB3-445C-BC66-F6893D36B5F5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3CE94516-4A9B-4679-99B3-0AFE16BCB590}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{46F79234-8A26-45A8-BE60-279596C53C15}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4B5B0E7B-0FCC-4EFC-841B-47F7E285769C}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{4DC4F19D-ABEB-4ACE-B391-E5A80065E903}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5518B4AF-849F-44C5-A4B1-7A08A9EFD5C5}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 |
"{7A8BFC6B-2D51-4A36-B7A5-7C8D64251C38}" = lport=25 | protocol=6 | dir=in | name=fasthosts |
"{8D434E52-92C8-400E-8035-545309D76D2C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8EF83AD5-5D92-4D91-9E79-833AACF0FE0B}" = rport=137 | protocol=17 | dir=out | app=system |
"{9191BFA1-0EF1-4133-ACAB-F2E086E01D41}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9C41F437-B0D5-43CA-87DA-13DEFE3E189C}" = lport=138 | protocol=17 | dir=in | app=system |
"{A257DD46-FD87-4603-A028-E49278D4395F}" = lport=139 | protocol=6 | dir=in | app=system |
"{A2F88618-E8B1-49AE-B00C-13CBB9C3ECF1}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{A94EAADA-FCDE-44F4-83AE-573FFBBE2A27}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 |
"{B36458EF-9813-4299-A7C5-EDA1D7FBDB5F}" = lport=137 | protocol=17 | dir=in | app=system |
"{C167F530-DB36-4B3F-A1A6-623BCEFA9AE8}" = lport=445 | protocol=6 | dir=in | app=system |
"{CAFE988B-9ABC-4203-83CD-F72014942E72}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{CC6714F0-7B60-47E1-8D57-81A81D2F8C63}" = lport=10243 | protocol=6 | dir=in | app=system |
"{D21B3AA9-F88A-455B-871A-4CDFD5AE12B7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D260B9C5-B5E1-484D-851D-D6172DCD15D7}" = rport=138 | protocol=17 | dir=out | app=system |
"{D6A387F3-89B0-40BE-838E-5E48F45273D5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EA9C6472-F933-4663-87BA-CFAB73DD603D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EE548787-076B-4590-A2C3-B9E7556B752F}" = rport=445 | protocol=6 | dir=out | app=system |
"{F1E70654-E816-4A0B-A458-B4F99BB469AB}" = rport=139 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00F05D2B-B1F8-4881-A83C-BB7FE92ACB51}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{010416A2-C421-4882-9599-F9F09413B5E2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{013C723A-F49D-4DFF-9618-4EC8C4BFC62E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0DD56E57-EE46-492B-A116-BEB38CE232CA}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{1C313A37-FD0B-405D-A720-866ECEEC0B49}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{1CF29987-0B7B-4710-B362-4D606D10377A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{1EE7E345-4FE7-4A69-A0D7-7DA9D7FA567F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{21B1C0CF-1422-445A-B961-868D71F5EB57}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{234B1CE5-2F58-4DAF-8CA5-6D026CBA2889}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{26A6257F-E2B6-42FA-86D6-BD42EFE12878}" = protocol=6 | dir=out | app=system |
"{358E5CF6-FF74-41EB-AD09-1E25D42D1E02}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{35AA16CB-1967-4122-914F-27D43C874A38}" = protocol=6 | dir=in | app=c:\users\clair and didi\appdata\roaming\dropbox\bin\dropbox.exe |
"{3D862AEF-51AD-44AB-9E68-6C3667DEE8F5}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{42FCAB17-0E0D-4AC7-8AD7-150424E4BE9A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{45FC1349-37E4-4116-AB6D-6D9CD09396DB}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{48ABACF7-C1E6-4ACA-BA8C-F38DEBF855D1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{4C5E357C-5371-46D7-8D8D-6E3C6B8ACAC1}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{58E41B69-82E8-4EEA-8823-3CFCF96A2616}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{68E0D6D6-9F14-4C1D-BA23-DF3D2385E765}" = protocol=17 | dir=in | app=c:\users\clair and didi\appdata\roaming\dropbox\bin\dropbox.exe |
"{804E537E-6938-493B-B580-07D02E3E45F6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{88E5B47F-2BAE-4482-B104-5684C3E0F03B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8C145D08-F00B-4E51-AED5-1D1ED971652D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8D09D491-7F58-47BD-84BB-6D992218102D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ACB80161-51A0-4772-B1FC-EE17234AC963}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B0969454-8002-49BD-95A8-6DE92E51E932}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B3F01062-50C1-4FBC-BD50-E585C4EA83F1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DAFE1CC8-6FE0-4C3A-B451-4F247D175680}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E5F720AB-5A5C-4C83-B7E5-E8DBD40F9970}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F63A699F-CFD7-4A36-9F51-038BF42FA422}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{14116DDD-A561-425D-82FF-D2CA10D4C64C}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{142142BC-A6A5-423E-938B-9F02F5163956}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{1ABCEDB0-510B-4A00-A334-3989658BFA5B}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{2C7D9A7B-47A3-411A-B097-B0EBF5E6BF1E}C:\users\clair and didi\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\clair and didi\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{5DDE553A-70DA-49F6-BFA5-65CE95F35D38}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{6EF1845D-3572-42B9-B473-F6978D7BB7FF}C:\program files\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files\ares\ares.exe |
