-
Then post the results of the log it produces.
I needed to see this
I was referring to the report from the OTL fix
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
- See this Link for programs that need to be disabled and instruction on how to disable them.
- Remember to re-enable them when we're done.
- Double click on ComboFix.exe & follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
-
Woops! Here's the log for the OTL from yesterday in the meantime:
OTL logfile created on: 28/01/2011 10:45:48 PM - Run 3
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Dana\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 67.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 456.98 Gb Total Space | 279.14 Gb Free Space | 61.09% Space Free | Partition Type: NTFS
Drive D: | 8.78 Gb Total Space | 1.00 Gb Free Space | 11.42% Space Free | Partition Type: NTFS
Drive E: | 3.30 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive K: | 7.55 Gb Total Space | 6.60 Gb Free Space | 87.37% Space Free | Partition Type: FAT32
Computer Name: DANA-PC | User Name: Dana | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Dana\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWWSC.exe ()
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\System32\Macromed\Flash\FlashUtil10l_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
PRC - C:\WINDOWS\System32\wpcumi.exe (Microsoft Corporation)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
========== Modules (SafeList) ==========
MOD - C:\Users\Dana\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
========== Win32 Services (SafeList) ==========
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (avg9wd) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (WPFFontCache_v0400) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (SBSDWSCService) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (fssfltr) -- C:\WINDOWS\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (AvgTdiX) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (taphss) -- C:\WINDOWS\System32\drivers\taphss.sys (AnchorFree Inc)
DRV - (Point32) -- C:\WINDOWS\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (hcw18bda) -- C:\WINDOWS\System32\drivers\hcw18bda.sys (Hauppauge Computer Works, Inc)
DRV - (ElRawDisk) -- C:\WINDOWS\System32\drivers\dddsk.sys (EldoS Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (adfs) -- C:\Windows\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (nvlddmkm) -- C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (HSXHWBS2) -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (XAudio) -- C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (NVENETFD) -- C:\WINDOWS\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://www.google.ca/ig?rls=ig&hl=en&source=iglk"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.50
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: facepad@lazyrussian.com:0.7.3
FF - prefs.js..extensions.enabledItems: {DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..keyword.URL: "http://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=9PyNom5m&q="
FF - user.js..browser.search.selectedEngine: "Search"
FF - user.js..keyword.URL: "http://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=9PyNom5m&q="
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/11/24 09:15:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/14 15:19:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/14 15:19:38 | 000,000,000 | ---D | M]
[2009/08/03 17:17:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dana\AppData\Roaming\Mozilla\Extensions
[2010/11/16 16:59:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions
[2009/08/04 18:47:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/28 10:54:58 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/12/18 22:35:52 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(71)
[2010/11/16 16:59:42 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/07/02 12:31:32 | 000,000,000 | ---D | M] (flashget3 Extension) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}
[2010/06/30 09:23:33 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/06/29 14:51:29 | 000,000,000 | ---D | M] (FacePAD: Facebook Photo Album Downloader) -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\extensions\facepad@lazyrussian.com
[2010/08/13 14:09:11 | 000,002,198 | ---- | M] () -- C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\searchplugins\google-search.xml
[2010/10/20 18:15:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/11/24 09:15:19 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2008/09/10 00:09:32 | 000,079,216 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npContribute.dll
[2007/08/07 08:25:58 | 000,001,461 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
[2009/04/07 14:59:38 | 000,000,872 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\Yahooober3233666.gif
[2009/12/12 10:21:44 | 000,000,202 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\Yahooober3233666.src
O1 HOSTS File: ([2011/01/26 12:36:05 | 000,428,884 | R--- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 14769 more lines...