"TCP Query User{892C7310-0C00-4A61-8623-1D4561AFF8A5}C:\program files\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files\ares\ares.exe |
"TCP Query User{9B767EC8-6DCA-4C07-948C-B8EF04895F26}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{B2C57F09-7967-43FC-8978-7EF7517A57FA}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{BEB019C5-0776-4BA4-87F5-B0DE513887CE}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe |
"TCP Query User{C42B7CEF-3CDB-469C-9FC1-C63A20B4C84B}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{DC48D612-507E-4187-A879-22989212871D}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{2CEB0121-E10A-4326-86C8-3BBAC67C6A4C}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{4093D7AD-D035-4B18-9EA8-11A3130CEF85}C:\program files\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files\ares\ares.exe |
"UDP Query User{672E4DF9-11AF-4762-8600-E407CDFB7381}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe |
"UDP Query User{9F982488-D29A-4B69-831A-917EB5049EF7}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{A66FF85E-4A27-4455-8EF9-C9E38C9DC4C0}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{BBAA1713-1CB5-45F3-9079-252FBB1746DF}C:\program files\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files\ares\ares.exe |
"UDP Query User{E6F32D03-627F-49D2-ADDB-44B50096834B}C:\users\clair and didi\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\clair and didi\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{EC7C1854-DD70-48CA-8F56-A90FAC9EB11E}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{EF6ECF0E-283B-4CEB-B1FD-D23964F19218}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{F517C91D-B6B9-44C8-922F-AB5DDCF87B94}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{FAE59E7E-81A4-47C4-845D-4E2356E890F3}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{FB5C707F-054B-454B-8E55-A9B33A3634B5}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0837A661-FEC3-48B3-876C-91E7D32048A9}" = Macromedia Dreamweaver 8
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{49471DB8-7F3C-42DB-89C2-AC50FA0C5290}" = Camtasia Studio 7
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup 2011
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{5BCC634A-58AD-42F9-B3C6-2EA52F81CF85}" = Snagit 10
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{639673E9-D53F-44F4-A046-485C8A6ADA15}" = Paint.NET v3.5.6
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B7B8AA42-B894-4668-A652-D9915C7EDDCF}" = PowerPacket Ethernet Adapter
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C79312BD-3E76-4474-A10C-1435D1856A4B}" = Adobe Dreamweaver CS5
"{C939F015-83C6-432C-B67B-0816AA0B4C17}" = Spare Messaging
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D34D82E0-4600-407B-9478-8506C1DD1033}" = Nero 7 Essentials
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E8FF78D0-4D1C-4B2D-AC80-670F135F5461}" = Poladroid
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F413B69D-4AD6-42AB-AEA5-0548989FAD50}" = Norton 360
"{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}" = mCore
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Ares" = Ares 2.1.7
"Audacity_is1" = Audacity 1.2.6
"Browser Defender_is1" = Browser Defender 3.0
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"dBpoweramp Windows Media Audio 10 Codec" = dBpoweramp Windows Media Audio 10 Codec
"DiskCleaner" = Disk Cleaner (remove only)
"Google Updater" = Google Updater
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.0.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"N360" = Norton 360 Premier Edition
"Password Recovery Bundle 2010 Demo" = Password Recovery Bundle 2010 Demo
"PrimoPDF" = PrimoPDF -- by Nitro PDF Software
"ProInst" = Intel(R) PROSet/Wireless Software
"PROR" = Microsoft Office Professional 2007 Trial
"Revo Uninstaller" = Revo Uninstaller 1.91
"Sina Web TV" = Sina Web TV
"SopCast" = SopCast 3.0.3
"StreamTorrent 1.0" = Stream Torrent 1.0
"Switch" = Switch Sound File Converter
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.5.3.1
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.2
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = Compresor WinRAR

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3673642746-4147633524-2801634249-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"FileZilla Client" = FileZilla Client 3.3.5.1
"GoToMeeting" = GoToMeeting 4.5.0.457

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15/02/2011 07:43:51 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 07:43:51 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:21 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:21 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:21 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:23 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:23 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:24 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 12:56:24 | Computer Name = CD-Pc | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 15/02/2011 16:11:31 | Computer Name = CD-Pc | Source = Application Error | ID = 1000
Description = Faulting application ccSvcHst.exe, version 10.1.0.37, time stamp 0x4cec5876,
faulting module SYMHTML.DLL, version 5.5.0.45, time stamp 0x4cc69fbe, exception
code 0xc0000005, fault offset 0x0004334e, process id 0x7bc, application start time
0x01cbcd31c2463f1b.

[ OSession Events ]
Error - 19/07/2009 18:31:25 | Computer Name = CD-Pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 12
seconds with 0 seconds of active time. This session ended with a crash.

Error - 02/07/2010 04:03:58 | Computer Name = CD-Pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1241
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 15/02/2011 08:13:36 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7034
Description =

Error - 15/02/2011 12:55:10 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7000
Description =

Error - 15/02/2011 12:55:10 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7001
Description =

Error - 15/02/2011 16:15:25 | Computer Name = CD-Pc | Source = DCOM | ID = 10010
Description =

Error - 15/02/2011 16:21:19 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7000
Description =

Error - 15/02/2011 16:21:19 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7001
Description =

Error - 15/02/2011 17:57:28 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7011
Description =

Error - 15/02/2011 17:57:58 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7011
Description =

Error - 16/02/2011 05:18:03 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7000
Description =

Error - 16/02/2011 05:18:03 | Computer Name = CD-Pc | Source = Service Control Manager | ID = 7001
Description =


< End of report >

[ken545]

Hi,

Part of this fix will reset your hosts file, after its done and you reboot let me know if the redirects have stopped

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL



:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:DFC5A2B2

:Services

:Reg

:Files


:Commands
[purity]
[emptytemp]
[RESETHOSTS]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the results of the log and a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

[Diwis]

All processes killed
Error: Unable to interpret <PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0B4227B4> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:DFC5A2B2> in the current context!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Clair and Didi
->Temp folder emptied: 58257 bytes
->Temporary Internet Files folder emptied: 34046071 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 34789267 bytes
->Flash cache emptied: 1364 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: Default User

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
->FireFox cache emptied: 30529585 bytes
->Flash cache emptied: 405 bytes

User: HarwoodVA
->Temp folder emptied: 41926 bytes
->Temporary Internet Files folder emptied: 37294 bytes
->Flash cache emptied: 56504 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 2595 bytes

Total Files Cleaned = 95.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.20.6 log created on 02162011_133125

Files\Folders moved on Reboot...
C:\Users\Clair and Didi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HCVBPHJA\NPE[1].exe moved successfully.