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [WPCUMI] C:\WINDOWS\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
O4 - Startup: C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary...t.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01...PUplden-ca.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Dana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Dana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/21 18:42:41 | 000,000,121 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/01/28 12:12:40 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/01/27 21:31:00 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Dana\Desktop\OTL.exe
[2011/01/27 15:50:50 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/01/27 15:50:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011/01/27 15:50:20 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011/01/27 15:46:45 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Users\Dana\Desktop\erunt-setup.exe
[2011/01/27 00:30:54 | 000,000,000 | ---D | C] -- C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/01/27 00:30:53 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/01/26 14:50:06 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys
[2011/01/26 14:49:47 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2011/01/26 14:40:33 | 000,000,000 | ---D | C] -- C:\Users\Dana\AppData\Local\Sunbelt Software
[2011/01/26 14:38:02 | 000,000,000 | -H-D | C] -- C:\ProgramData\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2011/01/26 14:32:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2011/01/26 14:32:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011/01/26 14:32:53 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2011/01/26 12:48:43 | 130,359,064 | ---- | C] (Lavasoft ) -- C:\Users\Dana\Desktop\Ad-Aware90Install.exe
[2011/01/25 19:48:06 | 000,000,000 | ---D | C] -- C:\Users\Dana\Documents\Love You for Your Face
[2011/01/23 22:44:22 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Reference Photos and Inspiration
[2011/01/23 22:35:25 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Santa Pictures
[2011/01/23 22:33:32 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Christmas Stuff
[2011/01/23 22:33:30 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Christmas Door Competition
[2011/01/23 22:33:21 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Christmas 2010
[2011/01/23 22:31:26 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\.psd Files
[2011/01/23 22:30:47 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\.ai Files
[2011/01/23 22:30:27 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\.fla Files
[2011/01/23 22:30:16 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\.indd Files
[2011/01/23 22:29:51 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\TDSB
[2011/01/23 16:08:53 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Adobe Illustrator CS5
[2011/01/23 14:59:42 | 001,228,384 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Dana\Desktop\Illustrator_15_LS1.exe
[2011/01/23 10:52:09 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Adobe Application Manager 1.5
[2011/01/23 10:49:00 | 030,776,016 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Dana\Desktop\ApplicationManager1.5_all.exe
[2011/01/22 15:27:22 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\CS5
[2011/01/22 13:45:45 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\Seungri (Big Bang) - VVIP
[2011/01/19 16:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JPEG to PDF
[2011/01/19 16:24:03 | 000,000,000 | ---D | C] -- C:\Program Files\JPEG to PDF
[2011/01/19 16:22:54 | 000,591,266 | ---- | C] (jpegtopdf.com ) -- C:\Users\Dana\Desktop\jpegtopdf_setup.exe
[2011/01/17 23:47:01 | 000,000,000 | ---D | C] -- C:\aeaf14c6383169906a187a71917593
[2011/01/17 23:27:26 | 000,000,000 | ---D | C] -- C:\Windows\XSxS
[2011/01/17 23:27:26 | 000,000,000 | ---D | C] -- C:\Program Files\Xenocode
[2011/01/11 15:54:27 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2011/01/11 15:54:22 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2011/01/08 19:45:05 | 000,000,000 | ---D | C] -- C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/01/08 19:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/01/08 15:20:39 | 000,000,000 | ---D | C] -- C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanUp!
[2011/01/08 15:20:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanUp!
[2011/01/08 15:20:34 | 000,000,000 | ---D | C] -- C:\Program Files\CleanUp!