Registry entries deleted on Reboot...

At the moment doesn't looks like internet gets any redirect however it does happen every time i run a scan with several spyware or other tools and do a reboot looks fine but after a while the redirect starts again. Doesn't seems i can activate security center either

[ken545]

When you ran the fix for OTL, did you click on Run Scan, it should have been
Then click the Run Fix button at the top

If you did not run Run Fix than please run the program again




Scan With RootKitUnHooker

Please choose one link and download Rootkit Unhooker and save it to your desktop.
Link 1 (http://www.kernelmode.info/ARKs/RKUnhookerLE.EXE)
Link 2 (http://www.kernelmode.info/ARKs/RKUnhookerLE.zip)
Link 3 (http://www.kernelmode.info/ARKs/RkU3.8.388.590.rar)

Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.


Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

[Diwis]

I'm running the RKUnhooker, In OTL i did use the fix button. Just after that i went on safe mode and networking and use norton power remover and did find a infected program and did removed it then on safe mode stil I did use malwarebytes and nothing was found and finally I did use Spybot and found just a dodgy cookie plus the security center issue but no sign of virtumonde.dll any moremuha:. Really pleased about that to be honest, thanks so much for your help!!!:rockon: I'll copy and paste the report from RKUnhooker in a next post.
However i don't know what's the problem with securiy center. I have tried to use 'manage' when you right click on 'computer' and put security center on auto but it goes onto disable rear after......

[Diwis]

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6002 (Service Pack 2)
Number of processors #2
==============================================
>Drivers
==============================================
0x8C802000 C:\Windows\system32\DRIVERS\igdkmd32.sys 6299648 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x82246000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System)
0x82246000 PnpManager 3907584 bytes
0x82246000 RAW 3907584 bytes
0x82246000 WMIxWDM 3907584 bytes
0x8D402000 C:\Windows\system32\DRIVERS\NETw4v32.sys 2256896 bytes (Intel Corporation, Intel® Wireless WiFi Link Driver)
0x81880000 Win32k 2109440 bytes
0x81880000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x90207000 C:\Windows\system32\drivers\RTKVHDA.sys 1781760 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0xB740A000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110215.038\NAVEX15.SYS 1355776 bytes (Symantec Corporation, AV Engine)
0x8820A000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver)
0x87E06000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x88006000 C:\Windows\System32\drivers\tcpip.sys 970752 bytes (Microsoft Corporation, TCP/IP Driver)
0x804D6000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)
0xB3A04000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x92F16000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)
0x92E0E000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110114.001\BHDrvx86.sys 704512 bytes (Symantec Corporation, BASH Driver)
0x87C7D000 C:\Windows\system32\drivers\N360\0500000.07D\SYMEFA.SYS 671744 bytes (Symantec Corporation, Symantec Extended File Attributes)
0x8CE04000 C:\Windows\System32\drivers\dxgkrnl.sys 655360 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8CF08000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0xB3AF8000 C:\Windows\system32\drivers\N360\0500000.07D\SRTSP.SYS 544768 bytes (Symantec Corporation, Symantec AutoProtect)
0x80603000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)

[ken545]

Is that the complete Rootkit Unhooker log ?

When you ran the fix with OTL did you include :OTL at the top of the fix, if not run it again please

[Diwis]

Sorry Ken, got carried away with excitement...:oops: Done it again and made sure OTL was at the top and there is the resolt;

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
ADS C:\ProgramData\TEMP:430C6D84 deleted successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Clair and Didi
->Temp folder emptied: 191889 bytes
->Temporary Internet Files folder emptied: 7656244 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 584 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: HarwoodVA
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 66616 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 8.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.20.6 log created on 02162011_171034

Files\Folders moved on Reboot...
C:\Users\Clair and Didi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully.
C:\Users\Clair and Didi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G7R58AJ1\showthread[1].htm moved successfully.
C:\Users\Clair and Didi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\24KJHKFW\search[1].htm moved successfully.
C:\Users\Clair and Didi\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

[ken545]

Great, thanks. I knew something wasn't right

How are things running now ?

[Diwis]

Seems great thanks soooooo much!!! Just did a scan with Spybot and no more virus or cookies!! That's amazing! However the silly problem about security center stil there but it may be due to Norton??

Thanks again Ken545. Just would like to share something with you, if you don't mind.

I have checked your profile and looked in all the work you have done and really really has inspired me because this is something that I'm really interested on.

I hope I can use your advice in future

[ken545]

Hi,

Explain to me exactly whats going on with your Security Center and I can link you to a windows forum to help you fix that.

As far a removing malware, you can join out Malware Removal Classroom over at WhattheTech, we are always looking for new malware fighters and the classroom is free, graduated from there myself about 6 years ago and currently I am a classroom teacher in the classroom
http://forums.whatthetech.com/index.php?showtopic=80368

[Diwis]

Hi Ken545,

Sounds amazing thanks a lot! I'll definitely go for it.

I'm affraid to inform you that the redirect has started again. My partner uses this laptop for remote work and the 'malware' is affecting websites like www.1shoppingcart.com and others which is affecting dramaticly her work. She can get to the websites but whenever she clicks at any of the tabs or buttons in the those websites nothing happens and little error msg appears at the botton of the page, I wonder if all this has affected java scrip or similar?
I don't know if you can help but that didn't happen before the virtumonde.dll was detected.

Regarding Security Center, if you go into it appears of and when you clikc on a message shows up saying that the Security Center service can't be started. Spybot says that is a virus which is affecting the security center in fact if i go to computer management its disable and i'm constantly put back to automatic it works for a few seconds but it goes again back ti disable.

I hope all this make sence to you and isn't to much of an inconvenience

[Diwis]

Hi again,

We've just tried to work on FireFox and seems that there are no issues like the ones we experience with internet explorer.... Just to let you know

[Diwis]

Just restared settings on Internet Explorer and all looks back to normal. Except for the Security Center. But I'm really happy that almost everythin has gone to normal and laptop feels working better and faster.

Thanks so much

[ken545]

Hi,

Lets run this program

Download ComboFix from one of these locations:

Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)


* IMPORTANT !!! Save ComboFix.exe to your Desktop


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link (http://www.bleepingcomputer.com/forums/topic114351.html) for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.


Double click on ComboFix.exe & follow the prompts.


As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.


Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



http://img.photobucket.com/albums/v706/ried7/RC1.png


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

http://img.photobucket.com/albums/v706/ried7/RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

[Diwis]

ComboFix 11-02-17.01 - Clair and Didi 17/02/2011 19:17:24.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2038.980 [GMT 0:00]
Running from: c:\users\Clair and Didi\Desktop\Desktop icons don't use often\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Desktop
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Clair and Didi\AppData\Roaming\Adobe\crc.dat
c:\users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Download programs.url
c:\users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games.url
c:\users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Translator.url
c:\users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videos.url
c:\users\Clair and Didi\g2mdlhlpx.exe
c:\windows\struct~.ini

----- BITS: Possible infected sites -----

hxxp://buy-download.norton.com
.
((((((((((((((((((((((((( Files Created from 2011-01-17 to 2011-02-17 )))))))))))))))))))))))))))))))
.