[2011/01/04 21:06:36 | 000,000,000 | ---D | C] -- C:\Users\Dana\Desktop\TVXQ - Keep Your Head Down (Full)
[2011/01/02 17:29:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP
[2011/01/02 17:28:58 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP-2.0
[2011/01/01 22:01:56 | 000,000,000 | ---D | C] -- C:\Users\Dana\Documents\Adobe
[2004/11/24 14:25:52 | 000,335,872 | ---- | C] ( ) -- C:\Windows\System32\drvc.dll
========== Files - Modified Within 30 Days ==========
[2011/01/29 14:25:44 | 004,262,047 | ---- | M] () -- C:\Users\Dana\Desktop\ComboFix.exe
[2011/01/29 14:10:32 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/29 14:10:32 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/29 13:48:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-255328087-349536182-3825070298-1000UA.job
[2011/01/29 12:49:39 | 000,114,305 | ---- | M] () -- C:\Users\Dana\Desktop\Fall%202011-Acknowledgment%20Letter.pdf
[2011/01/29 12:48:34 | 000,149,268 | ---- | M] () -- C:\Users\Dana\Desktop\Fall%202011-Conditional%20Offer%20of%20Admission-Bachelor%20of%20Technology%20-%20Graphic%20Communications%20Management.pdf
[2011/01/29 12:10:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/01/29 09:47:21 | 000,133,632 | ---- | M] () -- C:\Users\Dana\Desktop\RKUnhookerLE.EXE
[2011/01/29 09:43:08 | 070,562,341 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2011/01/29 09:39:08 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011/01/29 09:35:30 | 000,000,296 | -HS- | M] () -- C:\Windows\tasks\Jqzo.job
[2011/01/29 09:35:18 | 3085,492,224 | -HS- | M] () -- C:\hiberfil.sys
[2011/01/27 21:31:10 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Dana\Desktop\OTL.exe
[2011/01/27 20:48:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-255328087-349536182-3825070298-1000Core.job
[2011/01/27 15:50:32 | 000,000,915 | ---- | M] () -- C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/01/27 15:50:22 | 000,000,716 | ---- | M] () -- C:\Users\Dana\Desktop\ERUNT.lnk
[2011/01/27 15:47:27 | 000,624,128 | ---- | M] () -- C:\Users\Dana\Desktop\dds.scr
[2011/01/27 15:46:49 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Users\Dana\Desktop\erunt-setup.exe
[2011/01/27 09:30:03 | 000,002,521 | ---- | M] () -- C:\Users\Dana\Desktop\HiJackThis.lnk
[2011/01/27 00:27:52 | 001,402,880 | ---- | M] () -- C:\Users\Dana\Desktop\HiJackThis.msi
[2011/01/26 14:49:31 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2011/01/26 14:49:28 | 000,015,880 | ---- | M] () -- C:\Windows\System32\lsdelete.exe
[2011/01/26 14:37:55 | 000,001,033 | ---- | M] () -- C:\Users\Dana\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2011/01/26 14:37:55 | 000,001,009 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011/01/26 12:48:48 | 130,359,064 | ---- | M] (Lavasoft ) -- C:\Users\Dana\Desktop\Ad-Aware90Install.exe
[2011/01/26 12:36:05 | 000,428,884 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/01/25 17:28:37 | 003,134,265 | ---- | M] () -- C:\Users\Dana\Desktop\Approval.pdf
[2011/01/24 00:07:31 | 000,606,378 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/24 00:07:30 | 000,108,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/23 22:32:53 | 000,025,088 | ---- | M] () -- C:\Users\Dana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/23 22:01:16 | 003,852,872 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/01/23 18:33:16 | 000,079,360 | RHS- | M] () -- C:\Windows\System32\mmsysd.dll
[2011/01/23 14:59:54 | 001,228,384 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Dana\Desktop\Illustrator_15_LS1.exe
[2011/01/23 10:49:54 | 030,776,016 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Dana\Desktop\ApplicationManager1.5_all.exe
[2011/01/22 22:56:40 | 000,086,861 | ---- | M] () -- C:\Users\Dana\Documents\My teachers.docx
[2011/01/22 13:42:02 | 057,809,982 | ---- | M] () -- C:\Users\Dana\Desktop\Seungri (Big Bang) - VVIP (iHoneydew.com).zip
[2011/01/21 16:39:19 | 004,419,739 | ---- | M] () -- C:\Users\Dana\Desktop\Jaejoong with make up.psd
[2011/01/19 16:23:03 | 000,591,266 | ---- | M] (jpegtopdf.com ) -- C:\Users\Dana\Desktop\jpegtopdf_setup.exe
[2011/01/15 16:30:29 | 017,321,763 | ---- | M] () -- C:\Users\Dana\Desktop\Functions_11.rar
[2011/01/15 15:39:23 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011/01/12 17:39:41 | 000,011,901 | ---- | M] () -- C:\Users\Dana\Documents\long long link.docx
[2011/01/10 16:26:18 | 000,000,144 | ---- | M] () -- C:\Users\Dana\AppData\Roaming\wklnhst.dat
[2011/01/08 19:45:04 | 000,000,816 | ---- | M] () -- C:\Users\Public\Desktop\WinRAR.lnk