2011-02-17 19:32 . 2011-02-17 19:32 -------- d-----w- c:\users\Clair and Didi\AppData\Local\temp
2011-02-17 19:32 . 2011-02-17 19:32 -------- d-----w- c:\users\HarwoodVA\AppData\Local\temp
2011-02-17 12:15 . 2011-02-17 12:15 -------- d-----w- c:\program files\Common Files\Skype
2011-02-16 13:31 . 2011-02-16 13:31 -------- d-----w- C:\_OTL
2011-02-16 11:03 . 2011-02-16 22:40 -------- d-----w- c:\users\Clair and Didi\AppData\Local\Adobe
2011-02-16 10:58 . 2011-02-16 23:16 -------- d-----w- c:\users\Clair and Didi\AppData\Local\NPE
2011-02-16 10:55 . 2011-02-16 10:55 -------- d-----w- c:\users\Clair and Didi\AppData\Roaming\Tific
2011-02-16 10:19 . 2011-02-16 10:19 -------- d-----w- c:\users\Clair and Didi\AppData\Local\Apple
2011-02-15 16:57 . 2010-08-21 04:59 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-02-15 16:57 . 2011-02-15 16:57 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-02-15 16:57 . 2011-02-15 16:57 -------- d-----w- c:\program files\Symantec
2011-02-15 16:54 . 2011-02-15 16:54 -------- d-----w- c:\windows\system32\drivers\N360
2011-02-15 16:54 . 2011-02-15 16:54 -------- d-----w- c:\program files\Norton 360 Premier Edition
2011-02-15 12:13 . 2011-02-15 12:13 -------- d-----w- c:\programdata\PCSettings
2011-02-15 12:13 . 2011-02-15 12:13 -------- d-----w- c:\programdata\NortonInstaller
2011-02-15 12:13 . 2011-02-15 12:13 -------- d-----w- c:\program files\NortonInstaller
2011-02-15 02:56 . 2011-02-15 02:56 -------- d-----w- c:\users\Clair and Didi\AppData\Roaming\AVG10
2011-02-15 02:54 . 2011-02-15 02:54 -------- d--h--w- c:\programdata\Common Files
2011-02-15 02:51 . 2011-02-15 11:37 -------- d-----w- c:\programdata\AVG10
2011-02-15 02:50 . 2011-02-17 19:06 -------- d-----w- c:\program files\AVG
2011-02-15 02:40 . 2011-02-15 02:51 -------- d-----w- c:\programdata\MFAData
2011-02-15 02:11 . 2011-02-15 02:11 -------- d-----w- c:\users\Clair and Didi\AppData\Local\Threat Expert
2011-02-15 02:06 . 2011-01-07 14:54 149456 ----a-w- c:\windows\SGDetectionTool.dll
2011-02-15 02:06 . 2011-01-07 14:54 767952 ----a-w- c:\windows\BDTSupport.dll
2011-02-15 02:06 . 2011-01-07 14:54 1533904 ----a-w- c:\windows\PCTBDRes.dll
2011-02-15 02:06 . 2011-01-07 14:54 2000848 ----a-w- c:\windows\PCTBDCore.dll
2011-02-15 01:59 . 2011-02-15 02:36 -------- d-----w- c:\program files\PC Tools Security
2011-02-14 18:50 . 2011-02-15 02:34 -------- d-----w- c:\programdata\PC Tools
2011-02-13 23:06 . 2011-02-13 23:06 -------- d-----w- c:\program files\VS Revo Group
2011-02-13 19:20 . 2011-02-15 01:16 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-02-13 19:20 . 2011-02-13 20:15 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-02-13 18:29 . 2011-02-13 23:33 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-02-13 18:29 . 2011-02-13 18:29 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-13 18:24 . 2011-02-13 18:24 -------- d-----w- c:\users\Clair and Didi\AppData\Local\Sunbelt Software
2011-02-13 17:59 . 2011-02-15 01:48 -------- d-----w- c:\programdata\Lavasoft
2011-02-13 17:59 . 2011-02-13 23:29 -------- d-----w- c:\program files\Lavasoft
2011-02-13 15:10 . 2011-02-13 20:21 -------- d-----w- c:\program files\Panda Security
2011-02-12 18:40 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys
2011-02-12 17:54 . 2011-02-12 17:54 59904 --sha-r- c:\windows\system32\NAPCLCFGC.dll
2011-02-11 10:13 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0D70C23F-4736-4498-8636-2EE0121FB560}\mpengine.dll
2011-02-09 19:38 . 2010-12-31 13:57 2039808 ----a-w- c:\windows\system32\win32k.sys
2011-02-09 19:38 . 2011-01-06 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-02-09 19:38 . 2011-01-20 14:12 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-02-09 19:38 . 2011-01-20 13:44 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-02-09 19:38 . 2011-01-20 13:44 797184 ----a-w- c:\windows\system32\FntCache.dll
2011-02-09 19:32 . 2011-01-08 08:47 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-02-09 19:32 . 2011-01-08 06:28 292352 ----a-w- c:\windows\system32\atmfd.dll
2011-02-07 22:02 . 2011-02-13 22:08 -------- d-----w- c:\program files\Frhed
2011-02-07 21:11 . 2011-02-07 21:22 -------- d-----w- c:\program files\OpenOffice.org 3
2011-02-07 21:10 . 2011-02-07 21:10 -------- d-----w- c:\program files\Common Files\Java
2011-02-07 21:07 . 2011-02-07 21:07 -------- d-----w- c:\program files\Java
2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2011-01-21 18:36 . 2011-01-21 18:36 -------- d-----w- c:\program files\SmartDoctor

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:11 . 2009-10-02 17:09 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-01-21 19:06 . 2007-02-21 20:13 2502656 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\Accent WORD Password Recovery\awrdpr.exe
2011-01-06 11:54 . 2011-02-15 02:06 2125 ----a-w- c:\windows\UDB.zip
2010-12-28 15:55 . 2011-01-12 09:32 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-20 18:09 . 2010-01-23 18:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2010-01-23 18:05 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-14 14:49 . 2011-01-12 09:31 1169408 ----a-w- c:\windows\system32\sdclt.exe
2010-12-10 13:00 . 2010-12-10 13:00 784136 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-03-31 21:47 . 2008-11-09 10:27 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-05-28 01:03 94208 ----a-w- c:\users\Clair and Didi\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-05-28 01:03 94208 ----a-w- c:\users\Clair and Didi\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-05-28 01:03 94208 ----a-w- c:\users\Clair and Didi\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-30 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-25 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-25 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-25 138008]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-13 4489216]
"SpareMessaging"="c:\program files\Spare Messaging\MessagingApp.exe" [2007-11-28 42824]
"UpdateP2GShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2007-07-26 202024]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-01-07 108496]

c:\users\Clair and Didi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer5"=wdmaud.drv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-06-29 112128]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-06-29 102912]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 PLCMP532;PLCMP532 NDIS Protocol Driver;c:\windows\system32\Drivers\PLCMP532.sys [x]
R3 PLCND532;PLCND532 NDIS Protocol Driver;c:\windows\system32\Drivers\PLCND532.sys [2007-08-08 26656]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-02-13 64512]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0500000.07D\SYMDS.SYS [2010-10-21 340016]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0500000.07D\SYMEFA.SYS [2010-11-18 652336]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [2010-11-23 691248]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110216.001\IDSvix86.sys [2010-11-11 353912]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0500000.07D\Ironx86.SYS [2010-11-16 136312]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\N360\0500000.07D\SYMTDIV.SYS [2010-12-01 330360]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [2011-01-07 247760]
S2 N360;Norton 360;c:\program files\Norton 360 Premier Edition\Engine\5.0.0.125\ccSvcHst.exe [2010-11-24 130000]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-02-15 102448]


--- Other Services/Drivers In Memory ---

*Deregistered* - Normandy

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2011-02-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-28 15:19]