[2011/01/03 20:14:11 | 001,366,019 | ---- | M] () -- C:\Users\Dana\Desktop\KeeleMap.pdf
[2011/01/02 17:45:27 | 000,001,420 | ---- | M] () -- C:\Users\Dana\.recently-used.xbel
[2011/01/02 17:29:57 | 000,000,902 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2011/01/01 19:26:35 | 000,223,760 | ---- | M] () -- C:\Users\Dana\Desktop\Puzzle (13).JPG
========== Files Created - No Company Name ==========
[2011/01/29 14:25:42 | 004,262,047 | ---- | C] () -- C:\Users\Dana\Desktop\ComboFix.exe
[2011/01/29 12:49:39 | 000,114,305 | ---- | C] () -- C:\Users\Dana\Desktop\Fall%202011-Acknowledgment%20Letter.pdf
[2011/01/29 12:48:34 | 000,149,268 | ---- | C] () -- C:\Users\Dana\Desktop\Fall%202011-Conditional%20Offer%20of%20Admission-Bachelor%20of%20Technology%20-%20Graphic%20Communications%20Management.pdf
[2011/01/29 09:47:20 | 000,133,632 | ---- | C] () -- C:\Users\Dana\Desktop\RKUnhookerLE.EXE
[2011/01/27 16:53:55 | 000,152,064 | ---- | C] () -- C:\Users\Dana\Desktop\Page Layout.ppt
[2011/01/27 16:53:39 | 003,040,768 | ---- | C] () -- C:\Users\Dana\Desktop\DPI and Resolution.ppt
[2011/01/27 16:53:39 | 000,829,440 | ---- | C] () -- C:\Users\Dana\Desktop\Elements and Principles of Design.ppt
[2011/01/27 16:53:39 | 000,415,232 | ---- | C] () -- C:\Users\Dana\Desktop\designbrief.ppt
[2011/01/27 16:53:11 | 004,781,568 | ---- | C] () -- C:\Users\Dana\Desktop\Writing About Design.ppt
[2011/01/27 16:53:11 | 000,735,744 | ---- | C] () -- C:\Users\Dana\Desktop\Some inspiration.ppt
[2011/01/27 15:50:32 | 000,000,915 | ---- | C] () -- C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/01/27 15:50:22 | 000,000,716 | ---- | C] () -- C:\Users\Dana\Desktop\ERUNT.lnk
[2011/01/27 15:47:17 | 000,624,128 | ---- | C] () -- C:\Users\Dana\Desktop\dds.scr
[2011/01/27 00:30:54 | 000,002,521 | ---- | C] () -- C:\Users\Dana\Desktop\HiJackThis.lnk
[2011/01/27 00:27:50 | 001,402,880 | ---- | C] () -- C:\Users\Dana\Desktop\HiJackThis.msi
[2011/01/26 23:17:38 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011/01/26 23:07:48 | 000,015,880 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2011/01/26 14:37:55 | 000,001,033 | ---- | C] () -- C:\Users\Dana\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2011/01/26 14:37:55 | 000,001,009 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011/01/25 17:28:37 | 003,134,265 | ---- | C] () -- C:\Users\Dana\Desktop\Approval.pdf
[2011/01/23 22:34:31 | 000,025,088 | ---- | C] () -- C:\Users\Dana\Desktop\A father's Poem (use for layout).doc
[2011/01/23 18:33:41 | 000,000,296 | -HS- | C] () -- C:\Windows\tasks\Jqzo.job
[2011/01/23 18:33:16 | 000,079,360 | RHS- | C] () -- C:\Windows\System32\mmsysd.dll
[2011/01/23 17:17:48 | 000,001,433 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS5.lnk
[2011/01/23 17:14:54 | 000,000,964 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2011/01/23 17:11:56 | 000,001,057 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2011/01/23 17:01:30 | 000,001,148 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2011/01/23 17:00:32 | 000,001,310 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2011/01/23 16:57:02 | 000,000,876 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2011/01/22 22:56:38 | 000,086,861 | ---- | C] () -- C:\Users\Dana\Documents\My teachers.docx
[2011/01/22 13:37:57 | 057,809,982 | ---- | C] () -- C:\Users\Dana\Desktop\Seungri (Big Bang) - VVIP (iHoneydew.com).zip
[2011/01/21 16:39:16 | 004,419,739 | ---- | C] () -- C:\Users\Dana\Desktop\Jaejoong with make up.psd
[2011/01/15 16:31:08 | 018,430,474 | ---- | C] () -- C:\Users\Dana\Desktop\Functions_11.pdf
[2011/01/15 16:27:48 | 017,321,763 | ---- | C] () -- C:\Users\Dana\Desktop\Functions_11.rar
[2011/01/12 17:39:41 | 000,011,901 | ---- | C] () -- C:\Users\Dana\Documents\long long link.docx
[2011/01/08 19:45:04 | 000,000,816 | ---- | C] () -- C:\Users\Public\Desktop\WinRAR.lnk
[2011/01/03 20:14:11 | 001,366,019 | ---- | C] () -- C:\Users\Dana\Desktop\KeeleMap.pdf
[2011/01/02 17:45:27 | 000,001,420 | ---- | C] () -- C:\Users\Dana\.recently-used.xbel
[2011/01/02 17:29:57 | 000,000,902 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2011/01/01 19:26:34 | 000,223,760 | ---- | C] () -- C:\Users\Dana\Desktop\Puzzle (13).JPG
[2010/11/17 17:04:45 | 000,000,144 | ---- | C] () -- C:\Users\Dana\AppData\Roaming\wklnhst.dat
[2010/08/20 13:26:10 | 000,007,728 | ---- | C] () -- C:\Users\Dana\AppData\Local\d3d9caps.dat
[2010/07/02 12:31:11 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010/05/13 20:51:39 | 000,004,096 | -H-- | C] () -- C:\Users\Dana\AppData\Local\keyfile3.drm