2011-02-17 c:\windows\Tasks\User_Feed_Synchronization-{508EFDC1-88EF-47E2-824C-BD2D6262BAD6}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://www.king.com/ctl/kingcomie.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
FF - ProfilePath - c:\users\Clair and Didi\AppData\Roaming\Mozilla\Firefox\Profiles\icftwr6k.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://uk.search.yahoo.com/search?fr=mcafee&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: z: {e132ce4a-1cb1-43f4-8cff-b342d1e81f8a} - c:\program files\Mozilla Firefox\extensions\{e132ce4a-1cb1-43f4-8cff-b342d1e81f8a}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
FF - Ext: SearchStatus: {d57c9ff1-6389-48fc-b770-f78bd89b6e8a} - %profile%\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Browser Defender Toolbar: {cb84136f-9c44-433a-9048-c5cd9df1dc16} - c:\program files\PC Tools Security\BDT\Firefox
FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn
FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn
.
- - - - ORPHANS REMOVED - - - -

AddRemove-FileZilla Client - c:\program files\FileZilla FTP Client\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-17 19:32
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360 Premier Edition\Engine\5.0.0.125\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360 Premier Edition\Engine\5.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-02-17 19:36:52
ComboFix-quarantined-files.txt 2011-02-17 19:36

Pre-Run: 24,725,340,160 bytes free
Post-Run: 24,656,703,488 bytes free

- - End Of File - - C216DC46CA220F05803C323D95888A30


Hope your ok... A couple of redirects today... nothing else

[ken545]

We don't live with redirects, there not normal.

Please download TDSSKiller.zip (http://support.kaspersky.com/downloads/utils/tdsskiller.zip)
Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan

Only if Malicious objects are found then ensure Cure is selected
Then click Continue > Reboot now

Copy and paste the log in your next reply

A copy of the log will be saved automatically to the root of the drive (typically C:\)

[Diwis]

Scan completed with TDSSKiller and no threads found. I have been on internet for a few hours and no redirect has occured....

So I would say that is fine, what you think???

[ken545]

Sounds good. Lets do this. Use your computer for a few days and then post back and let me know how its behaving

[Diwis]

ok thanks!!:santa:

[Diwis]

Hi Ken545,

Hope you are ok

I do have a redirect once in a while, I do run ATF-Cleaner and it's cool. I'm telling you that it happens once every two days, nothing major. Other than that I did run everything you gave me and all clean!:rockon:

Thank you so much for your help and all the tools you gave me. You been really helpfull and really patient

:thanks:

[ken545]

Thanks for getting back to me, where are the redirects taking you ??

I am going to look over your post and see if we missed anything, be back around noon

[Diwis]

No redirect today, done all the scans and nothing. It was a sort of search site but I can't remeber which one. If next time occurs I let you know

[ken545]

OK, if it happens again besure to write down where its taking you. Post the info back, we close threads after 3 days so if its closed you can just PM me to reopen it .

Open OTL and click on CleanUp and it will remove programs we have used and there backups from your system


How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)



Safe Surfn
Ken

[Diwis]

Hi ken545

That's the website that takes to me first thing and then doesn't do it for the day;

http://allgreatwebsites.net/?q=jobcentreonline&src=precisead&refurl={referrer}&url={url}

[ken545]

Lets flush your DNS Cache

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Double click to run.
*** note: Win Vista and Win 7 need to right click and choose to "run as Administrator" .. the computer will reboot itself.



Let me know if it helped ?

[Diwis]

Hi there

I did what you told me to do yesterday and this morning on my first search on google again that stupid redirect

http://allgreatwebsites.net/?q=freecycle&src=precisead&refurl={referrer}&url={url}

Only does it once and is just on the first search then that's it for the day...:confused:

[ken545]

Do you use a router ?

[Diwis]

Lan connection but i'm moving house today and i would be having my own router. Do you recon that i get the redirects due to sharing network?

[ken545]

Hi,

I have worked on about a half dozen or so threads in the last month that once the router was reset the redirects stopped . They do get a bit haywire sometimes and can get infected.

When you move and set up your wireless, will this be a new router , if so then you should be alright. Have any of the people that where hooked up to your lan experienced any redirects ?