[2010/04/27 17:41:30 | 000,000,016 | ---- | C] () -- C:\Windows\encore_launcher.ini
[2010/04/27 17:41:08 | 000,000,158 | ---- | C] () -- C:\Windows\compedia.ini
[2009/09/20 18:31:47 | 000,000,000 | ---- | C] () -- C:\Windows\System32\tBass.dll
[2009/09/10 19:15:40 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/19 21:32:59 | 000,025,088 | ---- | C] () -- C:\Users\Dana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/19 10:15:58 | 004,338,246 | ---- | C] () -- C:\Windows\System32\libavcodec.dll
[2008/12/17 12:41:18 | 000,884,237 | ---- | C] () -- C:\Windows\System32\ff_x264.dll
[2008/12/17 12:22:58 | 000,093,184 | ---- | C] () -- C:\Windows\System32\ff_wmv9.dll
[2008/12/17 12:22:48 | 000,057,344 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2008/12/17 12:17:34 | 000,239,247 | ---- | C] () -- C:\Windows\System32\ff_theora.dll
[2008/12/17 11:59:54 | 000,560,802 | ---- | C] () -- C:\Windows\System32\libmplayer.dll
[2007/06/01 15:15:20 | 000,000,311 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/06/01 15:03:14 | 000,066,048 | ---- | C] () -- C:\Windows\System32\hcwxds.dll
[2007/06/01 14:51:28 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
[2007/06/01 14:51:27 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
[2007/03/06 03:47:24 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2007/01/12 09:07:48 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2007/01/12 09:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2004/10/03 12:50:54 | 000,129,024 | ---- | C] () -- C:\Windows\System32\ff_mpeg2enc.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 292 bytes -> C:\ProgramData\TEMP:9AF3A05F
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:59D05D9A
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:1C5692E6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:91730504
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:73C25840
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:3857ABB7
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:B54102AD
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:DD842FD5
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:14750D76
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:F50F1555
< End of report >
-
And here's my ComboFix log:
ComboFix 11-01-28.03 - Dana 29/01/2011 15:53:12.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2942.1992 [GMT -5:00]
Running from: c:\users\Dana\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-29 )))))))))))))))))))))))))))))))
.
2011-01-29 21:03 . 2011-01-29 21:04 -------- d-----w- c:\users\Dana\AppData\Local\temp
2011-01-29 21:03 . 2011-01-29 21:03 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-01-29 21:03 . 2011-01-29 21:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-29 21:03 . 2011-01-29 21:03 -------- d-----w- c:\users\Cheeselund\AppData\Local\temp
2011-01-28 17:12 . 2011-01-28 17:12 -------- d-----w- C:\_OTL
2011-01-27 20:50 . 2011-01-27 20:50 -------- d-----w- c:\program files\ERUNT
2011-01-27 05:30 . 2011-01-27 05:30 388096 ----a-r- c:\users\Dana\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-27 05:30 . 2011-01-27 05:30 -------- d-----w- c:\program files\Trend Micro
2011-01-26 19:49 . 2011-01-26 19:49 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-01-26 19:40 . 2011-01-26 19:40 -------- d-----w- c:\users\Dana\AppData\Local\Sunbelt Software
2011-01-26 19:38 . 2011-01-29 19:55 -------- dc-h--w- c:\programdata\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2011-01-26 19:32 . 2011-01-26 19:49 -------- d-----w- c:\programdata\Lavasoft
2011-01-26 19:32 . 2011-01-26 19:32 -------- d-----w- c:\program files\Lavasoft
2011-01-23 23:33 . 2011-01-23 23:33 79360 --sha-r- c:\windows\system32\mmsysd.dll
2011-01-19 21:24 . 2011-01-19 21:24 -------- d-----w- c:\program files\JPEG to PDF
2011-01-18 04:47 . 2011-01-18 04:47 -------- d-----w- C:\aeaf14c6383169906a187a71917593
2011-01-18 04:27 . 2011-01-18 04:27 -------- d-----w- c:\program files\Xenocode
2011-01-11 20:54 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2011-01-11 20:54 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-01-11 20:54 . 2010-12-28 15:53 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-01-11 20:54 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-01-11 20:54 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2011-01-11 20:54 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-01-11 20:54 . 2010-12-14 14:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
2011-01-08 20:20 . 2011-01-08 20:20 -------- d-----w- c:\program files\CleanUp!
2011-01-02 22:28 . 2011-01-02 22:29 -------- d-----w- c:\program files\GIMP-2.0
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 23:09 . 2010-10-22 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 23:08 . 2010-10-22 22:54 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-09 13:58 . 2010-12-09 13:58 605960 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-04 18:56 . 2010-12-16 22:34 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-04 18:55 . 2010-12-16 22:34 352768 ----a-w- c:\windows\system32\taskschd.dll
2010-11-04 18:55 . 2010-12-16 22:34 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-11-04 18:55 . 2010-12-16 22:34 601600 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-04 16:34 . 2010-12-16 22:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-11-02 06:01 . 2010-12-16 22:34 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-02 05:57 . 2010-12-16 22:34 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-02 05:57 . 2010-12-16 22:34 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-02 05:57 . 2010-12-16 22:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-11-02 05:57 . 2010-12-16 22:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-11-02 05:01 . 2010-12-16 22:34 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 04:26 . 2010-12-16 22:34 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-11-02 04:24 . 2010-12-16 22:34 1638912 ----a-w- c:\windows\system32\mshtml.tlb
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-11-08 497648]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]
c:\users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Dana^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ViiKiiDesktopPlugin.lnk]
path=c:\users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ViiKiiDesktopPlugin.lnk
backup=c:\windows\pss\ViiKiiDesktopPlugin.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 11:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-08-03 22:14 133104 ----atw- c:\users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 22:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-09-23 05:47 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SnapfishMediaDetector]
2007-03-02 21:55 1441792 ----a-w- c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-08-31 20:06 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-09-28 00:18 328056 ----a-w- c:\program files\uTorrent\uTorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\dddsk.sys [2009-02-12 22312]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2009-03-20 391168]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2011-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-255328087-349536182-3825070298-1000Core.job
- c:\users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-03 22:14]
2011-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-255328087-349536182-3825070298-1000UA.job
- c:\users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-03 22:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\4cg5rcw3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/ig?rls=ig&hl=en&source=iglk
FF - prefs.js: keyword.URL - hxxp://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=9PyNom5m&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: FacePAD: Facebook Photo Album Downloader: facepad@lazyrussian.com - %profile%\extensions\facepad@lazyrussian.com
FF - Ext: flashget3 Extension: {DB9127A2-3381-41ec-82B3-1B6ED4C6F29A} - %profile%\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - user.js: keyword.URL - hxxp://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=9PyNom5m&q=
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-29 16:04
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-01-29 16:05:44
ComboFix-quarantined-files.txt 2011-01-29 21:05
ComboFix2.txt 2011-01-29 20:15
Pre-Run: 300,199,849,984 bytes free
Post-Run: 300,168,880,128 bytes free
- - End Of File - - 96B5DB6CDDCBDDD7B6CF37493D5B9FA8
-
-
Hi,
I've uninstalled utorrent just as you requested. As for the Viikii plugin, it's used to translate videos to English or something like that. It's been a long time since I've last touched it. But now I removed it since I won't be using that.
By the way, here's the result from the ESET online scan:
C:\Users\Dana\Desktop\New Folder\HSS-1.49-install-anchorfree-76-conduit.exe a variant of Win32/HotSpotShield application
-
How are things running now ?
-
From the scan result that I just gave you, I shredded the file using Spybot's File Shredder.
Thank you so much for helping me fix the search redirect problem.
-
Your very welcome,
Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups
Safe Surfn
Ken
-
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules